46. VMware vSphere (vCenter and ESXi)

Lawliet reads a vCenter Server, or a standalone ESXi host, through the vSphere API: its inventory, where its VMs sit on the network, the compliance of hosts, VMs and port groups, and findings for the review queue. It can change a host, VM or port group setting (with a second approver, recorded and reversible) and install agents into guest VMs.

Path: vSphere (sidebar group Network & Data). Licence feature: network.

Permissions:

46.1 Before you start: the service account#

A read-only account makes a write fail with no_permission, recorded on the change; nothing is retried with other rights.

The certificate is always verified: you pin the SHA-256 of the certificate the endpoint presents, or give the CA bundle that issued it. There is no "do not verify" mode. After a planned certificate renewal, pin the new one; a changed certificate stops the sync (nothing is sent) and raises a high review item.

46.2 Procedure: add a connection#

Permission: Manage vSphere connections. Four-eyes: yes.

Risk: none to vSphere (Lawliet only reads with a read-only account). The password is stored encrypted and never shown again. Rollback: remove the connection (46.3).

1. Open vSphere > Connections. Under Add a connection fill in:

   Field	What to enter
   Name	A label, for example "Prod vCenter"
   Kind	vCenter Server (recommended) or Standalone ESXi host (a host no vCenter manages)
   Address and port	The SDK endpoint, for example vcenter.example.local, port 443
   Service account (read-only role)	The account from 46.1
   Password	Its password

2. Trust, one of:

   • Press Show the certificate (port 443 only; no credential is sent). Compare the shown SHA-256 with the one in the vCenter or ESXi console, then tick Pin <fingerprint> (<issuer or self-signed>, valid to <date>).
   • Or paste the certificate's SHA-256 into or paste the certificate's SHA-256 (from the ESXi / vCenter console) (the only way for a port other than 443).
   • Or paste the issuing CA into or paste a CA bundle (PEM).

3. Press Add (needs a second approver). A second administrator approves in Approvals (the approver reads the address, account and trust, never the password); then press Execute now in Approvals > My requests.

4. On the new row press Test ("Connected: <product>" or "Failed: <reason>"), then Sync ("Sync started; the status updates when it finishes.").

What you see: the row with Name, Endpoint, Trust ("pinned <first characters>..." or "CA bundle"), Last sync (status, and the last error in red) and Inventory ("N hosts, M VMs, K without agent").

If it fails:

46.3 Change or remove a connection#

Remove: the bin on the row (Remove <name>). Four-eyes: yes. The connection and its inventory are removed.

Change (address, account, password, trust, poll interval, settings): there is no edit form in this release. Use PUT /api/v1/vsphere/connections/{connection_id} with the fields to change and the connection's current revision; four-eyes yes. Per-connection settings:

46.4 What a sync reads#

Datacenters, clusters, hosts (version, build, management addresses, lockdown mode, NTP, services, firewall, selected advanced options), datastores; VMs (guest OS, VMware Tools state, power, NICs with MAC, IPs and port group, disks, snapshots and their age, encryption, vTPM, selected advanced settings, removable and legacy devices); standard and distributed switches and port groups (VLAN, security policy). Objects that disappear are marked removed, not deleted. One long-lived session per connection; idle sessions are logged out after 15 minutes.

Inventory tab: clusters with their hosts ("ESXi <version> build <build> - N failing") and VMs (power, agent #N or no agent, failing controls). Click a host or VM for its details, how it was linked, and its Failing controls.

Linking. A VM is linked to an enrolled agent and to a network node by MAC address, or by host name and IP together - never by a guest-reported name or IP alone. An ambiguous match (cloned VMs keep MACs) links nothing. ESXi hosts appear on the Network map at their management address, each VM linked to its host with its port groups and VLANs; ESXi hosts get asset profiles.

Network tab: per VLAN, its port groups (distributed, or standard on N hosts; uplinks), with promiscuous, forged transmits and MAC changes marked in red, and the VMs on each.

