Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

How to Disable/Enable the SLP Service on VMware ESXi (76372)

Last Updated: 2/27/2024Categories: SecurityTotal Views: 924590Language:
Chinese (Simplified)JapaneseEnglish

448 like this article

Subscribe to get an email
newsletter with new updates

448 people found this helpful Please provide article feedback:

Learn how VMware Skyline Advisor and Skyline Health Diagnostics work together to provide proactive intelligence and self-service log analysis.

Use Skyline Advisor to avoid issues before they occur across VCF, vSphere, vSAN, NSX, vROps & Horizon. Skyline Findings are based on top KBs, VMSAs/CVEs and design best practices.

Use Skyline Health Diagnostics to root cause vSphere & vSAN logs when an issue occurs. Skyline Health Diagnostic Findings are based on top KBs and VMSA/CVEs. You can use the Skyline Health Diagnostics tool in online or offline mode.

If you require additional help from technical support, please use Skyline Advisor to initiate a Log Assist to reduce time to upload logs. TSEs can also initiate logs to reduce effort.

Details

OpenSLP vulnerabilities have been disclosed that affect ESXi. These vulnerabilities and their impact on VMware products are documented in the following VMware Security Advisories (VMSAs), please review these before continuing as there may be considerations outside the scope of this document:

VMSA-2022-0030 (CVE-2022-31699)

VMSA-2021-0014 (CVE-2021-21995) - Click here for further information on the advisory

VMSA-2021-0002 (CVE-2021-21974)

VMSA-2020-0023 (CVE-2020-3992)
VMSA-2019-0022 (CVE-2019-5544)

The ESXi team has investigated these vulnerabilities and determined that the possibility of exploitation can be removed by performing the steps detailed in the resolution section of this article. This workaround is meant to be a temporary solution only and customers are advised to deploy the patches documented in the aforementioned VMSAs.

Warning:

This workaround is applicable ONLY to ESXi. Do not apply this workaround to other VMware products.

Functionality Impacts:

With the workaround, CIM clients which uses SLP to find CIM servers over port #427 will not be able to locate the service.

There is no requirement to reboot the ESXi host to disable/enable the service

Solution

Details on the available powercli options to disable the service are documented here

To implement the workaround perform the following steps:

1 Login to the ESXi hosts using an SSH session (such as putty)

2 Stop the SLP service on the ESXi host with this command:

/etc/init.d/slpd stop

Note: The SLP service can only be stopped when the service is not in use. Use the following command to view the operational state of Service Location Protocol Daemon:

esxcli system slp stats get

3 Run the following command to disable the SLP service:

esxcli network firewall ruleset set -r CIMSLP -e 0

To make this change persist across reboots:

chkconfig slpd off

To check if the change is applied across reboots:

chkconfig --list | grep slpd

output: slpd off

To remove the workaround perform the following steps:

Run the following command to enable the ruleset of SLP service:

esxcli network firewall ruleset set -r CIMSLP -e 1

Run the following command to change the current startup information of slpd service:

chkconfig slpd on

Run the following command to check if the change is applied after running the above step (Step 2#):

chkconfig --list | grep slpd

output: slpd on

Run the following command to start the SLP service:

/etc/init.d/slpd start

Disable and enable the CIM agent, see How to disable or enable the CIM agent on the ESX/ESXi host

Later versions of ESXi report the SLPD service in the vCenter GUI

1. To check if you can update the SLP service via the vSphere client, login to the vCenter

2 Select the ESXi host and click on "Configure"  -- "Services". Look for SLP in the list
If SLP is not listed, then use the process detailed above

3 Select SLPD and click on "Stop" and then click "Ok"

4 Select " Edit Startup Policy" and select "Start and stop manually". Click Ok

5 Reverse the steps above to re-enable the service

Related Information

VMware Skyline Health Diagnostics for vSphere - FAQ
For up-to-date information on these vulnerabilities as well as future security information please sign up for our VMSA mailing list .

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware vSphere ESXi

Related Versions:

VMware vSphere ESXi 7.0.0

VMware vSphere ESXi 6.7

VMware vSphere ESXi 6.5

VMware vSphere ESXi 6.0

Take Our Survey

Support Assistant