vcsa-hardening.sh

#!/bin/bash

# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# ==============================================================================
# VCSA Hardening & Logging Script (v.2.3) 
#
# ==============================================================================
#
# This script automates the hardening of a VMware vCenter Server Appliance (VCSA)
# by enforcing secure zero trust management access. All settings set by the script
# are both idempotent and persistent, and are crucially abstracted from the VAMI
# GUI to prevent modification by a compromised GUI administrator account. It
# leverages default Linux commands to build critical security functionality that
# the VCSA does not support out-of-the-box such as:
#
#   - Port-specific stateful firewalling with connection logging.
#   - Auditing and remote logging of all shell commands.
#   - Remote logging for both allowed and blocked network connections.
#
# --- OPERATIONAL REQUIREMENT: VAMI-MANAGED SYSLOG FORWARDING ---
#
# This script is designed to integrate with the VCSA's native syslog service,
# which must be configured exclusively through the VCSA Management Interface (VAMI).
#
# Before executing this script, you are REQUIRED to configure and enable log
# forwarding to a remote syslog server via the VAMI (on port 5480). Use TLS for
# enhanced security.
#
# ==============================================================================
#
# --- Disclaimer and Supportability ---
#
# Please be formally advised that this VCSA hardening script introduces configurations that 
# may deviate from VMware's standard supported state. Consequently, its application may impact 
# or invalidate your organization's support agreement with VMware. Use of this script is at 
# the user's own discretion and risk.
#
# --- USAGE ---
# Standard Execution: ./vcsa-hardening.sh
# Dry Run (Show changes without applying): ./vcsa-hardening.sh --dry-run
#
# ==============================================================================

# --- START CONFIGURATION ---

# Management Port Access Control (Base Policy - Always Applied)
# In Zero Trust Mode, these lists are also used for the OUTBOUND whitelist.
TRUSTED_SSH_IPS=(
  "<IP-ADDRESS>" # Admin Workstation PAW
)
TRUSTED_WEB_IPS=(
  "<IP-ADDRESS>"    # Admin Workstation / PAW / VMware PowerCLI / API
  "<IP-ADDRESS>/24" # The entire ESXi Host management subnet
  "<IP-ADDRESS>"    # Veeam / NetWorker Server (IMPORTANT: Add Backup IPs here)
)
TRUSTED_VAMI_IPS=(
  "<IP-ADDRESS>" # Admin Workstation PAW
)

# --- RATE LIMITING / BRUTE FORCE PROTECTION ---
# Controls whether the firewall tracks connection frequency.
#
# true  = (Standard Hardening) Block IPs that connect more than 6 times/minute.
#         WARNING: This may block automated backup tools (Dell NetWorker, Veeam).
#
# false = (High Traffic/Backup Support) Disable frequency tracking. 
#         The firewall will ONLY check if the IP is in the Trusted List.
ENABLE_RATE_LIMITING=false

# --- Additional Security Postures (Choose ONE) ---
# To use the base "Standard Hardening" mode, set both to false.

# ENABLE_ZERO_TRUST_MODE (Highest Security - STRICT)
#   - true  = Activates a "True" Zero Trust model. Sets default INPUT and OUTPUT
#             policies to DROP. The outbound whitelist is built ONLY from the
#             explicitly defined IP and network lists below. RFC1918 is NOT trusted.
ENABLE_ZERO_TRUST_MODE=false
# --- CRITICAL USAGE NOTES FOR TRUE ZERO TRUST MODE ---
# If you set ENABLE_ZERO_TRUST_MODE=true, the firewall defaults to DROP for BOTH 
# inbound and outbound traffic. 
#
# INBOUND: Only TCP 22, 443, 5480 (from trusted lists) and UDP 902 (Global) are allowed.
# OUTBOUND: The VCSA can ONLY initiate outbound connections to IPs defined in ALL of 
# the trusted arrays in this configuration block. The script automatically merges:
#   - TRUSTED_SSH_IPS, TRUSTED_WEB_IPS, and TRUSTED_VAMI_IPS
#   - ALLOWED_PUBLIC_IPS and ADDITIONAL_PRIVATE_RANGES
#   - TRUSTED_DNS_SERVERS and TRUSTED_NTP_SERVERS
# 
# You MUST explicitly define all core infrastructure your VCSA needs to talk TO.
# Failure to do so will break vCenter functionality. Your lists must include:
#   - Active Directory / LDAP servers (Put these in ADDITIONAL_PRIVATE_RANGES)
#   - Syslog servers, KMS servers, and Storage Arrays (Put these in ADDITIONAL_PRIVATE_RANGES)
#   - Backup proxies or monitoring tools (e.g., vRealize)
#   - ESXi Management networks (Usually already covered in TRUSTED_WEB_IPS)
#

