Information
The Managed Object Browser (MOB) is a web-based server application that lets you examine objects that exist on the server side, explore the object model used by the VM kernel to manage the host, and change configurations. It is installed and started automatically when vCenter is installed.
Rationale:
The MOB is meant to be used primarily for debugging the vSphere SDK. Because there are no access controls, the MOB could also be used as a method to obtain information about a host being targeted for unauthorized access.
Solution
To disable the MOB, run the following ESXi shell command:
vim-cmd proxysvc/remove_service '/mob' 'httpsWithRedirect'
Additionally, the following PowerCLI command may be used:
Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob |Set-AdvancedSetting -value 'false'
Note: You cannot disable the MOB while a host is in lockdown mode.
References:
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-0EF83EA7-277C-400B-B697-04BDC9173EA3.html
Notes:
Some third-party tools use the MOB to gather information. Use the following command to re-enable the MOB temporarily for third-party tool usage:
vim-cmd proxysvc/add_np_service '/mob' httpsWithRedirect /var/run/vmware/proxy-mob