[{"data":1,"prerenderedAt":1500},["ShallowReactive",2],{"blog-\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi":3,"blog-\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi-surround":1442,"blog-\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi-certifications":1499},{"id":4,"title":5,"body":6,"categories":1430,"cover":1431,"cover_contain":1432,"credly_badge_id":1430,"date":1433,"description":1434,"extension":1435,"meta":1436,"navigation":1432,"path":1437,"related_certifications":1430,"seo":1438,"slug":1439,"stem":1440,"__hash__":1441},"blog\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi.md","Patchs de sécurité et mises à jour sous VMware ESXi 5",{"type":7,"value":8,"toc":1418},"minimark",[9,14,18,22,110,115,122,245,249,277,311,324,328,394,402,409,430,434,478,500,507,512,515,520,553,559,601,621,624,654,661,665,682,697,700,984,987,993,996,1014,1054,1057,1085,1106,1116,1149,1157,1176,1200,1209,1221,1231,1240,1260,1274,1307,1314,1328,1361,1388,1407,1411,1414],[10,11,13],"h2",{"id":12},"cas-dusage-concret","Cas d'usage concret",[15,16,17],"p",{},"Vous devez maintenir plusieurs hôtes ESXi 5.x à jour côté sécurité : voici comment appliquer les patchs facilement.",[10,19,21],{"id":20},"vmware-esxi-et-la-sécurité-informatique","VMware ESXi et la sécurité informatique",[15,23,24,25,29,30,33,34,37,40,41,44,45,48,49,51,52,55,56,59,60,63,65,66,69,70,73,74,77,78,80,81,83,84,87,88,90,91,94,95,98,99,102,103,87],{},"Les ",[26,27,28],"strong",{},"systèmes informatiques"," sont sensibles aux ",[26,31,32],{},"failles de sécurité",", pas étonnant n’est-ce pas?",[35,36],"br",{},[26,38,39],{},"VMware ESXi"," est lui aussi touché par des ",[26,42,43],{},"vulnérabilités"," qui sont ensuite ",[26,46,47],{},"corrigées"," par l’éditeur.",[35,50],{},"\nAujourd’hui, il est important de suivre l’",[26,53,54],{},"évolution d’un produit"," afin de ",[26,57,58],{},"colmater"," ses ",[26,61,62],{},"failles.",[35,64],{},"\nNous allons prendre l’exemple d’une ",[26,67,68],{},"template ESXi 5.1","  : ",[26,71,72],{},"OVH."," Nous allons ",[26,75,76],{},"patcher"," les ",[26,79,43],{},". ",[35,82],{},"\nLe système deviendra alors un peu plus fiable et rendra la tâche plus difficile aux ",[26,85,86],{},"potentiels pirates",".",[35,89],{},"\nLa ",[26,92,93],{},"découverte"," de la ",[26,96,97],{},"faille HeatBleed"," a aussi touché la version 5.5 d’",[26,100,101],{},"ESXi"," : ",[104,105,109],"a",{"href":106,"rel":107},"http:\u002F\u002Fblogmotion.fr\u002Fsysteme\u002Fpatch-vsphere-11828",[108],"nofollow","exemple de vulnérabilité",[111,112,114],"h3",{"id":113},"bien-comprendre-lenjeu","Bien comprendre l’enjeu :",[15,116,117,118,121],{},"Avant de se lancer dans la correction de vulnérabilité sur une ",[26,119,120],{},"infrastructure"," il est important d’en connaître certaines étapes, avec certains points à retenir :",[123,124,125,137,150,160,171,206,217,230,242],"ul",{},[126,127,128,129,132,133,136],"li",{},"La correction de vulnérabilité est un ",[26,130,131],{},"processus"," à ",[26,134,135],{},"étapes multiples",", il faut réaliser les étapes dans l’ordre.",[126,138,139,140,143,144,146,147,87],{},"Avant de les effectuer, il faut ",[26,141,142],{},"comprendre"," le ",[26,145,131],{}," dans son ",[26,148,149],{},"ensemble",[126,151,152,155,156,159],{},[26,153,154],{},"Les étapes"," sont ",[26,157,158],{},"réversibles,"," un patch peut être désinstallé.",[126,161,162,163,166,167,170],{},"Si vous utilisez ",[26,164,165],{},"des plugins"," vérifiez leur ",[26,168,169],{},"compatibilité"," avec leurs futurs updates.",[126,172,173,174,143,177,180,181,184,185,188,189,180,192,195,196,188,199,180,202,205],{},"Il faut également ",[26,175,176],{},"maîtriser",[26,178,179],{},"langage"," ",[26,182,183],{},"technique"," (",[26,186,187],{},"VIB",", ",[26,190,191],{},"profil",[26,193,194],{},"d","‘",[26,197,198],{},"image",[26,200,201],{},"dépôt",[26,203,204],{},"logiciel",", etc…).",[126,207,208,209,212,213,216],{},"Prenez  