# BLOCK_INTERNET_ACCESS (Recommended for Production)
#   - true  = Augments the base policy by blocking outbound internet access.
#             This mode is "pragmatic" and allows RFC1918 traffic by default.
BLOCK_INTERNET_ACCESS=false

# Whitelisted IPs & Ranges (used by restrictive modes)
ALLOWED_PUBLIC_IPS=( "162.159.140.167" "172.66.0.165" ) # These fixed IP addresses used to serve VMware Update Manager 
TRUSTED_DNS_SERVERS=( "<IP-ADDRESS>" "<IP-ADDRESS>" )
TRUSTED_NTP_SERVERS=( "<IP-ADDRESS>" )
# CRITICAL for "True" Zero Trust mode. This list must contain any internal
# networks the VCSA needs to contact that are not already in the lists above.
# Example: ADDITIONAL_PRIVATE_RANGES=( "192.168.50.0/24" "192.168.60.0/24" )
ADDITIONAL_PRIVATE_RANGES=()

# Reverse shell port blocking (Always recommended)
ENABLE_REVERSE_SHELL_PORT_BLOCKING=true
REVERSE_SHELL_PORTS=( 1337 4444 4445 5555 6666 7777 8888 9001 9999 31337 )

# --- END CONFIGURATION ---

# ==============================================================================
# SCRIPT LOGIC (Functions and Execution)
# ==============================================================================

# --- Dry Run Mode Detection ---
DRY_RUN=false
if [[ "$1" == "-dry" || "$1" == "--dry-run" ]]; then
  DRY_RUN=true
fi

# --- Initialize SSH Check Status Variable ---
SSH_CHECK_STATUS="Check skipped (not a direct SSH session)."

# --- Helper function for executing commands ---
execute_cmd() {
  if [[ "$DRY_RUN" == "true" ]]; then
    echo "[DRY RUN] Would execute: $@"
  else
    "$@"
  fi
}

# --- Helper function for creating files ---
create_file() {
  local file_path=$1
  if [[ "$DRY_RUN" == "true" ]]; then
    echo "[DRY RUN] Would create/overwrite file: ${file_path}"
    echo "--- Start of content for ${file_path} ---"
    cat - | sed 's/^/| /'
    echo "--- End of content for ${file_path} ---"
  else
    cat - > "${file_path}"
  fi
}

# --- Helper function for checking syslog status ---
check_remote_syslog_configured() {
    local syslog_conf_file="/etc/vmware-syslog/syslog.conf"
    if [[ ! -f "$syslog_conf_file" ]] || ! grep -qE '^[^#$]*\*\.\*\s*@{1,2}' "$syslog_conf_file"; then
        return 1
    else
        return 0
    fi
}

set -e

echo "================================================================================"
echo "      VCSA HARDENING AND LOGGING SCRIPT - MANDIANT (v2.3)        "
echo "================================================================================"

if [[ "$DRY_RUN" == "true" ]]; then
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
echo "!!!                      DRY RUN MODE ACTIVATED                            !!!"
echo "!!!    No changes will be made. The script will only show what it would do.  !!!"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
fi

echo "Starting hardening procedure: $(date)"
execute_cmd logger -p local0.notice -t vcsa_hardening "Script started - version 2.3"
echo ""

