[ Applies to ] StorageGuard / Dell PowerFlex / Hyperconverged Infrastructure & SDS
This article lists the recommended baseline checks for Dell PowerFlex. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
Dell PowerFlex is a software-defined infrastructure platform that pools compute and storage resources to deliver scalable, high-performance block and file services for modern data centers.
Why hardening Dell PowerFlex matters
PowerFlex spans storage nodes, management software and networking, so a single weak setting can expose the whole environment. Hardening access, certificates, encryption and management services protects stored data and keeps the platform resilient.
Recommended baseline checks
The baseline below contains 170 checks, listed alphabetically.
| ID | Configuration check |
|---|---|
| SG-M7175T228V01 | (CHAP) authentication between SDRs |
| SG-F2874T228V01 | Absolute session timeout (management) |
| SG-M7371T228V01 | All MDM IP addresses are defined |
| SG-C0490T228V01 | Allowed authentication methods |
| SG-M4714T228V01 | Appliance SSL certificate expiration |
| SG-F4985T228V01 | Appliance SSL certificate expiration (PowerFlex Manager) |
| SG-M7841T228V01 | Approved Directory Service Domain |
| SG-F8193T228V01 | Approved Directory Service Domain (PowerFlex Manager) |
| SG-F4721T228V01 | Approved DNS server (PowerFlex Manager) |
| SG-C0449T228V01 | Approved DNS servers |
| SG-M1405T228V01 | Approved IdP |
| SG-F6610T228V01 | Approved IdP (PowerFlex Manager) |
| SG-M8707T228V01 | Approved issuer for LDAP server SSL certificate |
| SG-C0435T228V01 | Approved LDAP servers |
| SG-M9359T228V01 | Approved NFS version |
| SG-F6514T228V01 | Approved NTP (PowerFlex Manager) |
| SG-C0013T228V01 | Approved NTP servers |
| SG-C0523T228V01 | Approved SDR version |
| SG-C0497T228V01 | Approved SDS version |
| SG-M7769T228V01 | Approved SSL certificate issuer (MDM) |
| SG-F4464T228V01 | Approved SSL certificate issuer (PowerFlex Manager) |
| SG-C0015T228V01 | Approved Syslog servers |
| SG-C0333T228V01 | Approved user roles |
| SG-F4553T228V01 | Audit logging status |
| SG-M8969T228V01 | Authentication Method |
| SG-C0530T228V01 | Automatic log collection |
| SG-M9809T228V01 | Background device scanner |
| SG-C0529T228V01 | Capacity alert configuration |
| SG-M4663T228V01 | Central authentication |
| SG-C0029T228V01 | Centralized log server |
| SG-M7129T228V01 | CEPA Publisher configured for Ransomware detection |
| SG-M9225T228V01 | CIFS idle use session timeout |
| SG-F4797T228V01 | CIFS idle use session timeout (PowerFlex CO) |
| SG-M5648T228V01 | Connect to CloudIQ Enabled |
| SG-F8294T228V01 | Connect to CloudIQ Enabled (PowerFlex Manager) |
| SG-M5716T228V01 | Correct DRL mode |
| SG-M5521T228V01 | Data at-REST encryption |
| SG-C0482T228V01 | Data rebalance |
| SG-C0483T228V01 | Data rebalance priority |
| SG-C0481T228V01 | Data rebuild |
| SG-M4858T228V01 | Default password ( Web UI) |
| SG-C0056T228V01 | Default passwords |
| SG-M9847T228V01 | Disable IPMI |
| SG-M2940T228V01 | Disable SNMP in your organization is not using SNMP |
| SG-C0243T228V01 | DNS server configuration |
| SG-F7285T228V01 | DNS server configuration (PowerFlex Manager) |
| SG-C0060T228V01 | DNS server redundancy |
| SG-F2662T228V01 | DNS server redundancy (PowerFlex manager) |
| SG-M8030T228V01 | Email (SMTP server) configuration |
| SG-M2777T228V01 | Email policy settings |