des ",[26,210,211],{},"précautions"," (on ne le répète jamais assez) ",[26,214,215],{},": sauvegardez vos VM’s"," !",[126,218,219,220,180,223,226,227],{},"Comprendre la ",[26,221,222],{},"commande",[26,224,225],{},"esxcli"," et ses ",[26,228,229],{},"paramètres.",[126,231,232,233,180,236,238,239,87],{},"Vérifiez vos ",[26,234,235],{},"checksum",[26,237,187],{}," : effectuez un ",[26,240,241],{},"test avant le déploiement",[126,243,244],{},"Appliquez le patch ou l’update sur votre hôte.",[111,246,248],{"id":247},"la-problématique","La problématique :",[15,250,251,252,254,255,258,259,262,263,266,267,87,270,272,273,276],{},"Notre problématique est de ",[26,253,76],{}," un ",[26,256,257],{},"hyperviseur"," sous ",[26,260,261],{},"VMware ESXi 5.1"," vers ",[26,264,265],{},"5.1U1"," puis ",[26,268,269],{},"U2",[35,271],{},"\nPour le ",[26,274,275],{},"processus de mise à jour"," (ESXi 5.1 vers 5.1U1), il faut se poser certaines questions :",[278,279,280,287,301],"ol",{},[126,281,282,283,286],{},"Mon serveur ESXi est-il en production actuellement? Peut-il être en ",[26,284,285],{},"mode maintenance","?",[126,288,289,290,293,294,297,298,286],{},"Quels sont ",[26,291,292],{},"les composants"," qui constituent ",[26,295,296],{},"mon serveur","? Sont-ils ",[26,299,300],{},"compatibles avec  ESXi 5.1",[126,302,24,303,306,307,310],{},[26,304,305],{},"drivers"," sont-ils disponibles pour le ",[26,308,309],{},"futur système ESXi 5.1"," que je souhaite implanter?",[15,312,313,314,317,318,320,323],{},"Ce type de questions est indispensable avant de se lancer dans une ",[26,315,316],{},"migration"," quelle qu’elle soit**.**",[35,319],{},[26,321,322],{},"Adapter vos updates suivant votre serveur",", dans mon cas j’utilise un serveur dédié mSP 2013.",[111,325,327],{"id":326},"lister-les-cve","Lister les CVE",[15,329,330,331,334,335,340,341,346,348,349,352,353,87,356,358,361,362,365,366,369,370,87,375,377,378,381,382,384,385,388,389,87],{},"Il existe un nombre important de site de ",[26,332,333],{},"CVE"," comme par exemple : ",[104,336,339],{"href":337,"rel":338},"https:\u002F\u002Fcve.mitre.org\u002F",[108],"CVE.mitre"," et ",[104,342,345],{"href":343,"rel":344},"http:\u002F\u002Fcert.ssi.gouv.fr\u002Fsite\u002FCERTFR-2014-ALE-003\u002F",[108],"CERT SSI gouv fr.",[35,347],{},"\nQuand un CVE est accessible publiquement, il y a généralement un ",[26,350,351],{},"patch"," pour colmater la ",[26,354,355],{},"faille",[35,357],{},[26,359,360],{},"VMware"," a un ",[26,363,364],{},"portail public"," pour ses ",[26,367,368],{},"vunérabilités"," disponible à cette adresse : ",[104,371,374],{"href":372,"rel":373},"https:\u002F\u002Fwww.vmware.com\u002Fpatchmgr\u002FfindPatch.portal",[108],"portail VMware",[35,376],{},"\nDans notre cas nous allons ",[26,379,380],{},"lister les CVE"," connus publiquement après le 29 aout 2012 (date de sortie de ",[26,383,39],{}," 5.1) depuis le site de ",[26,386,387],{},"CVEdetails"," accessible à cette adresse : ",[104,390,393],{"href":391,"rel":392},"http:\u002F\u002Fwww.cvedetails.com\u002Fvulnerability-search.php",[108],"vunerability",[15,395,396,397,87],{},"La liste des CVE connus pour l’éditeur VMware et le produit ESXi est à l’",[104,398,401],{"href":399,"rel":400},"http:\u002F\u002Fwww.cvedetails.com\u002Fvulnerability-search.php?f=1&vendor=vmware&product=esxi&cveid=&cweid=&cvssscoremin=&cvssscoremax=&psy=2012&psm=08&pey=&pem=&usy=2012&usm=08&uey=&uem=",[108],"adresse suivante",[15,403,404],{},[405,406],"img",{"alt":407,"src":408},"","\u002Fimages\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi\u002F0ecbc06a3d.png",[15,410,411,412,414,415,418,419,180,422,425,426,429],{},"On se rend compte que notre ",[26,413,257],{}," actuellement en ",[26,416,417],{},"production"," connaît des ",[26,420,421],{},"failles",[26,423,424],{},"importantes de sécurité",", il est donc temps de ",[26,427,428],{},"colmater