# --- SSH Lockout Protection Check ---
if [[ -n "$SSH_CLIENT" ]]; then
    CURRENT_SSH_IP="${SSH_CLIENT%% *}"
    IP_IS_TRUSTED=false
    for trusted_ip in "${TRUSTED_SSH_IPS[@]}"; do
        if [[ "$CURRENT_SSH_IP" == "$trusted_ip" ]]; then
            IP_IS_TRUSTED=true
            break
        fi
    done

    if [[ "$IP_IS_TRUSTED" == "true" ]]; then
        SSH_CHECK_STATUS="PASSED: Your current SSH IP ($CURRENT_SSH_IP) is in the trusted list."
    else
        SSH_CHECK_STATUS="WARNING: Your current SSH IP ($CURRENT_SSH_IP) was NOT in the trusted list."
        echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! SAFETY WARNING !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
        echo "!!! Your current SSH IP address ($CURRENT_SSH_IP) was NOT found in the"
        echo "!!! TRUSTED_SSH_IPS list. This WILL lock you out of your session."
        echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
        
        if [[ "$DRY_RUN" != "true" ]]; then
            read -p "  Do you want to continue anyway? (yes/no): " -r
            if [[ ! "$REPLY" =~ ^[Yy][Ee][Ss]$ ]]; then
                echo "  Aborted by user for safety."
                exit 0
            fi
        fi
    fi
fi

# Configuration Sanity Check
if [[ "$ENABLE_ZERO_TRUST_MODE" == "true" && "$BLOCK_INTERNET_ACCESS" == "true" ]]; then
  echo "  [ERROR] Configuration conflict: Please enable only ONE additional security posture."
  exit 1
fi

# ==============================================================================
# SECTION 1: SHELL AUDITING
# ==============================================================================
echo "[+] Configuring stable shell command auditing..."

# Use the simplified, stable PROMPT_COMMAND that does not cause shell crashes.
create_file /etc/profile.d/99-mandiant-audit.sh <<'EOF'
# Set HISTTIMEFORMAT for accurate timestamps.
export HISTTIMEFORMAT="%F %T "

# This PROMPT_COMMAND is designed for maximum stability and correctness.
export PROMPT_COMMAND='
  # 1. Capture exit code immediately and enable error tolerance.
  __LAST_EXIT_CODE=$?
  set +e

  # 2. Get the last command from history.
  __LAST_CMD=$(history 1 | sed "s/^ *[0-9]* *//")

  # 3. If a command was run, log it.
  if [ -n "$__LAST_CMD" ]; then
    logger -p local1.notice -t SHELL_COMMAND \
      "CMD user=$(whoami) host=$(hostname) pwd=$(pwd) pid=$$ exit=$__LAST_EXIT_CODE cmd=\"$__LAST_CMD\""
  fi

  # 4. Return the original exit code to the shell.
  (exit $__LAST_EXIT_CODE)
'
EOF
execute_cmd chmod +x /etc/profile.d/99-mandiant-audit.sh
execute_cmd sed -i 's/^#*ForwardToSyslog=.*/ForwardToSyslog=yes/' /etc/systemd/journald.conf
execute_cmd systemctl restart systemd-journald
echo "    ✓ Shell command auditing configured"

# ==============================================================================
# SECTION 2: FIREWALL (BASE POLICY & AUGMENTATIONS)
# ==============================================================================
echo "[+] Configuring base firewall policy (protecting management ports)..."
execute_cmd iptables -F INPUT; execute_cmd iptables -F OUTPUT; execute_cmd iptables -F FORWARD
execute_cmd iptables -P FORWARD DROP
for chain in VCSA_SSH_RULES VCSA_WEB_RULES VCSA_VAMI_RULES; do execute_cmd iptables -F $chain &>/dev/null || true; done

