Updated vSphere Security Hardening Report Script for vSphere 4.1

VMware released earlier this week the first draft copy of the vSphere 4.1 Security Hardening Guide which provides several changes to the vSphere 4.0 version released last year. Unfortunately there was no change list provided and you have to manually go through both documents to get the differences. Luckily I did the heavy lifting for you and here are the changes in 4.1 version:

Edit: It looks like Charu of VMware has already posted a "diff" of the 4.0 and 4.1 version here.

Added Checks (14):

• VSH07 (Enterprise) - Check for privilege re-assignment after vCenter Server restarts
• VSH10 (Enterprise) - Clean up log files after failed installations of vCenter Server
• VUM06 (Enterprise) - Do not use default self-signed certificates
• VMX23 (Enterprise) - Use secure protocols for virtual serial port access
• VMX24 (DMZ) - Disable certain unexposed features
• VMX56 (Enteprise) - Restrict access to VMsafe network APIs
• HIN02 (Enterprise) - Keep ESX/ESXi system properly patched
• HCM05 (DMZ) - Disable Welcome web page
  
• HMT12 (Enterprise) - Prevent unintended use of VMsafe network APIs
• HMT15 (Enterprise) - Audit for loading of unauthorized kernel modules (ESXi only)
• HMT20 (DMZ) - Ensure that vpxuser auto-password change meets policy
• HMT21 (DMZ) - Ensure that vpxuser password meets length policy
• HCN05 (SSLF) - Disable DCUI to prevent all local administrative control
• HCN06 (Enterprise) - Disable Tech Support Mode unless needed for diagnostics and break-fix
  

Removed Checks (10):

• VMX03 (Enterprise) - Disable copy/paste to remote console
• VMX51 (Enterprise) - Restrict access to VMsafe CPU/memory APIs
• VMX54 (Enterprise) - Restrict access to VMsafe network APIs
• HCM04 (Enterprise) - Ensure that ESX is configured to encrypt all sessions
• HMT10 (Enterprise) - Prevent unintended use of VMsafe CPU/memory APIs
• HMT11 (Enterprise) - Prevent unintended use of VMsafe network APIs
• HCN01 (Enterprise) - Ensure that only authorized users have access to the DCUI
• HCN03 (Enterprise) - Avoid adding the root user to local groups
• HCN04 (SSLF) - Disable tech support mode
• COP06 (DMZ) - Ensure that vpxuser auto-password change in vCenter meets policy

Note: Some of the removed checks may have been replaced with newer and updated information and shows up in the added checks.

To help with your vSphere validation, here is the latest version of the vSphere Security Hardening Report script 1.5 script. There have been a few enhancements to the script which only validates a check based on whether it it is applicable to classic ESX or ESXi, which in the past it would display "N/A". There is also some further validation of the service endpoints for /, /ui, and /mob that may also help reduce manual verification where applicable. You can also join the new vSphere Security Hardening Report VMTN Group for new updates, bug report and discussions.

Here is an updated sample report based on vSphere 4.1:
vmwarevSphereSecurityHardeningReport-SAMPLE.html

One other thing I noticed while going through both the 4.0 and 4.1 security guide is the numbers for the code are all over the place, there are sometimes huge gaps that are unexplained (e.g. VSH6, VSH7 ... VSH10)