VMware View Security View 5.1 View Manager 5.1 View Composer 3.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs.
VMware View Security You can find the most up-to-date technical documentation on the VMware Web site at: http://www.vmware.com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: docfeedback@vmware.com Copyright © 2012 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.
Contents VMware View Security 5 1 VMware View Security Reference 7 VMware View Accounts 8 VMware View Security Settings 9 VMware View Resources 17 VMware View Log Files 18 VMware View TCP and UDP Ports 19 Services on a View Connection Server Host 23 Services on a Security Server 24 Services on a View Transfer Server Host 24 Index 25 VMware, Inc.
VMware View Security 4 VMware, Inc.
VMware View Security VMware View Security provides a concise reference to the security features of VMware View™. n Required system and database login accounts. n Configuration options and settings that have security implications. n Resources that must be protected, such as security-relevant configuration files and passwords, and the recommended access controls for secure operation. n Location of log files and their purpose.
VMware View Security 6 VMware, Inc.
VMware View Security Reference 1 When you are configuring a secure View environment, you can change settings and make adjustments in several areas to protect your systems. n VMware View Accounts on page 8 You must set up system and database accounts to administer VMware View components. n VMware View Security Settings on page 9 VMware View includes several settings that you can use to adjust the security of the configuration.
VMware View Security VMware View Accounts You must set up system and database accounts to administer VMware View components. Table 1-1. VMware View System Accounts VMware View Component Required Accounts View Client Configure user accounts in Active Directory for the users who have access to View desktops. The user accounts must be members of the Remote Desktop Users group, but the accounts do not require View administrator privileges.
Chapter 1 VMware View Security Reference VMware View Security Settings VMware View includes several settings that you can use to adjust the security of the configuration. You can access the settings by using View Administrator, by editing group profiles, or by using the ADSI Edit utility, as appropriate. Security-Related Global Settings in View Administrator Security-related global settings for client sessions and connections are accessible under View Configuration > Global Settings in View Administrator.
VMware View Security Table 1-3. Security-Related Global Settings (Continued) Setting Description Use IPSec for Security Server connections Determines whether to use Internet Protocol Security (IPSec) for connections between security servers and View Connection Server instances. By default, IPSec for security server connections is enabled. View Administrator session timeout Determines how long an idle View Administrator session continues before the session times out.
Chapter 1 VMware View Security Reference Table 1-4. Security-Related Server Settings (Continued) Setting Description Use SSL for Local Mode operations Determines whether communications and data transfers between client computers and the datacenter use SSL encryption. These operations include checking in and checking out desktops and replicating data from client computers to the datacenter, but do not include transfers of View Composer base images.
VMware View Security Table 1-5. Security-Related Settings in the View Agent Configuration Template (Continued) Setting Registry Value Name Description ConnectionTicketTimeout VdmConnectionTic ketTimeout Specifies the amount of time in seconds that the View connection ticket is valid. If this setting is not configured, the default timeout period is 120 seconds.
Chapter 1 VMware View Security Reference Table 1-6. Security Settings in the View Client Configuration Template (Continued) Setting Registry Value Name Description Certificate verification mode CertCheckMode Configures the level of certificate checking that is performed by View Client. You can select one of these modes: n No Security. View does not perform certificate checking. n Warn But Allow.
VMware View Security Table 1-6. Security Settings in the View Client Configuration Template (Continued) Setting Registry Value Name Description Default value of the 'Log in as current user' checkbox LogInAsCurrentUse Specifies the default value of the Log in as current user check box on the View Client connection dialog box. This setting overrides the default value specified during View Client installation.
Chapter 1 VMware View Security Reference Table 1-6. Security Settings in the View Client Configuration Template (Continued) Setting Registry Value Name Description Ignore certificate revocation problems IgnoreRevocation Determines whether errors that are associated with a revoked server certificate are ignored. These errors occur when the server sends a certificate that has been revoked and when the client cannot verify a certificate's revocation status. This setting is disabled by default.
