Mastering VMware Security: How to Use PowerCLI to Run the VMware STIGs
![An illustration depicting a computer server shielded with a lock, symbolizing secure VMware infrastructure.](https://simeononsecurity.com/img/cover/an_illustration_depicting_a_computer_server_sh_240x135.webp)
Table of Contents
How to Use PowerCLI to STIG VMware
PowerCLI is a powerful automation and scripting tool that allows users to manage and configure VMware environments using PowerShell. In this article, we will explore how to leverage PowerCLI to implement the VMware STIG (Security Technical Implementation Guide) for securing VMware ESXi and virtual machines.
Introduction
The VMware STIG provides guidelines and recommendations for securely configuring and managing VMware infrastructure. By following the STIG, organizations can enhance the security posture of their VMware deployments and ensure compliance with relevant government regulations, such as the Defense Information Systems Agency (DISA) STIG.
What is PowerCLI?
PowerCLI is a command-line interface and scripting tool for managing VMware environments. It is built on top of PowerShell and provides a vast set of cmdlets specifically designed for VMware administration. With PowerCLI, administrators can automate repetitive tasks, perform configuration changes, and gather information from VMware infrastructure.
Installation and Requirements
Before getting started with PowerCLI and VMware STIG, ensure that you have the following prerequisites:
- PowerCLI 11.3
: Install PowerCLI using the PowerShell Gallery with the command
Install-Module VMware.PowerCLI -force
. - Powershell 5 or newer : Ensure you have PowerShell version 5 or newer installed.
- ESXi 6.7 U2+ : Make sure you are using ESXi version 6.7 U2 or above.
Automating VMware VCSA STIG
The VMware ESXi STIG provides guidelines for securing ESXi hosts. By automating the implementation of STIG controls, administrators can streamline the process and ensure consistent configuration across multiple hosts.
Considerations
Before proceeding with the automation, it is important to consider the following points:
- Ensure that no virtual machine or guest on the ESXi host or cluster requires CD, USB, or Floppy Disk functionality.
- All ESXi hosts and guests tied to vCenter need to be STIG’ed.
- Troubleshooting skills are necessary to address any issues that may arise during the process.
Script: VMware VCSA STIG Automation
The following PowerCLI script can be used to automate the implementation of selected STIG controls for VCSAs:
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $false -Confirm:$false
$vcenters = 127.0.0.1, 127.0.0.2
#Connect to each vcenter server
ForEach ($vc in $vcenters) {
Connect-VIServer -Server $vc
}
#Automated
Write-Host "Vul ID: V-243098 Rule ID: SV-243098r719537_rule STIG ID: VCTR-67-000036"
Write-Host "If the 'config.log.level' value is not set to "info" or does not exist, this is a finding."
ForEach ($vc in $vcenters) {
Get-AdvancedSetting -Entity $vc -Name config.log.level | Set-AdvancedSetting -Value info
Get-AdvancedSetting -Entity $vc -Name config.log.level
}
Write-Host "Vul ID: V-243090 Rule ID: SV-243090r719513_rule STIG ID: VCTR-67-000024"
Write-Host "If the 'config.vpxd.hostPasswordLength' is set to a value other than "32", this is a finding.
If the setting does not exist, this is not a finding."
ForEach ($vc in $vcenters) {
Get-AdvancedSetting -Entity $vc -Name config.vpxd.hostPasswordLength | Set-AdvancedSetting -Value 32
Get-AdvancedSetting -Entity $vc -Name config.vpxd.hostPasswordLength
}
Write-Host "Vul ID: V-243089 Rule ID: SV-243089r719510_rule STIG ID: VCTR-67-000023"
Write-Host "If the 'VirtualCenter.VimPasswordExpirationInDays' is set to a value other than "30" or does not exist, this is a finding."
ForEach ($vc in $vcenters) {
Try {
Get-AdvancedSetting -Entity $vc -Name VirtualCenter.VimPasswordExpirationInDays | Set-AdvancedSetting -Value 30
}
Catch {
New-AdvancedSetting -Entity $vc -Name VirtualCenter.VimPasswordExpirationInDays -Value 30
}
}
Write-Host "Vul ID: V-243084 Rule ID: SV-243085r719498_rule STIG ID: VCTR-67-000016"
Write-Host "If NetFlow is configured and the collector IP is not known and documented, this is a finding."
