Securing an ESX service console is important because:
A.
VMs depend on the patch level of the service console
B.
Service Console actions can affect all VMs on an ESX host
C.
Service Console permissions are applied to users when logging in to a host via
vCenter
D.
VMs run in the service console
Explanation:
With VMware ESX being loaded on top of the server hardware, there are a few points of
immediate concern:
1. the VMKernel & its virtualization layer
2. the VMware ESX Service console (based on Red Hat Linux Enterprise)
These two pieces are two very distinct parts of VMware ESX. VMware has periodically
released patches for both of these different components although you probably just
thought of them as "ESX patches".
Concerning #1, the VMKernel and its virtualization layer is extremely secure. The Guest
machines have hardware isolation in place and it seems impossible that a guest VM could
somehow compromise the security of the host virtualization layer.
As for #2, with the services console being based on Linux, it will be affected by most of
the Red Hat Linux vulnerabilities. Because the service console is a Linux OS with a
direct link to the VMKernel, I will focus on securing the service console