| SG-F3758T228V01 | Email policy settings (PowerFlex Manager) |
| SG-M4381T228V01 | Enable Inflight Checksum |
| SG-M1252T228V01 | Enable Persistent Checksum |
| SG-M9086T228V01 | Enable Remote Support |
| SG-F8591T228V01 | Enable Remote Support (PowerFlex Manager) |
| SG-M4812T228V01 | Enable Zero Padding Policy |
| SG-M8406T228V01 | Enabled Fille Virus Checker |
| SG-C0600T228V01 | End of support |
| SG-C0526T228V01 | Enterprise features |
| SG-C0175T228V01 | Event types enabled for audit logging |
| SG-M2237T228V01 | External syslog server configuration |
| SG-C0527T228V01 | FGL metadata cache |
| SG-F9183T228V01 | FIPS compliance (PowerFlex MDM/SDS Linux host) |
| SG-C0600T228V02 | Future end of support |
| SG-C0524T228V01 | Gateway certificate check |
| SG-M6192T228V01 | Healthy MDM Cluster State |
| SG-F8918T228V01 | Idle session timeout (management) |
| SG-M4970T228V01 | Incorrect /var/lib/chrony folder permissions on the SVM |
| SG-M9641T228V01 | Incorrect mapping of LDAP group to role |
| SG-C0531T228V01 | Inflight checksum |
| SG-M1712T228V01 | Initial license replaced |
| SG-M5811T228V01 | Insufficient snapshots |
| SG-M6553T228V01 | Last successful system backup |
| SG-C0120T228V01 | LDAP incorrect role mapping |
| SG-C0039T228V01 | LDAP server configuration |
| SG-M3010T228V01 | LDAP SSL |
| SG-M2927T228V01 | LDAP SSL certificate expiration |
| SG-M1137T228V01 | Login banner check |
| SG-M1032T228V01 | Management client secure communication |
| SG-F5770T228V01 | Management client secure communication (PowerFlex BLOCK API) |
| SG-M1631T228V01 | MDM Cluster goodNodesNum |
| SG-C0500T228V01 | MDM Cluster IP config |
| SG-C0503T228V01 | MDM cluster state |
| SG-C0486T228V01 | MDM security policy |
| SG-M9958T228V01 | MDM self-signed certificate check |
| SG-M3160T228V01 | MDM SSL certificate expiration |
| SG-M1771T228V01 | MDM/SDS host FIPS compliance |
| SG-M1382T228V01 | NFS Anon user/group mapping |
| SG-M4760T228V01 | NFS Credential cache retention |
| SG-M4836T228V01 | NFS export access list |
| SG-M3340T228V01 | NFS exports minimum security |
| SG-M2055T228V01 | NFS share default access |
| SG-F4015T228V01 | Node firewall IP restriction (PowerFlex Manager) |
| SG-M8998T228V01 | Node firewalld IP based access restriction |
| SG-M4954T228V01 | Node firewalld status |
| SG-F6076T228V01 | Node firewalld status (PowerFlex Manager) |
| SG-C0231T228V01 | Non-default local users |
| SG-C0171T228V01 | NTP server configuration |
| SG-F1206T228V01 | NTP server configuration (PowerFlex Manager CI) |
| SG-C0432T228V01 | NTP server redundancy |
| SG-F1623T228V01 | NTP server redundancy (PowerFlex Manager CI) |
| SG-C0498T228V01 | Persistent checksum |
| SG-C0499T228V01 | Persistent checksum on read |
| SG-M1225T228V01 | PowerFlex Gateway allowNonSecureCommunication |
| SG-M4971T228V01 | PowerFlex Gateway bypassCertificateCheck |
| SG-C0488T228V01 | Product license |
| SG-M7343T228V01 | Remote replication |
| SG-M1896T228V01 | Replication security: MDM to MDM encrypted communications |
| SG-F7936T228V01 | Required DNS server (PowerFlex Manager) |
| SG-C0014T228V01 | Required NTP servers |
| SG-F5933T228V01 | Required NTP servers (PowerFlex Manager) |
| SG-C0016T228V01 | Required Syslog servers |
| SG-M6794T228V01 | Required/Approved NTP servers |
| SG-M9797T228V01 | Required/Approved SYSLOG servers |
