Articles in this section

VMware VSAN: Recommended Baseline Checks

Avatar
Oz Gabriely
  • Updated

[ Applies to ] StorageGuard   /   VMware vSAN   /   Hyperconverged Infrastructure & SDS

This article lists the recommended baseline checks for VMware vSAN. Core6 updates the list periodically as new StorageGuard checks become available.

Overview

VMware vSAN is software-defined storage that pools local disks across ESXi hosts into a shared, resilient datastore for virtualized workloads.

Why hardening VMware vSAN matters

vSAN stores the data for every virtual machine in the cluster. Access controls, encryption, secure host configuration and monitoring protect against unauthorized access and tampering in the virtualized storage layer.

Recommended baseline checks

The baseline below contains 37 checks, listed alphabetically.

ID Configuration check Component
SG-C0393T223V01 Account lockout threshold vSAN
SG-C0580T223V01 Authentication proxy certificate verification vSAN
SG-C0065T223V01 Data at-rest encryption vSAN
SG-F4359T223V01 Data-in-transit encryption vSAN
SG-F4061T223V01 DCUI banner vSAN
SG-F4136T223V01 DCUI banner message vSAN
SG-C0600T245V01 End of support vCenter
SG-C0577T223V01 ESX Admins group auto-add vSAN
SG-C0579T223V01 ESXi Shell warning suppression vSAN
SG-C0175T223V01 Event types enabled for audit logging vSAN
SG-C0175T223V02 Event types enabled for audit logging - API Audit vSAN
SG-F9618T223V01 Fault Tolerance mode vSAN
SG-C0600T245V02 Future end of support vCenter
SG-C0209T223V01 Idle session timeout vSAN
SG-C0209T223V04 Idle session timeout - DCUI vSAN
SG-C0209T223V05 Idle session timeout - Host Client Session vSAN
SG-C0209T223V03 Idle session timeout - Shell vSAN
SG-C0209T223V02 Idle session timeout - Shell Interactive vSAN
SG-C0049T223V01 KMS server configuration vSAN
SG-C0575T223V01 Managed Object Browser status vSAN
SG-C0468T223V01 Maximum concurrent sessions - SSH vSAN
SG-C0234T223V01 Maximum password age vSAN
SG-C0392T223V01 Minimum account lockout duration vSAN
SG-C0423T223V05 MOTD status - Host Client vSAN
SG-C0423T223V04 MOTD status - Issue vSAN
SG-C0423T223V02 MOTD status - SSH vSAN
SG-C0423T223V03 MOTD status - vSphere Web Client vSAN
SG-C0274T223V01 Password complexity vSAN
SG-C0284T223V01 Password history vSAN
SG-C0574T223V01 Remote syslog server configuration vSAN
SG-F6493T223V01 SSH motd message vSAN
SG-C0578T223V01 Syslog SSL certificate verification vSAN
SG-C0390T223V01 TLS level vSAN
SG-F8698T223V01 Unique VSAN DS names vSAN
SG-F7168T223V01 vSAN iSCSI mutual CHAP authentication vSAN
SG-F2069T223V01 VSAN iSCSI Target Service vSAN
SG-C0576T223V01 Web script launcher status vSAN

A complete baseline also covers the components that manage, connect to or protect VMware vSAN. Review the configuration of:

  • vCenter Server
  • ESXi hosts
  • Key providers (KMS)

Run checks with StorageGuard

Want automated validation? StorageGuard continuously scans VMware vSAN against a baseline and reports misconfigurations, with remediation guidance. Contact us to see it in your environment, or learn more about StorageGuard.

[ Still need help? ]

Our support team is here to help. Submit a request.

Related articles

Comments

0 comments

Please sign in to leave a comment.