VMware View Security Table 1-7. Security-Related Settings in the Scripting Definitions Section Setting Registry Value Name Description Connect all USB devices to the desktop on launch connectUSBOnStartu p Determines whether all of the available USB devices on the client system are connected to the desktop when the desktop is launched. This setting is disabled by default.
Chapter 1 VMware View Security Reference Table 1-8. Security-Related Settings in View LDAP Name-value pair Attribute Description csallowunencryptedstartsessi on pae-NameValuePair This attribute controls whether a secure channel is required between a View Connection Server instance and a desktop when a remote user session is being started. When View Agent 5.1 or later is installed on a desktop computer, this attribute has no effect and a secure channel is always required.
VMware View Security Table 1-9. View Connection Server and Security Server Resources (Continued) Resource Location Protection Log files %ALLUSERSPROFILE%\Application Data\VMware\VDM\logs :\Documents and Settings\All Users\Application Data\VMware\VDM\logs Protected by access control. web.xml (Tomcat configuration file) install_directory\VMware View\Server\broker\web apps\ROOT\Web INF Protected by access control. Table 1-10.
Chapter 1 VMware View Security Reference Table 1-11. VMware View Log Files (Continued) VMware View Component File Path and Other Information View Connection Server or Security Server %ALLUSERSPROFILE%\Application Data\VMware\VDM\logs\*.txt on the server. :\Documents and Settings\All Users\Application Data\VMware\VDM\logs\*.txt on the server. The log directory is configurable in the log configuration settings of the View Common Configuration ADM template file (vdm_common.adm).
VMware View Security Table 1-12. TCP and UDP Ports Used by View, Excluding Local Mode (Continued) 20 Source Port Target Port Protocol Description View Agent 4.5 or earlier 50002 (can be changed by group policy) View Client * UDP PCoIP, if PCoIP Secure Gateway is not used. View Agent 4.6 or later 4172 View Client * UDP PCoIP, if PCoIP Secure Gateway is not used. View Agent 4.
Chapter 1 VMware View Security Reference Table 1-12. TCP and UDP Ports Used by View, Excluding Local Mode (Continued) Source Port Target Port Protocol Description View Connection Server * vCenter Server or View Composer 443 TCP SOAP messages if SSL is enabled for access to vCenter Servers or View Composer. View Connection Server * View Agent 4.5 or earlier 50002 (can be changed by group policy) UDP PCoIP (not SALSA20) if PCoIP Secure Gateway via the View Connection Server is used.
VMware View Security Table 1-13. TCP and UDP Ports Used by Local Mode 22 Source Port Target Port Protocol Description Security server * View Transfer Server 80 TCP Local desktop checkout, check-in, and replication if tunnel connections are used and SSL is disabled for local mode operations. Security server * View Transfer Server 443 TCP Local desktop checkout, check-in, and replication if tunnel connections are used and SSL is enabled for local mode operations.
Chapter 1 VMware View Security Reference Table 1-13. TCP and UDP Ports Used by Local Mode (Continued) Source Port Target Port Protocol Description View Transfer Server * ESX host 902 TCP Publishing View Composer packages for local mode. View Transfer Server * Server that hosts the Transfer Server repository network share 445 UDP Configuring and publishing View Composer packages to the Transfer Server repository network share.
VMware View Security Services on a Security Server The operation of View Manager depends on several services that run on a security server. If you want to adjust the operation of these services, you must first familiarize yourself with them. Table 1-15. Security Server Services Service Name Startup Type Description VMware View Security Server Automatic Provides security server services. This service must be running for the correct operation of a security server.
Index A VMwareVDMDS service 23 accounts 8 ADM template files, security-related settings 9 W Web Component service 23 C Connection Server service 23 F firewall settings 19 Framework Component service 23, 24 L log files 18 M Message Bus Component service 23 R resources 17 S Script Host service 23 Security Gateway Component service 23, 24 security overview 5 Security Server service 24 security servers, services 24 security settings, global 9 server settings.
VMware View Security 26 VMware, Inc.
