vSphere 8 Security Enhancements

Many of our customers have done vulnerability assessment (VA) on vSphere ESXi and often highlighted out the vulerable items such as SHA1 and TLS 1.0, etc. 

Some of it were there but not in used and we could not manually remove them such as SHA1, MD5, etc.

While some of them were to support lower version such as TLS 1.1 and 1.0. 

With vSphere 8, the security enhancement has made uplift to remove unwanted security bundles and as well to support only secured transport connection via TLS 1.2.

On top of that, it also added daemons to now run in their own sandboxes instead of in the hypervisor world needing higher permissions which were unneeded and prone to vulnerability attacks.

What is new for security is a timeout for SSH shell when enabled on ESXi host. So administrators, no longer are to leave the SSH shell connected for infinite time or even worse forgetting to disconnect and logout of the endpoint where they are connected to the ESXi shell.

Lastly, if your hardware used for ESXi 8.0 installation contain TPM 1.2 hardware, you will be notified but it does not prevent you from installating ESXi 8.0 or upgrading to it. TPM 1.2 is no longer supported.

In vSphere 8U2, vCenter Certificate Services which was introduced. Catch the video on how certificate can be renew and replace without a full service or appliance restart.

vCenter Server now not only support traditional Active Directory and LDAP but also with MFA with ADFS which was release in vSphere 7. But vSphere 8, it now also support Azure AD, Okta, Microsoft Entra ID and Ping Federate. Check out the doc.

Check out more of vSphere 8 security from this document. You can read some of the above mentioned in VMware Doc here.