[ Applies to ] StorageGuard / Dell VxRail / Hyperconverged Infrastructure & SDS
This article lists the recommended baseline checks for Dell VxRail. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
Dell VxRail is a hyperconverged infrastructure appliance jointly engineered by Dell and VMware, integrating compute, vSAN storage and VxRail Manager lifecycle management.
Why hardening Dell VxRail matters
VxRail clusters host the virtual machines that run business applications. Securing VxRail Manager, vCenter, ESXi hosts and iDRAC reduces the attack surface and protects the workloads and data they support.
Recommended baseline checks
The baseline below contains 100 checks, listed alphabetically.
| ID | Configuration check | Component |
|---|---|---|
| SG-F8938T115V01 | Approved iDRAC administrative users/groups | VxRail Manager |
| SG-M8531T115V01 | Approved vxRail administrative users/groups | VxRail Manager |
| SG-M4640T115V01 | Authorized certificate issuer | VxRail Manager |
| SG-M4107T115V01 | BIOS System Security | VxRail Manager |
| SG-F1879T115V01 | Default iDRAC root user | VxRail Manager |
| SG-M7497T115V01 | Default iDRAC user accounts | VxRail Manager |
| SG-C0243T115V01 | DNS server configuration | VxRail Manager |
| SG-C0060T115V01 | DNS server redundancy | VxRail Manager |
| SG-M1452T115V01 | DNS service status | VxRail Manager |
| SG-C0600T115V01 | End of support | VxRail Manager |
| SG-C0600T245V01 | End of support | vCenter |
| SG-M5231T115V01 | Expanded monitoring with auditd | VxRail Manager |
| SG-M3670T115V01 | External syslog server | VxRail Manager |
| SG-M3085T115V01 | FIPS mode | VxRail Manager |
| SG-C0600T115V02 | Future end of support | VxRail Manager |
| SG-C0600T245V02 | Future end of support | vCenter |
| SG-M2887T115V01 | HTTP status | VxRail Manager |
| SG-M5508T115V01 | iDRAC 2-Factor Authentication | VxRail Manager |
| SG-M9254T115V01 | iDRAC account lockout | VxRail Manager |
| SG-M6080T115V01 | iDRAC Active Directory configuration | VxRail Manager |
| SG-M2489T115V01 | iDRAC default passwords | VxRail Manager |
| SG-M9828T115V01 | iDRAC FIPS mode | VxRail Manager |
| SG-M3533T115V01 | iDRAC firmware | VxRail Manager |
| SG-M5101T115V01 | iDRAC IP range filtering | VxRail Manager |
| SG-M1889T115V01 | iDRAC LDAP configuration | VxRail Manager |
| SG-F2150T115V01 | iDRAC Lifecycle Controller enabled protocols | VxRail Manager |
| SG-M6466T115V01 | iDRAC Local Configuration using iDRAC Settings | VxRail Manager |
| SG-M1982T115V01 | iDRAC Local Configuration using RACADM | VxRail Manager |
| SG-M7612T115V01 | iDRAC management interfaces must be isolated | VxRail Manager |
| SG-M1214T115V01 | iDRAC Password policy | VxRail Manager |
| SG-M9397T115V01 | iDRAC Remote Syslog | VxRail Manager |
| SG-M9683T115V01 | iDRAC Remote Syslog TLS | VxRail Manager |
| SG-F4916T115V01 | iDRAC Secure NTP settings | VxRail Manager |
| SG-M9109T115V01 | iDRAC Security Banner | VxRail Manager |
| SG-M6130T115V01 | iDRAC Self-Signed TLS/SSL Certificate | VxRail Manager |
| SG-F7808T115V01 | iDRAC SNMP authentication | VxRail Manager |
| SG-F4314T115V01 | iDRAC SNMP community string | VxRail Manager |
| SG-F9274T115V01 | iDRAC SNMP lockout | VxRail Manager |
| SG-F6643T115V01 | iDRAC SNMP privacy | VxRail Manager |
| SG-F4406T115V01 | iDRAC SNMP status | VxRail Manager |
| SG-F9791T115V01 | iDRAC SNMP version | VxRail Manager |
| SG-M6210T115V01 | iDRAC SSH cipher strength | VxRail Manager |
| SG-M2456T115V01 | iDRAC SSH host key algorithms | VxRail Manager |
| SG-M2753T115V01 | iDRAC SSH key exchange algorithms | VxRail Manager |
| SG-M2858T115V01 | iDRAC SSH MAC strength | VxRail Manager |
| SG-M4948T115V01 | iDRAC System Lockdown Mode | VxRail Manager |
| SG-F7156T115V01 | iDRAC Telnet Disabled | VxRail Manager |
| SG-F3415T115V01 | iDRAC Virtual Console plugin type | VxRail Manager |
