6 ms·
why do people putting their vmware vcenter onto the internet?
by merb 5y ago
why do people putting their vmware vcenter onto the internet?
- perlgeek 5y agoLots of hosting companies use vcenter for managing their VMs, and if you expose vcenter to your customers, you have a very convenient way to have the powercycle VMs, open consoles and stuff like that. And if you expose it to your customers, you either have to force them to use a VPN (and support it for even their dumbest users), or you expose it on the Internet. Not great security wise, but the economics do push you into that direction.
- fulafel 5y agoAlso, if you look at the vulnerability track record of commercial VPN products recently (some mentioned in this article even), they aren't necessarily any safer to keep publically accessible.
- tyingq 5y agoSadly, it's probably happening more with all the "work from home". I imagine lots of Shodan queries for vcenter right now. Apparently "intitle:id_vc_welcome" returns vcenter servers on Google.
- mschuster91 5y agoEven for WFH: just set up a damn openvpn in front of the vcenter server, if you don't have the money for a Cisco Anyconnect appliance. It's not that hard, and anyone ignorant enough to expose a vCenter to the Internet deserves being shut down. This is unacceptably incompetent.
- ocdtrekkie 5y agoFWIW, attackers are also constantly trying to exploit vulnerabilities in your AnyConnect appliance...
- oarsinsync 5y ago> Even for WFH: just set up a damn openvpn in front of the vcenter server, if you don't have the money for a Cisco Anyconnect appliance. It's not that hard If your business depends on employees that are working remotely, and you have critical services behind a VPN, your VPN solution is now a critical service too, and should be built and managed accordingly. Just throwing an OpenVPN host up isn’t enough. If you’re going down that road, you need multiple OpenVPN hosts, each one “hardened” (since they’re internet facing), and a mechanism to deploy the VPN clients (and certificates) to the users. You then need to do this a second time too for an entirely different VPN solution (OpenConnect? WireGuard? StrongSWAN?), in case the first one suffers a vulnerability that you can’t immediately mitigate and instead just needs to be shutdown. Like most technology solutions, this is only trivial to resolve if you’re operating at a really small scale, all your users are tech savvy, and you don’t treat it as a business critical service. The moment your business depends on it, it either ceases to be trivial, or becomes a large source of operational risk.
- mschuster91 5y agoAgreed, but anyone running vCenter on their own is already running complex and expensive infrastructure. There is simply no excuse at all for having it directly wired to the Internet. None.
- 2OEH8eoCRo0 5y agoI think that if it's possible then people will do it. There are so many humans and businesses that it's a certainty.
- Jedd 5y agoIf you're an organisation with vCenter, even if you don't have it 'onto the internet' you're far from safe. Your exposure then is merely every user and every (other) device on your internal network that has routable access to your vCenter. But yes, exposing highly sensitive tools to a wide, untrackable, and frequently hostile audience is not good practice.
- sp332 5y agoAnd all the remote devices connected by VPN. With everyone working from home, that's a pretty high number too.
- deleted 5y ago[deleted]
- croutonwagon 5y agoThis patch was pretty easy to apply too. Didnt even need a reboot IIRC
- 0xbadcafebee 5y agoWhy do people put hospital equipment on the internet? Why do people order steak well done? People are stupid.
- touisteur 5y agoSome people rightly don't trust their 'butcher' or the meat chain of custody that much. We eat shredded raw beef meat here and even I sometimes wince at the idea...
- cj 5y agoOr to put it m0re sanely, people have many priorities. Cybersecurity does not rank very highly for many people (rightly or wrongly).
- taneq 5y agoDon’t steakshame.