46.5 Compliance and remediation#

99 controls for hosts, VMs and port groups, checked through the API, mapped to DISA STIG VMware vSphere 8.0 and 7.0 (ESXi and VM), NIST SP 800-53 and the VMware vSphere Security Configuration Guide 8. Items the plain API does not expose (SSH daemon settings, Secure Boot, TPM, the VIB acceptance level, the TLS profile, key persistence, the DCUI shell) are read through the vSphere API's esxcli interface - no SSH to the host. A setting that cannot be read is unknown, never compliant. Hosts fail VSP-ESXI-PATCH-LEVEL when older than the patch baseline in the signed catalog (the fixes for VMSA-2025-0004), and VSP-ESXI-SUPPORTED-RELEASE on releases past general support.

Compliance tab: tiles Score (pass of decided), Failing, Unknown (not readable) and one per framework (DISA STIG, NIST 800-53, VMware SCG 8); then each control with Severity, Control ("- report only" when Lawliet never changes it), Fail, Pass, Unknown and its STIG ids. Click a control to see each object's result.

Procedure: remediate a setting#

Permission: Change vSphere configuration. Four-eyes: yes.

Risk: the setting changes on live hosts, VMs or port groups. Lockdown mode is refused unless the connection's last sync reported a real vCenter and no other Lawliet connection reaches the host directly. A control that requires another waits until that one passes. Rollback: the Changes tab (below), one step per change.

1. On Compliance, click the control. Tick the failing objects to fix.
2. For an audit-then-enforce control, tick I reviewed the audit result and the impact of enforcing this control.
3. Press Remediate N (needs a second approver) (up to 50 objects per request). The approver reads the object names. Execute it from Approvals > My requests.

What you see: "N change(s) applied; see Changes for read-back and rollback." Report-only controls show "Report only: changed by an administrator in vSphere." (site-specific values such as syslog targets, NTP servers and banners, and device removal, which needs the VM off).

Procedure: roll back a change#

Changes tab: When, Object, Control, Before, After, Status, and Roll back.

Permission: Change vSphere configuration. Four-eyes: yes. Press Roll back (or, after a conflict and only when you are sure the other change should be undone, Roll back anyway). Rollback first reads the current value; if it is no longer what Lawliet set, it stops as rollback_conflict.

46.6 Procedure: install agents on VMs#

Agents tab: running VMs without a Lawliet agent - VM, OS, Address, VMware Tools, Guest operations (ready, or why not). "Every VM has an agent" when none is missing.

Permission: Deploy agents remotely; the credential list also needs Manage deployment credentials. Four-eyes: yes for both ways.

Risk: the agent is installed as root or Administrator on each guest. Rollback: uninstall the agent (11.6, 12.9) and remove the host (10.7).

1. Tick the VMs.
2. Choose the Guest credential: a stored deployment credential of kind ssh_password (Linux guests; root or passwordless sudo) or winrm_password (Windows) (chapter 13).
3. Check Server address the guests reach.
4. Either:
   • Install through VMware Tools - for VMs whose guest operations are ready; no network path to the guest is needed. The enrolment token never appears on a guest command line: it is written to a file in a fresh private directory and handed to the installer with --token-file / -TokenFile, then deleted. The installer's log stays in that directory (/var/tmp/lawliet-guestops.*/install.log, C:\Windows\Temp\lawliet-guestops-*\install.log).
   • Hand off by IP (SSH / WinRM) - creates a remote-deployment job for the VMs' addresses ("Remote deployment job created; follow it under Environment > Deployment.").
5. Approve and execute the request.

What you see: "N install(s) started through VMware Tools." and, under Guest-operations installs, each VM's state (queued, running, awaiting_enrolment, enrolled, failed) and detail.

46.7 Findings in the review queue#

Module vSphere: unpatched host (critical), unsupported release, insecure port group (promiscuous, forged transmits, MAC changes), VM snapshot older than the limit, drift of a control that passed before (naming the vSphere user from the configuration-change events), high-severity control failures, and per connection one item each for VMs without an agent, unencrypted VMs and VMs without running Tools. A finding whose condition clears at a later sync is resolved with an activity entry.