VMware has finally released their draft version of the security hardening guides for vSphere 4.0. After taking a look at some of them, I’ll make a few observations:
1) Totally different format than previous versions, now organized in tables. Very similar to the DISA STIG security guides.
2) VMware adopted various security levels (DMZ, Enterprise, SSLF). They took the SSLF designation from Microsoft, it seems. SSLF is the most secure setting, which usually breaks some functionality.
3) When using Foxit many of the hot URL links didn’t work. Manually cutting and pasting links into IE worked most of the time. If that fails, Google the title of the document.
4) The guides cover ESX, ESXi, vCenter, VMs, networking, and the ESX console OS.
Overall, I think these are much better and more usable products than their 3.x versions. I get the sense that VMware worked with DISA on these settings, or at least tried to follow a similar organized format. The five guides are around 20 pages each, which is long enough to be thorough but not overwhelming large.