if [[ "$ENABLE_ZERO_TRUST_MODE" == "true" ]]; then
    echo "    -> Augmenting with TRUE ZERO TRUST posture (default DROP)."
    execute_cmd iptables -P INPUT DROP; execute_cmd iptables -P OUTPUT DROP
else
    echo "    -> Applying STANDARD posture (default ACCEPT)."
    execute_cmd iptables -P INPUT ACCEPT; execute_cmd iptables -P OUTPUT ACCEPT
fi

execute_cmd iptables -A INPUT -i lo -j ACCEPT; execute_cmd iptables -A OUTPUT -o lo -j ACCEPT
execute_cmd iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
execute_cmd iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
execute_cmd iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "INVALID_PKT: " --log-level 4; execute_cmd iptables -A INPUT -m state --state INVALID -j DROP

# --- RATE LIMITING / BRUTE FORCE PROTECTION LOGIC ---
for service in SSH WEB VAMI; do
  CHAIN_NAME="VCSA_${service}_RULES"; execute_cmd iptables -N "${CHAIN_NAME}" &>/dev/null || true
  
  if [[ "$ENABLE_RATE_LIMITING" == "true" ]]; then
    # Create and link rate limiting chain only if enabled
    RATELIMIT_CHAIN="${CHAIN_NAME}_RATELIMIT"; execute_cmd iptables -N "${RATELIMIT_CHAIN}" &>/dev/null || true
    execute_cmd iptables -F "${RATELIMIT_CHAIN}"
    execute_cmd iptables -A "${RATELIMIT_CHAIN}" -m state --state NEW -m recent --set --name "${service}_CONN"
    execute_cmd iptables -A "${RATELIMIT_CHAIN}" -m state --state NEW -m recent --update --seconds 60 --hitcount 6 --name "${service}_CONN" -j LOG --log-prefix "${service}_BRUTE_FORCE: " --log-level 4
    execute_cmd iptables -A "${RATELIMIT_CHAIN}" -m state --state NEW -m recent --update --seconds 60 --hitcount 6 --name "${service}_CONN" -j DROP
    execute_cmd iptables -A "${RATELIMIT_CHAIN}" -j RETURN
    
    # Insert Rate Limit chain at the top of the Service Chain
    execute_cmd iptables -I "${CHAIN_NAME}" 1 -j "${RATELIMIT_CHAIN}"
  fi
done

execute_cmd iptables -A INPUT -p tcp --dport 22 -j VCSA_SSH_RULES
execute_cmd iptables -A INPUT -p tcp --dport 443 -j VCSA_WEB_RULES
execute_cmd iptables -A INPUT -p tcp --dport 5480 -j VCSA_VAMI_RULES

# --- REQUIRED VCSA BACKEND PORTS ---
# Always allow ESXi Host Heartbeats inbound (Required to prevent host disconnects)
execute_cmd iptables -A INPUT -p udp --dport 902 -j ACCEPT

# Allow vCenter High Availability (vCHA) replication ports
execute_cmd iptables -A INPUT -p tcp --dport 2012 -j ACCEPT
execute_cmd iptables -A INPUT -p tcp --dport 2014 -j ACCEPT
execute_cmd iptables -A INPUT -p tcp --dport 8443 -j ACCEPT

populate_chain() {
  local chain_name=$1 service_name=$2; shift 2; local trusted_ips=("$@")
  if [[ ${#trusted_ips[@]} -eq 0 ]]; then echo "    ⚠ WARNING: No trusted IPs for ${service_name}"; fi
  for ip in "${trusted_ips[@]}"; do execute_cmd iptables -A "${chain_name}" -s "${ip}" -j ACCEPT; done
  execute_cmd iptables -A "${chain_name}" -j LOG --log-prefix "${service_name}_BLOCKED_NEW: " --log-level 4; execute_cmd iptables -A "${chain_name}" -j DROP
}
populate_chain VCSA_SSH_RULES SSH "${TRUSTED_SSH_IPS[@]}"; populate_chain VCSA_WEB_RULES WEB "${TRUSTED_WEB_IPS[@]}"; populate_chain VCSA_VAMI_RULES VAMI "${TRUSTED_VAMI_IPS[@]}"
echo "    ✓ Base firewall policy applied."

