Secure VMware vSphere with cnspec

Scan your VMware vSphere environment to find security risks before they become incidents. cnspec evaluates ESXi host hardening, NTP configuration, virtual machine settings, network switch security, and dozens of other vSphere controls.

Prerequisites

To scan vSphere with cnspec, you must have:

• cnspec installed on your workstation
• Network access to a vCenter Server or standalone ESXi host
• A user account with at least read-only permissions

Authenticate

cnspec connects to vCenter Server or an ESXi host using a username and password. The connection string format is USER@DOMAIN@HOST.

Create a read-only user (recommended)

For least-privilege access, create a dedicated read-only user in vCenter rather than using an administrator account:

1. In the vSphere Client, select Administration > Roles and clone the Read-only role.
2. Edit the cloned role to add the Global > Settings permission.
3. Under Administration > Users and Groups, create a new user (for example, mondoo-read).
4. Under Administration > Global Permissions, assign the cloned role to the new user with Propagate to children enabled.

Connection options

The vsphere provider accepts these connection options:

Verify with a quick vSphere check

Confirm that cnspec can reach your vSphere environment by opening a cnspec shell:

cnspec shell vsphere mondoo-read@vsphere.local@VCENTER_IP --ask-pass

If cnspec connects and shows a prompt, you're ready to scan.

Scan vSphere

To scan vCenter and its managed hosts:

cnspec scan vsphere mondoo-read@vsphere.local@VCENTER_IP --ask-pass

To automatically discover and scan ESXi hosts (and skip VMs):

cnspec scan vsphere mondoo-read@vsphere.local@VCENTER_IP --ask-pass --discover auto

To discover and scan everything, including VMs:

cnspec scan vsphere mondoo-read@vsphere.local@VCENTER_IP --ask-pass --discover all

auto is the default when you omit --discover. You can also name the asset types individually:

Understand scan output

When a scan completes, cnspec prints a summary of all the checks it ran, grouped into passing and failing checks. Each failed check shows its risk rating. For example:

Passing:
✓ Ensure default self-signed certificate for ESXi communication is not used
✓ Ensure the SLP service is disabled on ESXi hosts

Failing:
✕ MEDIUM (50):    Ensure NTP is configured on ESXi hosts

At the end of the output, cnspec shows a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To learn how to read a report in depth, see Understand Scan Results.

To assess your vSphere environment against Mondoo's security recommendations, enable the Mondoo VMware vSphere Security Baseline policy for vCenter and the Mondoo VMware vSphere ESXi Security policy for the discovered ESXi hosts. To learn how to enable policies, read Manage policies in Mondoo Platform. You can also create your own policies or specify a particular policy bundle with --policy-bundle.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks:

cnspec shell vsphere mondoo-read@vsphere.local@VCENTER_IP --ask-pass

Count hosts and VMs per datacenter

cnspec> vsphere.datacenters { name hosts.length vms.length }

List clusters and their hosts

cnspec> vsphere.datacenters { name clusters { name hosts { name } } }

List VMs and their advanced settings

cnspec> vsphere.datacenters { name vms { name advancedSettings } }

The vsphere.host examples that follow query a single ESXi host. When you connect to vCenter, cnspec discovers the ESXi hosts and the shell lets you choose one. On the vCenter asset itself, enumerate hosts through vsphere.datacenters { hosts { ... } } instead.

List ESXi services and their status

cnspec> vsphere.host.services { key label running policy }

Example security checks

Ensure the SLP service is not running on ESXi hosts

cnspec> vsphere.host.services.none(key == "slpd" && running == true)
[ok] value: true

Check ESXi host NTP configuration

cnspec> vsphere.host.ntp { server }
vsphere.host.ntp: {
  server: [
    0: "0.pool.ntp.org"
    1: "1.pool.ntp.org"
  ]
}

List installed VIBs on an ESXi host

cnspec> vsphere.host.packages { name acceptanceLevel }
vsphere.host.packages: [
  0: {
    name: "esx-base"
    acceptanceLevel: "VMwareCertified"
  }
  1: {
    name: "esx-update"
    acceptanceLevel: "VMwareCertified"
  }
]

Check VIB acceptance level on ESXi hosts

cnspec> vsphere.host.acceptanceLevel == "VMwareCertified"
[ok] value: "VMwareCertified"

List vSphere licenses

cnspec> vsphere.licenses { name total used }
licenses: [
  0: {
    name: "VMware vSphere 8 Enterprise Plus"
    total: 16
    used: 8
  }
]

Learn more

• Mondoo vSphere Resource Pack Reference: every vSphere resource and field cnspec can query
• Write Effective MQL: a guide to authoring checks and queries
• Secure VMware Cloud Director: scan VMware Cloud Director environments