Skip to content

README.md

Latest commit

 

History

History
168 lines (127 loc) · 5.32 KB

README.md

File metadata and controls

168 lines (127 loc) · 5.32 KB

VMware CIS Run Checks

Overview

Enterprise-grade PowerShell script for performing comprehensive CIS (Center for Internet Security) compliance assessments on VMware vSphere 8 environments. All operations are read-only and designed for production use.

Technology Stack: PowerShell, VMware PowerCLI, vSphere API
Compliance Framework: CIS Controls v8, VMware Security Hardening Guidelines
Target Platform: VMware vSphere 8.0+

Features

  • Comprehensive Security Assessment - 100+ CIS compliance checks across 8 security domains
  • Read-Only Operations - No configuration changes, safe for production environments
  • Enterprise Ready - Optimized for large-scale VMware infrastructures
  • Detailed Reporting - Structured output with remediation guidance
  • Automated Execution - CI/CD pipeline integration support

Quick Start

Prerequisites

# Required PowerShell version
$PSVersionTable.PSVersion  # Must be 5.1 or higher

# Install VMware PowerCLI
Install-Module -Name VMware.PowerCLI -Force -AllowClobber -Scope CurrentUser

# Set execution policy
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Installation

git clone https://github.com/uldyssian-sh/vmware-cis-run-checks.git
cd vmware-cis-run-checks

Basic Usage

# Standard CIS compliance check
.\vmware-cis-run-checks.ps1 -vCenter "vcenter.company.com"

# Detailed output with all findings
.\vmware-cis-run-checks.ps1 -vCenter "vcenter.company.com" -ShowDetails

Security Domains

Domain Checks Description
Install 4 ESXi host software and patching validation
Communication 9 Network services and certificate security
Logging 3 Centralized logging and audit configuration
Access 8 Authentication and user management controls
Console 11 Shell access and lockdown mode settings
Storage 3 iSCSI and SAN security configurations
Network 8 vSwitch and distributed switch policies
Virtual Machines 50+ Guest VM security and isolation controls

Output Interpretation

Status Codes

  • PASS - Configuration meets CIS recommendations
  • FAIL - Remediation required for compliance
  • INFO - Informational finding, review recommended
  • NotImplemented - Manual verification required

Sample Output

Category                Check                                    Object          Status  Details
--------                -----                                    ------          ------  -------
1.Install              Ensure-ESXiIsProperlyPatched             esxi01.lab.com  INFO    Reported: 8.0.2 build 22380479
2.Communication        Ensure-NTPTimeSynchronizationIsConfigured esxi01.lab.com  PASS    Servers=pool.ntp.org; Running=True
5.Console              Ensure-SSHIsDisabled                     esxi01.lab.com  FAIL    Running=True

Advanced Usage

Automated Reporting

# Generate timestamped report
$timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
.\vmware-cis-run-checks.ps1 -vCenter "vcenter.company.com" | 
    Out-File "CIS-Report_$timestamp.txt"

Multiple vCenter Assessment

$vCenters = @("vc01.company.com", "vc02.company.com")
foreach ($vc in $vCenters) {
    .\vmware-cis-run-checks.ps1 -vCenter $vc -ShowDetails |
        Out-File "CIS-Report_$($vc.Split('.')[0])_$(Get-Date -Format 'yyyy-MM-dd').txt"
}

CI/CD Integration

# Azure DevOps Pipeline
- task: PowerShell@2
  displayName: 'VMware CIS Compliance Check'
  inputs:
    targetType: 'filePath'
    filePath: 'vmware-cis-run-checks.ps1'
    arguments: '-vCenter $(vCenterFQDN)'

Security Considerations

  • Credentials: Use service accounts with read-only permissions
  • Network: Ensure secure connectivity to vCenter Server
  • Logging: Review output for sensitive information before sharing
  • Compliance: Regular execution recommended (weekly/monthly)

Troubleshooting

Common Issues

PowerCLI Connection Successs

# Configure certificate handling
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false

Permission Denied

# Verify read-only access to vCenter
Get-VIPermission -Principal "domain\serviceaccount"

Module Not Found

# Install required modules
Install-Module VMware.PowerCLI -Force -AllowClobber
Import-Module VMware.PowerCLI

Contributing

  1. Fork the repository
  2. Create feature branch: git checkout -b feature/enhancement
  3. Commit changes: git commit -m 'Add enhancement'
  4. Push branch: git push origin feature/enhancement
  5. Submit Pull Request

License

This project is licensed under the MIT License. See LICENSE file for details.

Support

Maintained by: uldyssian-sh

⭐ Star this repository if you find it helpful!

Disclaimer: Use of this code is at your own risk. Author bears no responsibility for any damages caused by the code.