$pgs = Get-VDPortgroup | Get-View
ForEach ($pg in $pgs) {
$spec = New-Object VMware.Vim.DVPortgroupConfigSpec
$spec.configversion = $pg.Config.ConfigVersion
$spec.defaultPortConfig = New-Object VMware.Vim.VMwareDVSPortSetting
$spec.defaultPortConfig.ipfixEnabled = New-Object VMware.Vim.BoolPolicy
$spec.defaultPortConfig.ipfixEnabled.inherited = $false
$spec.defaultPortConfig.ipfixEnabled.value = $false
$pg.ReconfigureDVPortgroup_Task($spec)
}
Get-VDPortgroup | Select-Object Name, VirtualSwitch, @{N = "NetFlowEnabled"; E = { $_.Extensiondata.Config.defaultPortConfig.ipfixEnabled.Value } }
Write-Host "Vul ID: V-243084 Rule ID: SV-243084r719495_rule STIG ID: VCTR-67-000015"
Write-Host "The vCenter Server must set the distributed port group Promiscuous Mode policy to reject."
Get-VDSwitch | Get-VDSecurityPolicy | Set-VDSecurityPolicy -AllowPromiscuous $false
Get-VDPortgroup | Where-Object { $_.IsUplink -eq $false } | Get-VDSecurityPolicy | Set-VDSecurityPolicy -AllowPromiscuous $false
Get-VDSwitch | Get-VDSecurityPolicy
Get-VDPortgroup | Where-Object { $_.IsUplink -eq $false } | Get-VDSecurityPolicy
Write-Host "Vul ID: V-243083 Rule ID: SV-243083r719492_rule STIG ID: VCTR-67-000014"
Write-Host "The vCenter Server must set the distributed port group MAC Address Change policy to reject."
Get-VDSwitch | Get-VDSecurityPolicy | Set-VDSecurityPolicy -MacChanges $false
Get-VDPortgroup | Where-Object { $_.IsUplink -eq $false } | Get-VDSecurityPolicy | Set-VDSecurityPolicy -MacChanges $false
Get-VDPortgroup | Where-Object { $_.IsUplink -eq $false } | Get-VDSecurityPolicy
Write-Host "Vul ID: V-243082 Rule ID: SV-243082r719489_rule STIG ID: VCTR-67-000013"
Write-Host "The vCenter Server must set the distributed port group Forged Transmits policy to reject."
Get-VDSwitch | Get-VDSecurityPolicy | Set-VDSecurityPolicy -ForgedTransmits $false
Get-VDPortgroup | Where-Object { $_.IsUplink -eq $false } | Get-VDSecurityPolicy | Set-VDSecurityPolicy -ForgedTransmits $false
Get-VDSwitch | Get-VDSecurityPolicy
Get-VDPortgroup | Where-Object { $_.IsUplink -eq $false } | Get-VDSecurityPolicy
Write-Host "Vul ID: V-243081 Rule ID: SV-243081r719486_rule STIG ID: VCTR-67-000012"
Write-Host "The vCenter Server must disable the distributed virtual switch health check."
Get-View -ViewType DistributedVirtualSwitch | Where-Object { ($_.config.HealthCheckConfig | Where-Object { $_.enable -notmatch "False" }) } | ForEach-Object { $_.UpdateDVSHealthCheckConfig(@((New-Object Vmware.Vim.VMwareDVSVlanMtuHealthCheckConfig -property @{enable = 0 }), (New-Object Vmware.Vim.VMwareDVSTeamingHealthCheckConfig -property @{enable = 0 }))) }
$vds = Get-VDSwitch
$vds.ExtensionData.Config.HealthCheckConfig
Write-Host "Vul ID: V-243077 Rule ID: SV-243077r719474_rule STIG ID: VCTR-67-00000"
Write-Host "The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information-flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC)."
Write-Host "If an alarm is not created and enabled to alert when syslog failures occur, this is a finding."
ForEach ($vdswitch in (Get-VDSwitch.name)){
(Get-VDSwitch $vdswitch | Get-View).EnableNetworkResourceManagement($true)
}
Get-VDSwitch | Select-Object Name, @{N = "NIOC Enabled"; E = { $_.ExtensionData.config.NetworkResourceManagementEnabled } }
#Manual Review
Write-Host "Vul ID: V-243076 Rule ID: SV-243076r719471_rule STIG ID: VCTR-67-000005"
Write-Host "The vCenter Server users must have the correct roles assigned."
Write-Host "Application service account and user required privileges should be documented.
If any user or service account has more privileges than required, this is a finding."
Get-VIPermission | Sort-Object Role | Select-Object Role, Principal, Entity, Propagate, IsGroup | Format-Table -Auto
Write-Host "Vul ID: V-243119 Rule ID: SV-243119r719600_rule STIG ID: VCTR-67-000064"
Write-Host "If any role other than Administrator and any site-specific group(s) have any of these permissions, this is a finding."
