Protect against MAC address spoofing

By default this feature is turned on.  If left as the default of accept then a potential attacker could spoof MAC addresses and potentially appear as a trusted host.

Remediation

• Login to VirtualCenter or your ESX host using the VI Client
• Select the configuration tab for your ESX host
• Select networking from the hardware pane
• Select the properties for the vswitch you wish to change
• Select Edit from the ports tab
• Select the security tab
• Change the “MAC address spoofing setting to Reject”

Protect the ESX Host so that the Root File System does not fill up

Make sure that each of the following directories is mounted on  a separate partition:

/home

/var

/tmp

/log

Remediation

1. Log into the service console via ssh
2. Run the command “df -k” this will show the current partition structure.  You should have separate entries for each of the above directories.
3. If you do not have separate directories then you will need to create new mount points for each of the directories and create new partitions on the disk.
4. If you do not have enough disk space then you will need to make a decision on how practical it is for you to make the necessary changes in order to comply with this rule.
5. Alternative approaches to not doing this would be to create a cronjob that monitors disk space and archives off log files and or deletes unwanted files to avoid the situation of the root partition filling up.

NOTE: Altering disk partitions is a skilled job do not attempt this if you are unsure of what you are doing and always make a backup first.

“Datastore Partitioning,” an appendix of the Installation

and Upgrade Guide, covers disk partitions in more detail.