LoFP LoFP / vsphere

vsphere rule

TitleTags
a documented maintenance window can enable ssh, relax execinstalledonly, and force-install a vendor vib on the same host. confirm the change ticket and the vib name before treating the sequence as malicious.
a support script stored under `/tmp` or a python inventory check can be pointed at a datastore during maintenance. confirm the file name, the account, and whether virtual machines were shut down in the same session.
administrators create local accounts during onboarding or break-glass setup. confirm the account name and whether it was then granted the admin role.
administrators disable lockdown mode for a documented maintenance window, then turn it back on. confirm the change ticket and that lockdown mode is enabled again afterward.
administrators enable ssh for a documented troubleshooting window. esxi often disables the service again on reboot, so a later enable by a known operator can be expected.
administrators list virtual machines during maintenance and troubleshooting. review whether the same session then kills those processes or searches the datastore.
administrators mark a maintenance or support script executable during a change window. confirm the path, the account, and whether the same session then executes a file from `/tmp` or enumerates virtual disks.
administrators power off virtual machines for patching, decommissioning, and hardware maintenance. review the account and whether the command targeted one vm id or every id returned by `getallvms`.
administrators rotate the root password during scheduled maintenance. confirm the change ticket and that the new password was stored with the approved break-glass process.
administrators run these commands during inventory, troubleshooting, and support. review whether the same session continues into virtual machine shutdown, snapshot removal, or a datastore search.
administrators sign in to the host client or the api as root from a jump host during maintenance. confirm the source address is a known workstation and that the session does not continue into ssh enablement, file copies to `/tmp`, or virtual machine shutdowns.
administrators sometimes force a vendor vib during a documented recovery or upgrade when the acceptance level would otherwise reject it. confirm the vib name against the change ticket.
administrators use `wget` to download a patch, vib, or support script during maintenance. confirm the url and whether the same session continues into file execution or virtual machine shutdown.
an administrator can reset the loghost while moving the host to a new collector. confirm that a new `--loghost` value was set in the same change and that logs are arriving at the collector.
an administrator deletes a rotated log under `/var/log` during a documented maintenance window. confirm the path and the change ticket.
an administrator who mistypes the root password in the host client a few times can reach three failures. confirm the source address is a known workstation and that a successful login did not follow.
audit settings change during collector maintenance. confirm that transmission was enabled again and that the change matches a ticket.
capacity reports, backup troubleshooting, and support scripts list `vmdk` files on a datastore. review the account and whether the search was followed by process kills or snapshot removal.
firewall changes are part of some network troubleshooting and product installs. confirm the change was temporary and that `--enabled true` and a drop default action were restored.
new virtualization administrators and service accounts are granted admin during approved account provisioning. confirm the account name against the identity ticket.
rare troubleshooting can open an ssh session with vpxuser. confirm the source address and that the session matches a change ticket. vcenter itself manages hosts through the api, not through ssh as vpxuser.
rare troubleshooting one-liners can use `printf` or `awk` to generate text. a line that also decodes to a syslog, firewall, or vm command should still be investigated.
snapshot consolidation after backups, storage pressure, and planned decommissioning can remove every snapshot for a vm. confirm the account and whether the command ran against one vm or every vm.
some recovery and lab images leave execinstalledonly off, and an approved change can disable it while a custom vib is installed. confirm the setting is restored to true afterward.
virtual machine process kills also happen during planned maintenance, host upgrades, and troubleshooting of a stuck vm. confirm the world id, the account, and whether the same session also enumerates `/vmfs/volumes` or removes snapshots.