Creating a Minimum Privilege User for Qualys Scans on ESXi Hosts and vCenter Server
Article ID: 452789
Updated On:
Products
Issue/Introduction
- A user needs to be created on the ESXi host and vCenter Server to perform Qualys Scans.
- Qualys public documentation indicates that scanning ESXi hosts is supported using either direct ESXi credentials or indirect vCenter Server credentials.
Environment
VMware vCenter Server
VMware vSphere ESXi
Cause
The environment requires a local, minimum privilege user account configured on the ESXi host or vCenter Server to successfully execute Qualys vulnerability scans.
Resolution
As per Qualys's official documentation, Qualys supports scanning ESXi hosts using two primary authentication methods. You can choose the method that best aligns with your environment's architecture:
Direct ESXi Credentials: The Qualys scanner authenticates directly to the individual ESXi host.
Action: To create a local user with the necessary permissions on the ESXi host, follow the official Qualys guide: Steps to Create Minimum Privilege User for ESXi Scan
vCenter Server Credentials: The Qualys scanner authenticates to the vCenter Server, which then pulls data for the managed ESXi hosts.
Action: To create a user and custom role within vCenter, follow the official Qualys guide: Steps to Create Minimum Privilege User for ESXi Scan (from vCenter)
Additional Information
Feedback