| SG-F1655T115V01 | iDRAC Virtual Console SSL encryption | VxRail Manager |
| SG-F9481T115V01 | iDRAC Virtual Console Video Encryption | VxRail Manager |
| SG-F4641T115V01 | iDRAC Virtual Media Encryption | VxRail Manager |
| SG-M7161T115V01 | iDRAC web server cipher suite strength | VxRail Manager |
| SG-M7801T115V01 | iDRAC web server HTTP status | VxRail Manager |
| SG-M9882T115V01 | iDRAC web server SSL encryption strength | VxRail Manager |
| SG-M8803T115V01 | iDRAC web server TLS level | VxRail Manager |
| SG-M4231T115V01 | iDRAC web UI default password | VxRail Manager |
| SG-M9832T115V01 | IP-based storage traffic isolation | VxRail Manager |
| SG-M2263T115V01 | IPMI over LAN disabled | VxRail Manager |
| SG-M8733T115V01 | Lifecycle Controller enabled protocols | VxRail Manager |
| SG-M3914T115V01 | Maximum password age (vxrail management accounts) | VxRail Manager |
| SG-M1000T115V01 | Minimum password age (vxrail management accounts) | VxRail Manager |
| SG-M5570T115V01 | Network traffic protection by NSX / L3 firewalls | VxRail Manager |
| SG-M5712T115V01 | Node secure boot | VxRail Manager |
| SG-M7357T115V01 | NT server configuration | VxRail Manager |
| SG-C0171T115V01 | NTP server configuration | VxRail Manager |
| SG-C0432T115V01 | NTP server redundancy | VxRail Manager |
| SG-M9860T115V01 | NTP service status | VxRail Manager |
| SG-C0362T115V01 | Proxy type | VxRail Manager |
| SG-M9402T115V01 | Remote support configuration | VxRail Manager |
| SG-C0138T115V01 | Remote support status | VxRail Manager |
| SG-M4981T115V01 | Root remote login | VxRail Manager |
| SG-M3107T115V01 | Secure NTP settings | VxRail Manager |
| SG-M8340T115V01 | Secure proxy type | VxRail Manager |
| SG-M1500T115V01 | Self-signed certificate | VxRail Manager |
| SG-M9027T115V01 | Serial Over LAN disabled | VxRail Manager |
| SG-M5520T115V01 | Session timeout | VxRail Manager |
| SG-M3456T115V01 | SNMP authentication | VxRail Manager |
| SG-M9536T115V01 | SNMP community string | VxRail Manager |
| SG-M3512T115V01 | SNMP lockout | VxRail Manager |
| SG-M6372T115V01 | SNMP privacy | VxRail Manager |
| SG-M4713T115V01 | SNMP status | VxRail Manager |
| SG-M4224T115V01 | SNMP version | VxRail Manager |
| SG-F3644T115V01 | Target iDRAC firmware | VxRail Manager |
| SG-M9318T115V01 | Telnet Disabled | VxRail Manager |
| SG-M9289T115V01 | Telnet status | VxRail Manager |
| SG-M1746T115V01 | TPM present | VxRail Manager |
| SG-C0116T115V01 | Unapproved admin users | VxRail Manager |
| SG-M2760T115V01 | Virtual Console plugin type | VxRail Manager |
| SG-M7831T115V01 | Virtual Console SSL encryption | VxRail Manager |
| SG-M4508T115V01 | Virtual Console Video Encryption | VxRail Manager |
| SG-M7286T115V01 | Virtual Media Encryption | VxRail Manager |
| SG-M8671T115V01 | VSAN Encryption | VxRail Manager |
| SG-M5652T115V01 | VSAN Health Check and public HCL connection method | VxRail Manager |
| SG-M4831T115V01 | VSAN Health Check and public HCL state | VxRail Manager |
| SG-M3466T115V01 | VSAN HealthCheck configuration | VxRail Manager |
| SG-M5478T115V01 | VxRail default passwords | VxRail Manager |
| SG-F1322T115V01 | VxRail FIPS mode | VxRail Manager |
| SG-F2644T115V01 | VxRail GUI Session timeout | VxRail Manager |
| SG-M9196T115V01 | VxRail SaaS multi-cluster management configuration | VxRail Manager |
| SG-M6874T115V01 | VxRail version | VxRail Manager |
Related components
A complete baseline also covers the components that manage, connect to or protect Dell VxRail. Review the configuration of:
- VMware vCenter and ESXi
- iDRAC
- VxRail Manager (Linux)
Run checks with StorageGuard
Want automated validation? StorageGuard continuously scans Dell VxRail against a baseline and reports misconfigurations, with remediation guidance. Contact us to see it in your environment, or learn more about StorageGuard.
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.