$roles = Get-VIRole
ForEach ($role in $roles) {
$privileges = $role.PrivilegeList
If ($privileges -match "Crypto*" -or $privileges -match "Global.Diagnostics" -or $privileges -match "Host.Inventory.Add*" -or $privileges -match "Host.Local operations.Manage user groups") {
Write-Host "$role has Cryptographic privileges"
}
}
Write-Host "Vul ID: V-243118 Rule ID: SV-243118r719597_rule STIG ID: VCTR-67-000063"
Write-Host "If there are any users other than Solution Users with the "Administrator" role that are not explicitly designated for cryptographic operations, this is a finding."
Get-VIPermission | Where-Object { $_.Role -eq "Admin" } | Select-Object Role, Principal, Entity, Propagate, IsGroup | Format-Table -Auto
Write-Host "Vul ID: V-243111 Rule ID: SV-243111r719576_rule STIG ID: VCTR-67-000055"
Write-Host "If no clusters are enabled for vSAN, this is not applicable."
Write-host "If vSAN is enabled and the datastore is named 'vsanDatastore', this is a finding."
If ($(Get-Cluster | Where-Object { $_.VsanEnabled } | Measure-Object).Count -gt 0) {
Write-Host "vSAN Enabled Cluster found"
$Clusters = Get-Cluster | Where-Object { $_.VsanEnabled }
Foreach ($clus in $clusters) {
$clus | Get-Datastore | Where-Object { $_.type -match "vsan" } | Set-Datastore -Name $(($clus.name) + "_vSAN_Datastore")
}
}
else {
Write-Host "vSAN is not enabled, this finding is not applicable"
}
Write-Host "If any user or service account has more privileges than required, this is a finding."
Get-VIPermission | Sort-Object Role | Select-Object Role, Principal, Entity, Propagate, IsGroup | Format-Table -Auto
Write-Host "Vul ID: V-243088 Rule ID: SV-243088r719507_rule STIG ID: VCTR-67-000020"
Write-Host "Review the port group VLAN tags and verify they are not set to a reserved VLAN ID."
Write-Host "Certain physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001–1024 and 4094, while Nexus switches typically reserve 3968–4047 and 4094."
Get-VDPortgroup | Select-Object Name, VlanConfiguration
Write-Host "Vul ID: V-243087 Rule ID: SV-243087r719504_rule STIG ID: VCTR-67-000019"
Write-Host "If any port group is configured with 'VLAN Trunk' and is not documented as a needed exception (such as NSX appliances), this is a finding.
If any port group is authorized to be configured with 'VLAN trunking' but is not configured with the most limited range necessary, this is a finding."
Get-VDPortgroup | Where-Object { $_.ExtensionData.Config.Uplink -ne "True" } | Select-Object Name, VlanConfiguration
Write-Host "Vul ID: V-243078 Rule ID: SV-243078r719644_rule STIG ID: VCTR-67-000008"
Write-Host "The vCenter Server must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events."
Write-Host "If an alarm is not created and enabled to alert when syslog failures occur, this is a finding."
Get-AlarmDefinition | Where-Object { $_.ExtensionData.Info.Expression.Expression.EventTypeId -eq "esx.problem.vmsyslogd.remote.failure" } | Select-Object Name, Enabled, @{N = "EventTypeId"; E = { $_.ExtensionData.Info.Expression.Expression.EventTypeId } }
Let’s break down the script and understand its functionalities:
- The script starts by configuring the PowerCLI environment, disabling certificate validation, and opting out of the Customer Experience Improvement Program (CEIP).
- Next, it connects to the vCenter servers specified in the
$vcenters
variable. - Each STIG control is then addressed individually using PowerCLI cmdlets. For example, the script sets the
config.log.level
to “info” for the specified vCenter servers. - The script continues to address other STIG controls, such as
config.vpxd.hostPasswordLength
,VirtualCenter.VimPasswordExpirationInDays
, and more. - Finally, the script performs a series of checks and configurations related to security policies and settings.
- Please note that this script serves as an example and should be customized to meet the specific requirements of your environment. It demonstrates the capabilities of PowerCLI in automating STIG implementation.
Automating VMware VM STIG
In addition to securing ESXi hosts, it is essential to apply STIG controls to virtual machines (VMs) running on the VMware infrastructure. PowerCLI can help automate the process of configuring VMs according to STIG guidelines.