les brèches","!",[10,431,433],{"id":432},"patches-vmware-esxi-51","Patches VMware ESXi 5.1",[15,435,436,437,440,441,443,444,447,448,451,453,454,457,458,87,461,463,464,466,467,470,471,474,475,87],{},"Nous l’avons vu précédemment, le ",[26,438,439],{},"portail"," de ",[26,442,360],{}," nous permet de ",[26,445,446],{},"télécharger"," des ",[26,449,450],{},"patchs.",[35,452],{},"\nNous allons commencer à utiliser ce service en ",[26,455,456],{},"mode CLI"," dans notre ",[26,459,460],{},"busybox ESXi",[35,462],{},"\nPour ma part, je vais joindre mon ",[26,465,101],{}," par ",[26,468,469],{},"SSH",", éteindre mes ",[26,472,473],{},"VMs"," et le mettre en ",[26,476,477],{},"maintenance",[479,480,484],"pre",{"className":481,"code":482,"language":483,"meta":407,"style":407},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","vim-cmd hostsvc\u002Fmaintenance_mode_enter\n","bash",[485,486,487],"code",{"__ignoreMap":407},[488,489,492,496],"span",{"class":490,"line":491},"line",1,[488,493,495],{"class":494},"sBMFI","vim-cmd",[488,497,499],{"class":498},"sfazB"," hostsvc\u002Fmaintenance_mode_enter\n",[15,501,502,503,506],{},"Rendez-vous maintenant sur le ",[26,504,505],{},"portail de VMware"," afin de patcher ESXi 5.1.",[15,508,509],{},[405,510],{"alt":407,"src":511},"\u002Fimages\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi\u002Faa6b0819d7.png",[15,513,514],{},"Cliquez maintenant sur « Search » et une liste déroulante apparaît :",[15,516,517],{},[405,518],{"alt":407,"src":519},"\u002Fimages\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi\u002Fcd07ae8da5.png",[15,521,522,523,526,527,530,531,533,534,537,538,180,541,544,545,548,549,552],{},"Vous avez ici les deux dernières ",[26,524,525],{},"release"," qui comblent des vulnérabilités ou des ",[26,528,529],{},"bugs"," dans ESXi 5.1.",[35,532],{},"\nIl vous faut cocher l’ensemble de vos ",[26,535,536],{},"patchs"," postérieurs à votre version. Mon système ",[26,539,540],{},"Build",[26,542,543],{},"Number"," est le « ",[26,546,547],{},"799733"," » et date du 29\u002F08\u002F2012. Je coche donc l’ensemble des ",[26,550,551],{},"updates"," disponibles puis je clique sur le bouton « Download now ».",[15,554,555,556,558],{},"Après avoir téléchargé le fichier vous avez l’ensemble des patchs dans votre archive.",[35,557],{},"\nSi vous rencontrez des problèmes, téléchargez-les un par un.",[15,560,561,180,565,180,570,180,573,180,578,581,583,584,587,588,591,592,594,595,597,598,600],{},[562,563,564],"em",{},"Pour commencer, je vous conseille de les transférer par",[562,566,567],{},[26,568,569],{},"SFTP",[562,571,572],{},"(avec le logiciel",[562,574,575],{},[26,576,577],{},"Filezilla",[562,579,580],{},"par exemple).",[35,582],{},"\nVeillez à bien noter le ",[26,585,586],{},"md5sum"," de votre archive afin de vérifier de l’",[26,589,590],{},"intégrité"," après le transfère !",[35,593],{},"\nLa commande de vérification du ",[26,596,586],{}," est la suivante dans ",[26,599,39],{}," :",[479,602,604],{"className":481,"code":603,"language":483,"meta":407,"style":407},"md5sum \u002Fchemin\u002FESXi510-201406001.zip\n6f2931d6ad8d85bbc493ca42715030fb  \u002Fchemin\u002FESXi510-201406001.zip\n",[485,605,606,613],{"__ignoreMap":407},[488,607,608,610],{"class":490,"line":491},[488,609,586],{"class":494},[488,611,612],{"class":498}," \u002Fchemin\u002FESXi510-201406001.zip\n",[488,614,616,619],{"class":490,"line":615},2,[488,617,618],{"class":494},"6f2931d6ad8d85bbc493ca42715030fb ",[488,620,612],{"class":498},[15,622,623],{},"On vérifie le md5 de la source d’origine (vmware) :",[479,625,627],{"className":481,"code":626,"language":483,"meta":407,"style":407},"md5sum:6f2931d6ad8d85bbc493ca42715030fb\nBuild Number: 1900470\nKB 2077640\n",[485,628,629,634,645],{"__ignoreMap":407},[488,630,631],{"class":490,"line":491},[488,632,633],{"class":494},"md5sum:6f2931d6ad8d85bbc493ca42715030fb\n",[488,635,636,638,641],{"class":490,"line":615},[488,637,540],{"class":494},[488,639,640],{"class":498}," Number:",[488,642,644],{"class":643},"sbssI"," 