if [[ "$ENABLE_RATE_LIMITING" == "false" ]]; then
    echo "    -> NOTE: Rate limiting (Brute Force Protection) is DISABLED to support backup/high-traffic."
fi

# ==============================================================================
# SECTION 3: OUTBOUND CONTROL AUGMENTATIONS
# ==============================================================================
if [[ "$ENABLE_ZERO_TRUST_MODE" == "true" ]]; then
    echo "[+] Applying TRUE ZERO TRUST outbound whitelist..."
    
    # Handle special protocols (DNS, NTP) first
    for dns in "${TRUSTED_DNS_SERVERS[@]}"; do
        execute_cmd iptables -A OUTPUT -d "${dns}" -p udp --dport 53 -j ACCEPT
        execute_cmd iptables -A OUTPUT -d "${dns}" -p tcp --dport 53 -j ACCEPT
    done
    for ntp in "${TRUSTED_NTP_SERVERS[@]}"; do
        execute_cmd iptables -A OUTPUT -d "${ntp}" -p udp --dport 123 -j ACCEPT
    done
    
    # Create a unified list of all other allowed IPs/networks for general traffic
    ZT_GENERAL_WHITELIST=(
        "${TRUSTED_SSH_IPS[@]}"
        "${TRUSTED_WEB_IPS[@]}"
        "${TRUSTED_VAMI_IPS[@]}"
        "${ADDITIONAL_PRIVATE_RANGES[@]}"
        "${ALLOWED_PUBLIC_IPS[@]}"
    )

    # De-duplicate the list to avoid redundant rules
    UNIQUE_ZT_WHITELIST=()
    if [[ ${#ZT_GENERAL_WHITELIST[@]} -gt 0 ]]; then
      readarray -t UNIQUE_ZT_WHITELIST < <(printf "%s\n" "${ZT_GENERAL_WHITELIST[@]}" | sort -u)
    fi

    # Add a general ACCEPT rule for every item in the unique list
    for dest in "${UNIQUE_ZT_WHITELIST[@]}"; do
        execute_cmd iptables -A OUTPUT -d "${dest}" -j ACCEPT
    done

    execute_cmd iptables -A OUTPUT -j LOG --log-prefix "ZT_OUTBOUND_DENIED: " --log-level 4
    echo "    ✓ Outbound traffic is now restricted to the explicit unified whitelist."

elif [[ "$BLOCK_INTERNET_ACCESS" == "true" ]]; then
    echo "[+] Augmenting with Internet Blocking policy..."
    execute_cmd iptables -A OUTPUT -d 10.0.0.0/8 -j ACCEPT; execute_cmd iptables -A OUTPUT -d 172.16.0.0/12 -j ACCEPT; execute_cmd iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
    for range in "${ADDITIONAL_PRIVATE_RANGES[@]}"; do execute_cmd iptables -A OUTPUT -d "${range}" -j ACCEPT; done
    for ip in "${ALLOWED_PUBLIC_IPS[@]}"; do execute_cmd iptables -A OUTPUT -d "${ip}" -j ACCEPT; done
    for dns in "${TRUSTED_DNS_SERVERS[@]}"; do execute_cmd iptables -A OUTPUT -d "${dns}" -p udp --dport 53 -j ACCEPT; execute_cmd iptables -A OUTPUT -d "${dns}" -p tcp --dport 53 -j ACCEPT; done
    for ntp in "${TRUSTED_NTP_SERVERS[@]}"; do execute_cmd iptables -A OUTPUT -d "${ntp}" -p udp --dport 123 -j ACCEPT; done
    if [[ "$ENABLE_REVERSE_SHELL_PORT_BLOCKING" == "true" ]]; then for port in "${REVERSE_SHELL_PORTS[@]}"; do execute_cmd iptables -A OUTPUT -p tcp --dport "$port" -m state --state NEW -j DROP; done; fi
    execute_cmd iptables -A OUTPUT -m state --state NEW -j LOG --log-prefix "INTERNET_BLOCKED: " --log-level 4
    execute_cmd iptables -A OUTPUT -m state --state NEW -j DROP
    echo "    ✓ Outbound internet access is now blocked."

