vrealize-automation-62-hardening

Recommendations

Info

VMware vRealize Automation 6.2 Hardening Guide443/8443(VMRC)7444Users84437444Identity Appliance389/636AD /OpenLDAP7444vRealize Appliance443Application ServicesAppliance44344374448443 & 5671FabricInfrastructure CoreApplication DirectorAgentContent Server1433SQL DatabaseServerFigure 1. Major components discussed in this document.T E C H N I C A L W H I T E P A P E R / 6
VMware vRealize Automation 6.2 Hardening GuidevRealize Hardening ToolYou can use the vRealize Hardening Tool to ensure that the secure baseline is reached and maintained. The vRealizeHardening Tool is available on the VMware vRealize Automation Drivers & Tools download page.Prerequisites for Non-Windows MachinesThe vRealize Hardening Tool is based on Ansible, which is an open-source software platform for configuring andmanaging computers that you can install by following the installation guidelines available athttp://docs.ansible.com/intro_installation.html.Verify that the Ansible software is installed.Run the following command.ansible --versionIf any errors appear, see the /Readme.txt file for instructions on how to install the missingmodules that are required to run Ansible.Set Up the vRealize Hardening ToolSet up the vRealize Hardening Tool.Run the following command.tar -zxvf vrhtool.tar.gzModify the list of vRealize Appliances on which the configuration changes are to occur.a. Edit the inventory.yaml file located in /baseline/v1.0/roles.b. Replace with the FQDN of your vRealize Appliance.c. Replace and with the ssh credentials that are required for the vRealizeHardening Tool to modify the vRealize Appliance.You can include multiple vRealize Appliances, as shown in the following example.Run the vRealize Hardening Tool in UI ModeRun the vRealize Hardening Tool in UI mode.Change to the directory where the tool resides by running the following command.cd Enter the following command.python script/vRHT.pyT E C H N I C A L W H I T E P A P E R / 7
Page 1 and 2: VMwarevRealize AutomationHardening
Page 3 and 4: VMware vRealize Automation 6.2 Hard
Page 5: VMware vRealize Automation 6.2 Hard
Page 17 and 18: Bootloader AuthenticationIf the sys
Page 19 and 20: section.[{ssl, [{versions, ['tlsv1.
Page 21 and 22: The preferred server cipher is TLS_
Page 23 and 24: ]},{rabbit, [{ssl_listeners, [5672]
Page 25 and 26: 499900 48 -rwsr-x--- 1 root message
Page 27 and 28: PostgreSQL (vRealize Appliance)Clie
Page 29 and 30: Prevent the Bluetooth protocol hand
Page 31 and 32: Appletalk ProtocolYou should preven
Page 33 and 34: Verify Host Server’s Secure Basel
Page 35 and 36: Delete and Disable Unnecessary Appl
Page 37 and 38: Identity ApplianceCreate a blank se
Page 39 and 40: Disable IPv4 Proxy ARPIPv4 Proxy AR
Page 41 and 42: Deny IPv4 forwardingIf the system i
Page 43 and 44: Deny IPv6 Router PrefixThe accept r
Page 45 and 46: Ports Required to be Exposed to Adm
Page 47 and 48: Minimum Required Outgoing PortsCOMP

vrealize-automation-62-hardening

Create successful ePaper yourself

Delete template?

Save as template?