1900470\n",[488,646,648,651],{"class":490,"line":647},3,[488,649,650],{"class":494},"KB",[488,652,653],{"class":643}," 2077640\n",[15,655,656,657,660],{},"Le ",[26,658,659],{},"MD5"," correspond parfaitement, nous passons à la dernière étape.",[111,662,664],{"id":663},"patch-avec-esxcli-software-vib","Patch avec esxcli software vib",[15,666,667,668,670,671,674,675,678,679,681],{},"Pour ",[26,669,76],{}," notre ",[26,672,673],{},"hyperviseur VMware"," en ",[26,676,677],{},"version 5.1 vers la  5.1U1",", nous utiliserons la commande ",[26,680,225],{},". On se positionne dans la hiérarchie de la commande suivante :",[479,683,685],{"className":481,"code":684,"language":483,"meta":407,"style":407},"esxcli software vib\n",[485,686,687],{"__ignoreMap":407},[488,688,689,691,694],{"class":490,"line":491},[488,690,225],{"class":494},[488,692,693],{"class":498}," software",[488,695,696],{"class":498}," vib\n",[15,698,699],{},"Ce qui nous renvoie les commandes disponibles :",[479,701,703],{"className":481,"code":702,"language":483,"meta":407,"style":407}," Available Commands:\n  get                   Displays detailed information about one or more installed VIBs\n  install               Installs VIB packages from a URL or depot. VIBs may be installed, upgraded, or\n                        downgraded. WARNING: If your installation requires a reboot, you need to disable HA\n                        first.\n  list                  Lists the installed VIB packages\n  remove                Removes VIB packages from the host. WARNING: If your installation requires a reboot, you\n                        need to disable HA first.\n  update                Update installed VIBs to newer VIB packages. No new VIBs will be installed, only updates.\n                        WARNING: If your installation requires a reboot, you need to disable HA first.\n",[485,704,705,713,745,791,832,838,857,894,910,954],{"__ignoreMap":407},[488,706,707,710],{"class":490,"line":491},[488,708,709],{"class":494}," Available",[488,711,712],{"class":498}," Commands:\n",[488,714,715,718,721,724,727,730,733,736,739,742],{"class":490,"line":615},[488,716,717],{"class":494},"  get",[488,719,720],{"class":498},"                   Displays",[488,722,723],{"class":498}," detailed",[488,725,726],{"class":498}," information",[488,728,729],{"class":498}," about",[488,731,732],{"class":498}," one",[488,734,735],{"class":498}," or",[488,737,738],{"class":498}," more",[488,740,741],{"class":498}," installed",[488,743,744],{"class":498}," VIBs\n",[488,746,747,750,753,756,759,762,765,768,770,773,776,779,782,785,788],{"class":490,"line":647},[488,748,749],{"class":494},"  install",[488,751,752],{"class":498},"               Installs",[488,754,755],{"class":498}," VIB",[488,757,758],{"class":498}," packages",[488,760,761],{"class":498}," from",[488,763,764],{"class":498}," a",[488,766,767],{"class":498}," URL",[488,769,735],{"class":498},[488,771,772],{"class":498}," depot.",[488,774,775],{"class":498}," VIBs",[488,777,778],{"class":498}," may",[488,780,781],{"class":498}," be",[488,783,784],{"class":498}," installed,",[488,786,787],{"class":498}," upgraded,",[488,789,790],{"class":498}," or\n",[488,792,794,797,800,803,806,809,812,814,817,820,823,826,829],{"class":490,"line":793},4,[488,795,796],{"class":494},"                        downgraded.",[488,798,799],{"class":498}," WARNING:",[488,801,802],{"class":498}," If",[488,804,805],{"class":498}," your",[488,807,808],{"class":498}," installation",[488,810,811],{"class":498}," requires",[488,813,764],{"class":498},[488,815,816],{"class":498}," reboot,",[488,818,819],{"class":498}," you",[488,821,822],{"class":498}," need",[488,824,825],{"class":498}," to",[488,827,828],{"class":498}," disable",[488,830,831],{"class":498}," HA\n",[488,833,835],{"class":490,"line":834},5,[488,836,837],{"class":494},"                        first.