| SG-M4622T228V01 | Restricted host (SDC) mode type |
| SG-C0477T228V01 | Restricted SDC access |
| SG-C0478T228V01 | Restricted SDC access type |
| SG-M4324T228V01 | SCLI secure mode |
| SG-F6687T228V01 | SCLI secure mode (PowerFlex MDM) |
| SG-M1158T228V01 | SDC authentication is enabled |
| SG-M4918T228V01 | SDR certificate expiry warning |
| SG-M8762T228V01 | SDR Certificate issuer |
| SG-M5617T228V01 | SDR self-signed certificate |
| SG-M2757T228V01 | SDS Cluster not in Maintenance |
| SG-C0502T228V01 | SDS DRL mode |
| SG-C0501T228V01 | SDS Maintenance state |
| SG-C0528T228V01 | Secure communication (MDM to Clients) |
| SG-C0525T228V01 | Secure Gateway Communication |
| SG-M5007T228V01 | Secure NFS (Kerberos used) |
| SG-M9563T228V01 | Self signed appliance SSL certificate |
| SG-F5882T228V01 | Self signed appliance SSL certificate (PowerFlex Manager) |
| SG-F1779T228V01 | Self-signed certificate check (PowerFlex MDMs) |
| SG-M2050T228V01 | Self-signed LDAP certificate |
| SG-M4624T228V01 | SMB signing |
| SG-F5204T228V01 | SMB signing (PowerFlex CO) |
| SG-M5215T228V01 | SMB version 1 is disabled |
| SG-C0507T228V01 | Snapshot access mode |
| SG-M2376T228V01 | Snapshot retention |
| SG-M3022T228V01 | SNMP monitoring |
| SG-C0155T228V01 | SNMP service disabled |
| SG-C0347T228V01 | SNMP trap host configuration |
| SG-M6250T228V01 | SNMP v2 Community String |
| SG-F3000T228V01 | SNMP v2 Community String (PowerFlex manager) |
| SG-M1999T228V01 | SNMP V3 authentication |
| SG-F5409T228V01 | SNMP V3 authentication (PowerFlex Manager) |
| SG-M7623T228V01 | SNMP V3 privacy |
| SG-F9715T228V01 | SNMP V3 privacy (PowerFlex Manager) |
| SG-M9428T228V01 | SNMP version |
| SG-F6784T228V01 | SNMP version (PowerFlex Manager) |
| SG-C0496T228V01 | Spare capacity policy |
| SG-M2458T228V01 | Storage Pool Spare Capacity |
| SG-F5229T228V01 | Storage pool: background device scanner (PowerFlex BLOCK API) |
| SG-M1093T228V01 | SupportAssist enabled |
| SG-F2806T228V01 | SupportAssist enabled (PowerFlex Manager) |
| SG-M9685T228V01 | SupportAssist through Proxy |
| SG-F6095T228V01 | SupportAssist through Proxy (PowerFlex Manager) |
| SG-F8052T228V01 | SVM chrony folder permissions |
| SG-M3892T228V01 | Syslog policy configuration |
| SG-F2809T228V01 | Syslog policy configuration (PowerFlex Manager) |
| SG-M7735T228V01 | Syslog policy settings |
| SG-M7907T228V01 | System backup schedule |
| SG-M3379T228V01 | System backup share access control |
| SG-M4614T228V01 | TLS version |
| SG-F6258T228V01 | TLS version (PowerFlex BLOCK API) |
| SG-C0116T228V01 | Unapproved admin users |
| SG-C0508T228V01 | Unsupported MDM cluster architecture |
| SG-C0213T228V01 | Use of secure LDAP |
| SG-C0506T228V01 | Use secure snapshots |
| SG-F5276T228V01 | Verify SMB version 1 is disabled (PowerFlex CO) |
| SG-C0511T228V01 | Zero-padding configuration |
Related components
A complete baseline also covers the components that manage, connect to or protect Dell PowerFlex. Review the configuration of:
- PowerFlex Manager
- MDM, SDS and SDC components
- File services (NAS)
- Node hardware and iDRAC
Run checks with StorageGuard
Want automated validation? StorageGuard continuously scans Dell PowerFlex against a baseline and reports misconfigurations, with remediation guidance. Contact us to see it in your environment, or learn more about StorageGuard.
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.