Wednesday, 5 February 2014

Identifying the vCenter Single Sign-On server deployment mode (2035817)

Details

vCenter Single Sign-On (SSO) can be deployed in three modes: Basic, Cluster (HA), and Multisite. You can choose one of these modes during the installation. However, after installation, the vSphere Web Client does not indicate the mode in which the server is running.

This article provides information on identifying the deployment mode in which SSO is running.

Solution

To identify the SSO deployment mode:

In the vCenter Single Sign-On server, click Start > Run, type regedit, and click OK. The Registry Editor window opens.
Browse to the HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Infrastructure\SSOServer\SetupType key.
Check the value of this key. This value determines the SSO deployment mode.

The value of this key can be:
- Basic
- Primary
- HA
- Multisite

Note: There are four types of possible values, even though there are only three deployment types. This is because the first node deployed in an HA or Multisite is identified as the Primary node.

Source:-
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2035817

Tuesday, 4 February 2014

Use Cases for PVLAN

3 Types of Private VLANs

There are 3 types of PVLANs configurable in a vSphere 5 environment. These include:

Promiscuous (Primary) – Can communicate with all interfaces in the VLAN. It is the primary PVLAN and is by default the first created. Only 1 promiscuous PVLAN per VLAN can be present at any given time. Routers are typically associated with promiscuous ports.
Isolated (Secondary) – Can communicate only with the promiscuous port not with other clients on the same PVLAN. A common use cases for isolated PVLANs include an ISP’s DMZ.
Community (Secondary) - Can communicate with other clients on the same VLAN and the promiscuous port. Commonly used in DVI environments.

Sunday, 2 February 2014

Session Files in vMA

Session Files
An alternative to vi-fastpass for automating cached credentials are session files.
Session files are Perl script files that save session credentials in an aptly named saved session file, called save_ session.pl.

Example
save_session.pl –server ‘servername‘ –user name root –password password –savesessionfile /home/vi-admin/esxsession
Once this has been saved, add it to the end of a command run through the vMA.

Example
vicfg-nics -l –sessionfile /home/vi-admin/esxsession

vmware-cmd Command

NAME

vmware-cmd - perform virtual machine operations

SYNOPSIS

General Options

  vmware-cmd [--help | -q | -v]

Server Operations

 vmware-cmd -s <conn_option> 
   [-l |
    -s register <config_file_path> [<datacenter>] [<resource_pool>] |
    -s unregister <config_file_path> ]

Virtual Machine Operations

 vmware-cmd <conn_option> <config_file_path>
    [answer |
     connectdevice <device_name> |
     createsnapshot <name> <description> quiesce [0|1] memory [0|1] |
     disconnectdevice <device_name> |
     getconfigfile |
     getguestinfo <variable> |
     getproductinfo [product|platform|build|majorversion|minorversion] |
     getstate |
     gettoolslastactive |
     getuptime |
     hassnapshot |
     reset [soft|hard] |
     removesnapshots
     revertsnapshot |
     setguestinfo <variable> <value> |
     start |
     suspend [soft|hard] ]

DESCRIPTION

vmware-cmd provides an interface to perform operations on a virtual machine. You can retrieve information such as the power state, register and unregister the virtual machine, set configuration variables, and manage snapshots.

OPTIONS

CONNECTION OPTIONS

The vmware_cmd vSphere CLI command connection options differ from those of most other vSphere CLI commands.

-H <host>: Specifies an ESX/ESXi host or a vCenter Server system.
-h | --vihost <esx_host>: Specifies a target host if the host specified by -H <host> is a vCenter Server system.
-O <port>: Specifies an alternative port. Default is 443
-U <user_name>: Name of the user who connects to the target. This user must have privileges to perform the operation.
-P <password>: Password of the user specified by <username>. Required if a user is specified.
--config <connection_config_file>: Location of a configuration file that specifies connection information.
--credstore <cred_store>: Name of a credential store file.
--sessionfile <session_file>: Name of a session file that was saved earlier using the vSphere SDK for Perl session/save_session.pl script.
--passthroughauth <passthroughauth>: If you specify this option, the system attempts to connect using Microsoft Windows Security Support Provider Interface (SSPI).

GENERAL OPTIONS

--help: Prints a help message for each command-specific and each connection option. Calling the script with no arguments or with --help has the same effect.
-q: Turns on quiet mode with minimal output.
-v: Turns on verbose mode.

