vSphere Security provides information about securing your vSphere® environment for VMware® vCenter® Server and VMware ESXi.

To help you protect your vSphere environment, this documentation describes available security features and the measures that you can take to safeguard your environment from attack.

Table 1. vSphere Security Highlights
Topics Content Highlights
Permissions and User Management
  • Permissions model (roles, groups, objects).
  • Creating custom roles.
  • Setting permissions.
  • Managing global permissions.
Host Security Features
  • Lockdown mode and other security profile features.
  • Host smart card authentication.
  • vSphere Authentication Proxy.
  • UEFI Secure Boot.
  • Trusted Platform Module (TPM).
Virtual Machine Encryption
  • How does VM encryption work?
  • KMS setup.
  • Encrypting and decrypting VMs.
  • Troubleshooting and best practices.
Guest OS Security
  • Virtual Trusted Platform Module (vTPM).
  • Virtualization Based Security (VBS).
Managing TLS Protocol Configuration Changing TLS protocol configuration using a command-line utility.
Security Best Practices and Hardening Best practices and advice from VMware security experts.
  • vCenter Server security
  • Host security
  • Virtual machine security
  • Networking security
vSphere Privileges Complete listing of all vSphere privileges supported in this release.

Related Documentation

A companion document, Platform Services Controller Administration, explains how you can use the Platform Services Controller services, for example, to manage authentication with vCenter Single Sign-On and to manage certificates in your vSphere environment.

In addition to these documents, VMware publishes the vSphere Security Configuration Guide (formerly known as the Hardening Guide) for each release of vSphere, accessible at http://www.vmware.com/security/hardening-guides.html. The vSphere Security Configuration Guide contains guidelines on security settings that can or should be set by the customer, and security settings delivered by VMware that should be audited by the customer to ensure that they are still set to default.

Intended Audience

This information is for experienced Windows or Linux system administrators who are familiar with virtual machine technology and data center operations.

vSphere Client and vSphere Web Client

Instructions in this guide reflect the vSphere Client (an HTML5-based GUI). You can also use the instructions to perform the tasks by using the vSphere Web Client (a Flex-based GUI).

Tasks for which the workflow differs significantly between the vSphere Client and the vSphere Web Client have duplicate procedures that provide steps according to the respective client interface. The procedures that relate to the vSphere Web Client, contain vSphere Web Client in the title.

Note: In vSphere 6.7 Update 1, almost all of the vSphere Web Client functionality is implemented in the vSphere Client. For an up-to-date list of any remaining unsupported functionality, see Functionality Updates for the vSphere Client.

Certifications

VMware publishes a public list of VMware products that have completed Common Criteria certifications. To check if a particular VMware product version has been certified, see the Common Criteria Evaluation and Validation webpage at https://www.vmware.com/security/certifications/common-criteria.html.

Support for Federal Information Processing Standard 140-2

Starting with version 6.7, vCenter Server supports the Federal Information Processing Standard (FIPS) 140-2.

FIPS 140-2 is a U.S. and Canadian government standard that specifies security requirements for cryptographic modules. By default, FIPS 140-2 is always enabled after installation or upgrade of vCenter Server 6.7 or greater, and ESXi 6.7 or greater.

To learn more about support for FIPS 140-2 in VMware products, see https://www.vmware.com/security/certifications/fips.html.