Script: VMWare VM STIG Automation
The following PowerCLI script demonstrates how to automate the implementation of selected STIG controls for VMs:
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $false -Confirm:$false
Connect-VIServer -Server 127.0.0.1
$cluster = Get-Cluster -Name "Cluster"
$folder = Get-Folder -Name "Folder"
# Credit to https://github.com/rlakey/vmware-stig-powercli/blob/master/VMware_vSphere_6.7_VM_STIG_Remediation.ps1
$vmconfig = @{
#Hardening/STIG Settings
vmAdvSettings = @{
"isolation.tools.copy.disable" = $true
"isolation.tools.dnd.disable" = $true
"isolation.tools.paste.disable" = $true
"isolation.tools.diskShrink.disable" = $true
"isolation.tools.diskWiper.disable" = $true
"isolation.tools.hgfsServerSet.disable" = $true
"RemoteDisplay.maxConnections" = "1"
"RemoteDisplay.vnc.enabled" = $false
"tools.setinfo.sizeLimit" = "1048576"
"isolation.device.connectable.disable" = $true
"tools.guestlib.enableHostInfo" = $false
"tools.guest.desktop.autolock" = $true
"mks.enable3d" = $false
}
vmAdvSettingsRemove = ("sched.mem.pshare.salt")
vmotionEncryption = "opportunistic" #disabled, required, opportunistic
}
ForEach ($vm in (Get-VM -Location $cluster | Where-Object { (Get-VM -Location $folder) -contains $_ } )) {
Write-Output "...Remediating advanced settings on $vm on $vcenter"
ForEach ($setting in ($vmconfig.vmAdvSettings.GetEnumerator() | Sort-Object Name)) {
#Pulling values for each setting specified
$settingname = $setting.name
$settingvalue = $setting.value
If ($asetting = $vm | Get-AdvancedSetting -Name $settingname) {
If ($asetting.value -eq $settingvalue) {
Write-Output "...Setting $settingname is already configured correctly to $settingvalue on $vm"
}
else {
Write-Output "...Setting $settingname was incorrectly set to $($asetting.value) on $vm setting to $settingvalue"
$asetting | Set-AdvancedSetting -Value $settingvalue -Confirm:$false
}
}
else {
Write-Output "...Setting $settingname does not exist on $vm creating setting..."
$vm | New-AdvancedSetting -Name $settingname -Value $settingvalue -Confirm:$false
}
Write-Output "...Removing advanced settings if necessary on $vm on $vcenter"
ForEach ($setting in ($vmconfig.vmAdvSettingsRemove | Sort-Object Name)) {
#Checking to see if current setting exists
If ($asetting = $vm | Get-AdvancedSetting -Name $setting) {
Write-Output "...Setting $setting exists on $vm...removing setting"
$asetting | Remove-AdvancedSetting -Confirm:$false
}
else {
Write-Output "...Setting $setting does not exist on $vm"
}
}
If ($vm.extensiondata.Config.MigrateEncryption -eq $vmconfig.vmotionEncryption) {
Write-Output "...vMotion encryption set correctly on $vm to $($vmconfig.vmotionEncryption)"
}
else {
$vmv = $vm | get-view
$config = new-object VMware.Vim.VirtualMachineConfigSpec
$config.MigrateEncryption = New-object VMware.Vim.VirtualMachineConfigSpecEncryptedVMotionModes
$config.MigrateEncryption = "$($vmconfig.vmotionEncryption)"
$vmv.ReconfigVM($config)
}
}
}
Let’s understand the script and its functionality:
- Similar to the VMWare VCSA STIG script, the PowerCLI environment is configured at the beginning.
- The script connects to the vCenter and selects the target cluster and folder where the VMs reside.
- The
$vmconfig
variable contains the VM STIG settings that will be applied. It includes advanced VM settings, such as disabling copy and paste, limiting remote display connections, and more. - The script loops through each VM in the specified cluster and folder, applying the STIG settings to the VMs.
- Additionally, the script addresses vMotion encryption settings for the VMs.
Again, this script is provided as an example, and you should modify it according to your specific environment and STIG requirements.
Extras
- The DOD STIG VIB used to exist for 5.0-6.7 But is no longer available.
- Ryan Lakey has some great guidance on implementing the DoD VMWare STIGS, and we highly suggest you read them.
Conclusion
Implementing the VMware STIG is crucial for enhancing the security of VMware infrastructure and achieving compliance with relevant regulations. PowerCLI enables automation and simplifies the process of applying STIG controls to both ESXi hosts and VMs.
In this article, we explored the use of PowerCLI to automate the VMware ESXi and VM STIGs. We discussed the installation requirements, provided example scripts, and highlighted the importance of customizing the scripts to meet specific environment needs.
By leveraging PowerCLI and following the STIG guidelines, administrators can efficiently secure their VMware deployments and reduce manual effort while ensuring consistent configurations.