else
    echo "[+] Applying Standard Hardening outbound policy..."
    if [[ "$ENABLE_REVERSE_SHELL_PORT_BLOCKING" == "true" ]]; then
        for port in "${REVERSE_SHELL_PORTS[@]}"; do execute_cmd iptables -A OUTPUT -p tcp --dport "$port" -m state --state NEW -j DROP; done
        echo "    ✓ Reverse shell port blocking is enabled."
    fi
    echo "    ✓ Outbound traffic is permitted."
fi

# ==============================================================================
# SECTION 4: GENERAL HARDENING & PERSISTENCE
# ==============================================================================
echo "[+] Applying general hardening configurations..."

echo "    - Configuring SSH login banner..."
create_file /etc/issue.net <<'EOF'
*******************************************************************************
*                                 W A R N I N G                               *
* This system is restricted to authorized users only. All activities on this  *
* system are logged and monitored. Unauthorized access or use is strictly     *
* prohibited and may be subject to criminal and/or civil prosecution.         *
*******************************************************************************
EOF
execute_cmd sed -i -E 's/^#*Banner .*/Banner \/etc\/issue.net/' /etc/ssh/sshd_config
execute_cmd systemctl restart sshd

echo "    - Configuring log bridge service..."
create_file /usr/local/bin/iptables-log-bridge.sh <<'EOF'
#!/bin/bash
journalctl -kf | grep --line-buffered -E "BLOCKED|BRUTE_FORCE|INVALID|INTERNET|ZT_OUTBOUND|SHELL_COMMAND" | while read line; do logger -p kern.info -t firewall_audit "$line"; done
EOF
execute_cmd chmod +x /usr/local/bin/iptables-log-bridge.sh
create_file /etc/systemd/system/iptables-log-bridge.service <<'EOF'
[Unit]
Description=Bridge iptables logs to syslog

[Service]
ExecStart=/usr/local/bin/iptables-log-bridge.sh
Restart=always
RestartSec=3s

[Install]
WantedBy=multi-user.target
EOF
execute_cmd systemctl daemon-reload
execute_cmd systemctl enable iptables-log-bridge.service
execute_cmd systemctl restart iptables-log-bridge.service

echo "    - Saving configuration for persistence..."
execute_cmd mkdir -p /etc/systemd/scripts
execute_cmd bash -c "iptables-save > /etc/systemd/scripts/ip4save"
execute_cmd systemctl enable iptables.service &>/dev/null || true
echo "    ✓ Final configurations have been saved."

# ==============================================================================
# FINAL CONFIGURATION SUMMARY & SYSLOG CHECK
# ==============================================================================
echo "================================================================================"
if [[ "$DRY_RUN" == "true" ]]; then
  echo "                  CONFIGURATION SUMMARY (DRY RUN)                           "
else
  echo "                        CONFIGURATION SUMMARY                                 "
fi
echo "================================================================================"
echo ""
echo "  SESSION SAFETY CHECK"
echo "  --------------------"
printf "  - SSH Lockout Check: %s\n" "$SSH_CHECK_STATUS"
echo ""
echo "  OVERALL SECURITY POSTURE"
echo "  ------------------------"
if [[ "$ENABLE_RATE_LIMITING" == "true" ]]; then
    echo "  Brute Force Protect:   ACTIVE (Rate Limiting Enabled)"
else
    echo "  Brute Force Protect:   DISABLED (Allows High-Volume Backup Traffic)"
fi

if [[ "$ENABLE_ZERO_TRUST_MODE" == "true" ]]; then
    echo "  Mode Active:           TRUE ZERO TRUST (STRICT)"
    echo "  Inbound Policy:        BLOCKED, except for trusted management IPs and ESXi UDP 902."
    echo "  Outbound Policy:       BLOCKED, except for the explicit unified whitelist below."