\n",[488,839,841,844,847,850,852,854],{"class":490,"line":840},6,[488,842,843],{"class":494},"  list",[488,845,846],{"class":498},"                  Lists",[488,848,849],{"class":498}," the",[488,851,741],{"class":498},[488,853,755],{"class":498},[488,855,856],{"class":498}," packages\n",[488,858,860,863,866,868,870,872,874,877,879,881,883,885,887,889,891],{"class":490,"line":859},7,[488,861,862],{"class":494},"  remove",[488,864,865],{"class":498},"                Removes",[488,867,755],{"class":498},[488,869,758],{"class":498},[488,871,761],{"class":498},[488,873,849],{"class":498},[488,875,876],{"class":498}," host.",[488,878,799],{"class":498},[488,880,802],{"class":498},[488,882,805],{"class":498},[488,884,808],{"class":498},[488,886,811],{"class":498},[488,888,764],{"class":498},[488,890,816],{"class":498},[488,892,893],{"class":498}," you\n",[488,895,897,900,902,904,907],{"class":490,"line":896},8,[488,898,899],{"class":494},"                        need",[488,901,825],{"class":498},[488,903,828],{"class":498},[488,905,906],{"class":498}," HA",[488,908,909],{"class":498}," first.\n",[488,911,913,916,919,921,923,925,928,930,933,936,939,941,944,946,948,951],{"class":490,"line":912},9,[488,914,915],{"class":494},"  update",[488,917,918],{"class":498},"                Update",[488,920,741],{"class":498},[488,922,775],{"class":498},[488,924,825],{"class":498},[488,926,927],{"class":498}," newer",[488,929,755],{"class":498},[488,931,932],{"class":498}," packages.",[488,934,935],{"class":498}," No",[488,937,938],{"class":498}," new",[488,940,775],{"class":498},[488,942,943],{"class":498}," will",[488,945,781],{"class":498},[488,947,784],{"class":498},[488,949,950],{"class":498}," only",[488,952,953],{"class":498}," updates.\n",[488,955,957,960,962,964,966,968,970,972,974,976,978,980,982],{"class":490,"line":956},10,[488,958,959],{"class":494},"                        WARNING:",[488,961,802],{"class":498},[488,963,805],{"class":498},[488,965,808],{"class":498},[488,967,811],{"class":498},[488,969,764],{"class":498},[488,971,816],{"class":498},[488,973,819],{"class":498},[488,975,822],{"class":498},[488,977,825],{"class":498},[488,979,828],{"class":498},[488,981,906],{"class":498},[488,983,909],{"class":498},[15,985,986],{},"Les détails des commandes sont très bien expliqués, dans mon cas j’utilise les updates.",[15,988,989,992],{},[26,990,991],{},"Connaître la version ESXi"," (optionnel) :",[15,994,995],{},"Avant de vous lancer, vous pouvez savoir à tout instant la version de votre hyperviseur :",[479,997,999],{"className":481,"code":998,"language":483,"meta":407,"style":407},"esxcli system version get\n",[485,1000,1001],{"__ignoreMap":407},[488,1002,1003,1005,1008,1011],{"class":490,"line":491},[488,1004,225],{"class":494},[488,1006,1007],{"class":498}," system",[488,1009,1010],{"class":498}," version",[488,1012,1013],{"class":498}," get\n",[479,1015,1017],{"className":481,"code":1016,"language":483,"meta":407,"style":407},"Product: VMware ESXi\nVersion: 5.1.0\nBuild: Releasebuild-799733\nUpdate: 0\n",[485,1018,1019,1030,1038,1046],{"__ignoreMap":407},[488,1020,1021,1024,1027],{"class":490,"line":491},[488,1022,1023],{"class":494},"Product:",[488,1025,1026],{"class":498}," VMware",[488,1028,1029],{"class":498}," ESXi\n",[488,1031,1032,1035],{"class":490,"line":615},[488,1033,1034],{"class":494},"Version:",[488,1036,1037],{"class":643}," 5.1.0\n",[488,1039,1040,1043],{"class":490,"line":647},[488,1041,1042],{"class":494},"Build:",[488,1044,1045],{"class":498}," Releasebuild-799733\n",[488,1047,1048,1051],{"class":490,"line":793},[488,1049,1050],{"class":494},"Update:",[488,1052,1053],{"class":643}," 0\n",[15,1055,1056],{},"Il existe un équivalent de la commande ci-dessus tel que :",[479,1058,1060],{"className":481,"code":1059,"language":483,"meta":407,"style":407},"vmware -l\nVMware ESXi 5.1.0 Update 0\n",[485,1061,1062,1070],{"__ignoreMap":407},[488,1063,1064,1067],{"class":490,"line":491},[488,1065,1066],{"class":494},"vmware",[488,1068,1069],{"class":498}," -l\n",[488,1071,1072,1074,1077,1080,1083],{"class":490,"line":615},[488,1073,360],{"class":494},[488,1075,1076],{"class":498}," ESXi",[488,1078,1079],{"class":643}," 5.1.0",[488,1081,1082],{"class":498}," Update",[488,1084,1053],{"class":643},[15,1086,1087,1088,1091,1092,1094,1095,1098,1099,1102,1103,1105],{},"Nous pouvons maintenant ",[26,1089,1090],{},"appliquer"," notre premier ",[26,1093,351],{},"! Je vous conseille comme première commande d’utiliser le paramètre suivant : ",[26,1096,1097],{},"–dry-run"," car il permet de connaître les changements qui seront effectifs après l’",[26,1100,1101],{},"update."," C’est très pratique pour être certain de ne pas enlever un ",[26,1104,187],{}," personnalisé, comme le driver d’une carte réseau par exemple.",[15,1107,1108,1109,1111,1112,1115],{},"Voici comment appliquer un ",[26,1110,351],{}," en mode simulation avec l’",[26,1113,1114],{},"argument –dry-run"," à la fin :",[479,1117,1119],{"className":481,"code":1118,"language":483,"meta":407,"style":407},"esxcli software vib update -d \"\u002Fvmfs\u002Fvolumes\u002Fdatastore1\u002FESXi550-201407001.zip\" --dry-run\n",[485,1120,1121],{"__ignoreMap":407},[488,1122,1123,1125,1127,1130,1133,1136,1140,1143,1146],{"class":490,"line":491},[488,1124,225],{"class":494},[488,1126,693],{"class":498},[488,1128,1129],{"class":498}," vib",[488,1131,1132],{"class":498}," update",[488,1134,1135],{"class":498}," -d",[488,1137,1139],{"class":1138},"sMK4o"," \"",[488,1141,1142],{"class":498},"\u002Fvmfs\u002Fvolumes\u002Fdatastore1\u002FESXi550-201407001.zip",[488,1144,1145],{"class":1138},"\"",[488,1147,1148],{"class":498}," --dry-run\n",[479,1150,1155],{"className":1151,"code":1153,"language":1154},[1152],"language-text","Dryrun only, host not changed. The following installers will be applied\n","text",[485,1156,1153],{"__ignoreMap":407},[15,1158,1159,1160,188,1163,1166,1167,1170,1171,1173,1174,600],{},"Je n’affiche pas la liste mais il y a 3 onglets : ",[26,1161,1162],{},"update",[26,1164,1165],{},"remove",", et ",[26,1168,1169],{},"skip",", si tout vous semble correct nous pouvons passer à l’",[26,1172,1162],{}," de notre ",[26,1175,101],{},[479,1177,1179],{"className":481,"code":1178,"language":483,"meta":407,"style":407},"esxcli software vib update -d \"\u002Fvmfs\u002Fvolumes\u002Fdatastore1\u002FESXi550-201407001.zip\"\n",[485,1180,1181],{"__ignoreMap":407},[488,1182,1183,1185,1187,1189,1191,1193,1195,1197],{"class":490,"line":491},[488,1184,225],{"class":494},[488,1186,693],{"class":498},[488,1188,1129],{"class":498},[488,1190,1132],{"class":498},[488,1192,1135],{"class":498},[488,1194,1139],{"class":1138},[488,1196,1142],{"class":498},[488,1198,1199],{"class":1138},"\"\n",[15,1201,1202,1203,143,1206,1208],{},"Vous pouvez désormais ",[26,1204,1205],{},"désactiver",[26,1207,285],{}," sur le serveur :",[479,1210,1212],{"className":481,"code":1211,"language":483,"meta":407,"style":407},"vim-cmd hostsvc\u002Fmaintenance_mode_exit\n",[485,1213,1214],{"__ignoreMap":407},[488,1215,1216,1218],{"class":490,"line":491},[488,1217,495],{"class":494},[488,1219,1220],{"class":498}," hostsvc\u002Fmaintenance_mode_exit\n",[15,1222,1223,1224,1227,1228,600],{},"Effectuez un ",[26,1225,1226],{},"redémarrage"," du ",[26,1229,1230],{},"serveur",[479,1232,1234],{"className":481,"code":1233,"language":483,"meta":407,"style":407},"reboot\n",[485,1235,1236],{"__ignoreMap":407},[488,1237,1238],{"class":490,"line":491},[488,1239,1233],{"class":494},[15,1241,1242,1243,1246,1247,87,1250,1252,1253,1255,1256,1259],{},"Une fois le redémarrage du serveur terminé, votre ",[26,1244,1245],{},"client vSphere"," va se ",[26,1248,1249],{},"mettre à jour",[35,1251],{},"\nUne fois connecté en ",[26,1254,469],{}," à l’hyperviseur voici le nouveau ",[26,1257,1258],{},"build"," de l’update :",[479,1261,1262],{"className":481,"code":998,"language":483,"meta":407,"style":407},[485,1263,1264],{"__ignoreMap":407},[488,1265,1266,1268,1270,1272],{"class":490,"line":491},[488,1267,225],{"class":494},[488,1269,1007],{"class":498},[488,1271,1010],{"class":498},[488,1273,1013],{"class":498},[479,1275,1277],{"className":481,"code":1276,"language":483,"meta":407,"style":407},"Product: VMware ESXi\nVersion: 5.1.0\nBuild: Releasebuild-1065491\nUpdate: 1\n",[485,1278,1279,1287,1293,1300],{"__ignoreMap":407},[488,1280,1281,1283,1285],{"class":490,"line":491},[488,1282,1023],{"class":494},[488,1284,1026],{"class":498},[488,1286,1029],{"class":498},[488,1288,1289,1291],{"class":490,"line":615},[488,1290,1034],{"class":494},[488,1292,1037],{"class":643},[488,1294,1295,1297],{"class":490,"line":647},[488,1296,1042],{"class":494},[488,1298,1299],{"class":498}," Releasebuild-1065491\n",[488,1301,1302,1304],{"class":490,"line":793},[488,1303,1050],{"class":494},[488,1305,1306],{"class":643}," 1\n",[15,1308,1309,1310,1313],{},"Il suffit d’appliquer les même étapes pour le passer en ",[26,1311,1312],{},"5.1U2"," ce qui donne après application :",[479,1315,1316],{"className":481,"code":998,"language":483,"meta":407,"style":407},[485,1317,1318],{"__ignoreMap":407},[488,1319,1320,1322,1324,1326],{"class":490,"line":491},[488,1321,225],{"class":494},[488,1323,1007],{"class":498},[488,1325,1010],{"class":498},[488,1327,1013],{"class":498},[479,1329,1331],{"className":481,"code":1330,"language":483,"meta":407,"style":407},"Product: VMware ESXi\nVersion: 5.1.0\nBuild: Releasebuild-1483097\nUpdate: 2\n",[485,1332,1333,1341,1347,1354],{"__ignoreMap":407},[488,1334,1335,1337,1339],{"class":490,"line":491},[488,1336,1023],{"class":494},[488,1338,1026],{"class":498},[488,1340,1029],{"class":498},[488,1342,1343,1345],{"class":490,"line":615},[488,1344,1034],{"class":494},[488,1346,1037],{"class":643},[488,1348,1349,1351],{"class":490,"line":647},[488,1350,1042],{"class":494},[488,1352,1353],{"class":498}," Releasebuild-1483097\n",[488,1355,1356,1358],{"class":490,"line":793},[488,1357,1050],{"class":494},[488,1359,1360],{"class":643}," 2\n",[15,1362,1363,1366,1368,180,1371,180,1378,180,1385],{},[562,1364,1365],{},"Je vous l’accorde, la manipulation est assez fastidieuse, c’est une méthode sur un seul hôte.",[35,1367],{},[562,1369,1370],{},"Il existe une méthode plus simple avec",[104,1372,1375],{"href":1373,"rel":1374},"http:\u002F\u002Fwww.youtube.com\u002Fwatch?v=PF3mo3Z3mI4",[108],[562,1376,1377],{},"VMware Vcenter",[104,1379,1382],{"href":1380,"rel":1381},"https:\u002F\u002F\u002F\u002Fwww.kassianoff.fr\u002F",[108],[562,1383,1384],{},"Update Manager",[562,1386,1387],{},"(payant).",[15,1389,1390,1391,1394,1395,429,1398,1400,1401,1403,1404,429],{},"Vous savez désormais comment ",[26,1392,1393],{},"colmater une faille"," dans votre ",[26,1396,1397],{},"hyperviseur ESXi",[35,1399],{},"\nJe vous encourage à colmater les ",[26,1402,32],{},", tenez vous informé, abonnz-vous au ",[26,1405,1406],{},"flux RSS CVE",[10,1408,1410],{"id":1409},"conclusion","Conclusion",[15,1412,1413],{},"Cet article a montré comment identifier et appliquer les correctifs de sécurité sur un hyperviseur VMware ESXi 5.1, en s’appuyant sur les bases CVE publiques et le portail de patchs de VMware, puis en utilisant la commande esxcli software vib update (avec l’option --dry-run pour valider les changements avant application). Cette démarche, bien que fastidieuse sur un hôte isolé, permet de colmater des failles connues et de réduire la surface d’attaque de l’infrastructure. Pour une gestion à plus grande échelle, VMware vCenter Update Manager reste une alternative payante plus