VMware VCENTER CONFIGURATION MANAGER 5.3 - SOFTWARE CONTENT REPOSITORY TOOL GUIDE Bedienungsanleitung PDF herunterladen (Seite 19)

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 19

8.0 IIS Preparation

VCM IIS web service and virtual directories should be properly prepared as described in the following sections.

8.1 IIS set to use Windows integrated authentication for the VCM Web site root

The interface to the VCM console is through a thin browser-based interface to an IIS served web application located at

the /VCM virtual directory. Integrated Windows Authentication (IWA) should be used with this directory. This can be

done by setting the IIS metabase property NTAuthenticationProviders to the string 'Negotiate,NTML'. This is the

default value, but VCM administrators should explicitly set this value at the /VCM directory regardless, in case

subsequent modifications to the IIS metabase would unintentionally override the default value. Locate instructions for

setting the metabase property in Microsoft Knowledge Base Article 215383, “How to configure IIS to support both the

Kerberos protocol and the NTLM protocol for network authentication.”

8.2 VCM Web Service uses HTTPS

Although it is possible to use the VCM UI across HTTP, this should not be done, as collection results, configuration

data, and configured passwords will travel across the network insecurely. The VCM document root should be set to

require HTTPS by following the directions described in Microsoft Knowledge Base Article 324069, “How to Set Up an

HTTPS Service in IIS"

. HTTPS not only provides security against snooping, it also assures connection to a

legitimate (not spoof) instance of VCM.

In addition, an HTTPS connection activates security precautions built into IE when combined with the IE configuration

recommendations listed later.

SSRS reports should also be set to use HTTPS, as described in the VCM Hardware and Software Requirements

Guide.

8.3 SSL/HTTPS certificate issued by trusted CA or self Issued

When VCM uses SSL, TLS, or HTTPS, it authenticates machines using certificates by certificate authorities (CA).

These CAs must either be internal (customer) CAs or members of the Microsoft Root Certificate Program list.

1 2 ... 14 15 16 17 18 19 20 21 22 23 24 ... 34 35

Keine Kommentare

VMware VCENTER CONFIGURATION MANAGER 5.3 - SOFTWARE CONTENT REPOSITORY TOOL GUIDE Bedienungsanleitung Seite 19