elif [[ "$BLOCK_INTERNET_ACCESS" == "true" ]]; then
    echo "  Mode Active:           INTERNET BLOCKING (Pragmatic)"
    echo "  Inbound Policy:        ALLOWED, except for protected management ports."
    echo "  Outbound Policy:       BLOCKED from accessing the internet."

else
    echo "  Mode Active:           STANDARD HARDENING"
    echo "  Inbound Policy:        ALLOWED, except for protected management ports."
    echo "  Outbound Policy:       UNRESTRICTED (Reverse shell ports may be blocked)."
fi
echo ""
echo "  INBOUND MANAGEMENT ACCESS (BASE POLICY)"
echo "  ---------------------------------------"
printf "  - SSH (22) Trusted:      %s\n" "${TRUSTED_SSH_IPS[*]:-NONE DEFINED}"
printf "  - vSphere (443) Trusted: %s\n" "${TRUSTED_WEB_IPS[*]:-NONE DEFINED}"
printf "  - VAMI (5480) Trusted:   %s\n" "${TRUSTED_VAMI_IPS[*]:-NONE DEFINED}"

if [[ "$ENABLE_ZERO_TRUST_MODE" == "true" || "$BLOCK_INTERNET_ACCESS" == "true" ]]; then
echo ""
echo "  OUTBOUND WHITELIST DETAILS"
echo "  --------------------------"
  if [[ "$ENABLE_ZERO_TRUST_MODE" == "true" ]]; then
    echo "  - RFC1918 Private Nets:  BLOCKED BY DEFAULT (True Zero Trust Mode)"
    echo "  - Whitelist built from:  ALL trusted IP/network arrays in the configuration."
    echo "  - ⚠ CRITICAL: VCSA may not function unless all required destinations"
    echo "    (e.g., AD, DNS, Backup, Storage) are defined in the configuration lists."
  else # This applies to BLOCK_INTERNET_ACCESS mode
    echo "  - RFC1918 Private Nets:  10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (Allowed)"
  fi
printf "  - Additional Ranges:     %s\n" "${ADDITIONAL_PRIVATE_RANGES[*]:-None defined}"
printf "  - Allowed DNS Servers:   %s\n" "${TRUSTED_DNS_SERVERS[*]:-None defined}"
printf "  - Allowed NTP Servers:   %s\n" "${TRUSTED_NTP_SERVERS[*]:-None defined}"
printf "  - Allowed Public IPs:    %s\n" "${ALLOWED_PUBLIC_IPS[*]:-None defined}"
fi
echo ""
echo "================================================================================"
echo "  [!] CRITICAL REQUIREMENT: REMOTE SYSLOG FORWARDING STATUS [!]"
echo "--------------------------------------------------------------------------------"
if [[ "$DRY_RUN" != "true" ]] && check_remote_syslog_configured; then
    echo "  Status: CONFIGURED"
    echo "  Remote syslog servers are detected in /etc/vmware-syslog/syslog.conf."
    echo "  All audit and firewall logs generated by this script will be forwarded."
else
    echo "  Status: NOT CONFIGURED or UNVERIFIED (!!! ACTION REQUIRED !!!)"
    echo "  No remote syslog servers were detected in /etc/vmware-syslog/syslog.conf."
    echo "  You MUST configure log forwarding via the VAMI for logs to be stored securely."
    echo "  Failure to do so will result in security logs only being stored locally."
fi
echo "--------------------------------------------------------------------------------"
echo ""
if [[ "$DRY_RUN" == "true" ]]; then
  echo "  DRY RUN COMPLETED. No changes were made to the system."
else
  echo "  Configuration completed successfully: $(date)"
fi
echo "================================================================================"

execute_cmd logger -p local0.notice -t vcsa_hardening "Script completed successfully"
exit 0