Secure VMware with Mondoo

Mondoo continuously assesses VMware vSphere and ESXi hosts for vulnerabilities and misconfigurations. Because VMware often forms the foundation of on-premises infrastructure, keeping it secure protects every workload running on top of it.

The setup has three parts:

1. Create a read-only vCenter user that Mondoo will scan with.
2. Deploy a Linux host with cnspec to run the scans. Mondoo ships a pre-built VMware appliance, or you can install cnspec on your own hardened Linux instance.
3. Register cnspec and run scans against vSphere and ESXi.

Step 1: Create a read-only vCenter user

Mondoo needs a read-only vCenter user. Create a role, then create a user assigned to it.

1. On the vSphere Client main menu, select Administration > Roles.

2. Select the Read-only role and select CLONE.

3. Name the clone Mondoo read-only role and select OK.

   

4. Select the new role and select EDIT. In the left list, select Global; in the right list, check Settings. Select SAVE.

   

5. On the Administration menu, select Users and Groups.

6. Under Users, select the vsphere.local domain and select ADD.

7. Name the user mondoo-read, set a password, and select ADD.

   

8. On the Administration menu, select Global Permissions > ADD, then assign the Mondoo Read-only role to the mondoo-read user. Check Propagate to children and select OK.

   

Step 2: Deploy a scan host

You can use the pre-built Mondoo VMware appliance or install cnspec on your own hardened Linux instance.

Option A: Mondoo VMware appliance

The appliance is a pre-configured Debian 12 VM with cnspec, VMware tools, cloud-init, and dev-sec hardening already in place.

1. Download the Mondoo OVA image.

2. In vCenter, right-click your Datacenter and select Deploy OVF Template.

   

3. Select the OVF template by URL or local file, then step through the wizard (name, folder, compute, storage, network).

   

The appliance ships with default credentials mondoo / mondoo. Change the password on first login. Password login is disabled by default on the hardened image; add your SSH public key to /home/mondoo/.ssh/authorized_keys (or let cloud-init configure it at boot).

Option B: Your own Linux host

Install cnspec on any hardened Linux instance. See the cnspec installation guide.

Step 3: Register cnspec with Mondoo

1. Register the host with a registration token:

   sudo cnspec login -t <token> --config /etc/opt/mondoo/mondoo.yml

2. Verify registration:

   cnspec status

   The output should include client is registered and client authenticated successfully.

3. Run a first test scan against vSphere using the default Platform End-of-Life and Platform Vulnerability policies:

   cnspec scan vsphere mondoo-read@vsphere.local@host --ask-pass

   Add --incognito to skip sending results to the Mondoo App for the first test scan.

4. In the Mondoo App, enable the policies you want to score against. VMware vSphere ESXi Security Baseline by Mondoo is a good starting point. See Manage Policies.

5. Run the scan again to send results to the Mondoo App:

   cnspec scan vsphere mondoo-read@vsphere.local@host --ask-pass --discover auto

   --discover auto finds all ESXi hosts and the vCenter automatically. Use --discover all to also discover VMs.

Scan multiple assets with an inventory file

An inventory file lets cnspec scan multiple VMware assets on a schedule. The basic file looks like this:

apiVersion: v1
kind: Inventory
metadata:
  name: cnspec-inventory
  labels:
    environment: production
spec:
  assets:
    - name:
      connections:
        - type: vsphere
          host: <ip of the ESXi or vCenter>
          insecure: true
          credentials:
            - type: password
              user: <username>
              password: <password>
          discover:
            targets:
              - host-machines

Save the file at /etc/opt/mondoo/inventory.yml as root so cnspec picks it up automatically, then:

sudo cnspec scan --inventory-file /etc/opt/mondoo/inventory.yml
sudo systemctl restart cnspec
sudo systemctl enable cnspec

Confirm the inventory loaded with sudo journalctl -u cnspec.service.