adaptée.",[1415,1416,1417],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}",{"title":407,"searchDepth":615,"depth":615,"links":1419},[1420,1421,1426,1429],{"id":12,"depth":615,"text":13},{"id":20,"depth":615,"text":21,"children":1422},[1423,1424,1425],{"id":113,"depth":647,"text":114},{"id":247,"depth":647,"text":248},{"id":326,"depth":647,"text":327},{"id":432,"depth":615,"text":433,"children":1427},[1428],{"id":663,"depth":647,"text":664},{"id":1409,"depth":615,"text":1410},null,"\u002Fimages\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi\u002Fd8c6089e77.png",true,"2014-07-15","Mettre à jour différentes versions d'ESXi 5.x facilement. Colmater une faille de sécurité dans ESXi avec les vib.","md",{},"\u002Fblog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi",{"title":5,"description":1434},"patchs-securite-mises-jour-sous-vmware-esxi","blog\u002Fpatchs-securite-mises-jour-sous-vmware-esxi","w8kAwULEjqD8T05s39ex8kpGi4_URDwEkBKqK2ie_aw",[1443,1451,1458,1466,1472,1479,1486,1493],{"title":1444,"path":1445,"stem":1446,"date":1447,"cover":1448,"categories":1449,"children":-1},"Configuration de VLAN avec Junos","\u002Fblog\u002Fconfiguration-vlan-avec-junos","blog\u002Fconfiguration-vlan-avec-junos","2014-11-18","\u002Fimages\u002Fblog\u002Fconfiguration-vlan-avec-junos\u002F1b4814003c.jpg",[1450],"Réseau",{"title":1452,"path":1453,"stem":1454,"date":1455,"cover":1456,"categories":1457,"children":-1},"Configuration de base sous Junos","\u002Fblog\u002Fconfiguration-base-sous-junos","blog\u002Fconfiguration-base-sous-junos","2014-09-10","\u002Fimages\u002Fblog\u002Fconfiguration-base-sous-junos\u002F1b4814003c.jpg",[1450],{"title":1459,"path":1460,"stem":1461,"date":1462,"cover":1463,"categories":1464,"children":-1},"Le  témoignage de ma formation au Greta-Viva5 de Valence : l’alternance,  la rentrée, les cours.","\u002Fblog\u002Fle-temoignage-formation-greta-viva5-valence-alternance-rentree-les-cours","blog\u002Fle-temoignage-formation-greta-viva5-valence-alternance-rentree-les-cours","2014-09-01","\u002Fimages\u002Fblog\u002Fle-temoignage-formation-greta-viva5-valence-alternance-rentree-les-cours\u002Fe27f7627f8.jpg",[1465],"Évènement",{"title":1467,"path":1468,"stem":1469,"date":1470,"cover":1471,"categories":1430,"children":-1},"Installation de certificat SSL Gandi avec Pound","\u002Fblog\u002Finstallation-certificat-ssl-gandi-avec-pound","blog\u002Finstallation-certificat-ssl-gandi-avec-pound","2014-08-12","\u002Fimages\u002Fblog\u002Finstallation-certificat-ssl-gandi-avec-pound\u002Fec4618d7ad.jpg",{"title":1473,"path":1474,"stem":1475,"date":1476,"cover":1477,"categories":1478,"children":-1},"Migration de Vyatta 6.6R1 vers VyOS Hydrogen","\u002Fblog\u002Fmigration-vyatta-6r1-vers-vyos-hydrogen","blog\u002Fmigration-vyatta-6r1-vers-vyos-hydrogen","2014-07-14","\u002Fimages\u002Fblog\u002Fmigration-vyatta-6r1-vers-vyos-hydrogen\u002F8a3fd53886.png",[1450],{"title":1480,"path":1481,"stem":1482,"date":1483,"cover":1484,"categories":1485,"children":-1},"Configuration d’une passerelle SRX100 sous J-Web","\u002Fblog\u002Fconfiguration-une-passerelle-srx100-sous-web","blog\u002Fconfiguration-une-passerelle-srx100-sous-web","2014-07-10","\u002Fimages\u002Fblog\u002Fconfiguration-une-passerelle-srx100-sous-web\u002F1b4814003c.jpg",[1450],{"title":1487,"path":1488,"stem":1489,"date":1490,"cover":1491,"categories":1492,"children":-1},"Hack In Paris et Nuit du Hack du 26 au 29 Juin 2014","\u002Fblog\u002Fhack-paris-nuit-hack-juin-2014","blog\u002Fhack-paris-nuit-hack-juin-2014","2014-04-11","\u002Fimages\u002Fblog\u002Fhack-paris-nuit-hack-juin-2014\u002Fd1c6cbea4e.jpg",[1465],{"title":1494,"path":1495,"stem":1496,"date":1497,"cover":1498,"categories":1430,"children":-1},"Configurer l’interface web de ruTorrent avec Apache2","\u002Fblog\u002Fconfigurer-interface-web-rutorrent-avec-apache2","blog\u002Fconfigurer-interface-web-rutorrent-avec-apache2","2014-03-31","\u002Fimages\u002Fblog\u002Fconfigurer-interface-web-rutorrent-avec-apache2\u002F672919258b.png",[],1786644879180]