OPERATIONS

The following operations require that you specify the path to the virtual machine configuration file. Choose one of the following formats:

Datastore prefix style: [ds_name] <relative_path>

For example:

  '[myStorage1] testvms/VM1/VM1.vmx' (Linux) 
  "[myStorage1] testvms\VM1\VM1.vmx" (Windows)

UUID-based path: folder/subfolder/file

For example:

  '/vmfs/volumes/mystorage/testvms/VM1/VM1.vmx' (Linux) 
  "/vmfs/volumes/mystorage/testvms/VM1/VM1.vmx" (Windows)

SERVER OPERATIONS

-l: Lists all registered virtual machines.
-s register <config_file_path[<datacenter>] [<resource_pool>]: Registers a virtual machine.; If -H specifies a vCenter Server system, you must specify the datacenter and the resource pool to register the virtual machine in. The default datacenter is ha-datacenter and the default resource pool is Resources.; If -H specifies an ESX/ESXi system, you usually do not specify the resource pool and datacenter. However, if two virtual machines with the same name exist in two resource pools, you must specify the resource pool.
-s unregister: Unregisters a virtual machine.

VIRTUAL MACHINE OPERATIONS

<config_file_path> answer

Prompts the user to answer a question for a virtual machine waiting for user input.

connectdevice <config_file_path> <device_name>

Connects a virtual device to a virtual machine.

<config_file_path> createsnapshot <name> <description> quiesce 0|1 memory 0|1

Creates a snapshot of the specified virtual machine, providing a name and description for the snapshot.

If the <quiesce> flag is 1 and the virtual machine is powered on when the snapshot is taken, VMware Tools is used to quiesce the file system in the virtual machine. Quiescing a file system is a process of bringing the on-disk data of a physical or virtual computer into a state suitable for backups. This process might include such operations as flushing dirty buffers from the operating system's in-memory cache to disk, or other higher-level application-specific tasks.

If the <memory> flag is 1, a dump of the internal state of the virtual machine is included in the snapshot. Memory snapshots take longer to create.

<config_file_path> disconnectdevice

Disconnects the specified virtual device from the virtual machine.

<config_file_path> getconfigfile

Returns a string containing the name of the virtual machine configuration file. This command fails if the virtual machine is not connected.

<config_file_path> getguestinfo

Retrieves the value for a GuestInfo variable. The variable contains the attributes of the guest operating system of a virtual machine. For example, you can run the following command to retrieve the IP address of a virtual machine: vmware-cmd <config_file-path> getguestinfo ip You usually use this command when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.

<config_file_path> getproductinfo

Returns information about the product, where <prodinfo> is product, platform, build, majorversion (product major version number), or minorversion (product minor version number). If product is specified, the return value is one of the following:

  esx -- VMware ESX
  embeddedESX -- VMware ESXi
  unknown (unknown product type)

If platform is specified, the return value is one of the following:

  win32-x86 -- x86-based Windows system
  linux-x86 -- x86-based Linux system
  vmnix-x86 -- x86 ESX/ESXi microkernel

<config_file_path> getstate

Retrieves the execution state of a virtual machine. The state can be on, off, suspended, or unknown.

<config_file_path> gettoolslastactive

Returns an integer indicating how much time has passed, in seconds, since the last heartbeat was detected from the VMware Tools service. This value is initialized to zero when the virtual machine powers on. It stays at zero until the first heartbeat is detected. After the first heartbeat, the value is always greater than zero until the virtual machine is power cycled again. The command can return one of the following:

0 -- VMware Tools are not installed or not running.
1 -- Guest operating system is responding normally.
5 -- Intermittent heartbeat. There might be a problem with the guest operating system.
100 -- No heartbeat. Guest operating system might have stopped responding

<config_file_path> getuptime

Returns the uptime (in seconds) of the guest operating system on the virtual machine.
<config_file_path> hassnapshot: Returns 1 if the virtual machine already has a snapshot. Returns 0 otherwise.
<config_file_path> removesnapshots: Removes all snapshots belonging to the virtual machine. If no snapshot exists, does nothing.
<config_file_path> reset [soft|hard]: Shuts down, and then reboots a virtual machine. The powerop_mode can be hard or soft. Default is soft.
<config_file_path> revertsnapshot: Reverts the virtual machine to the current snapshot. If no snapshot exists, does nothing and leaves the virtual machine state unchanged.
<config_file_path> setguestinfo<variable> <value>: Writes a GuestInfo variable into memory. This is an advanced command. You usually use this command when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.
<config_file_path> start: Powers on a previously powered-off virtual machine or resumes a suspended virtual machine.
<config_file_path> stop: Shuts down and powers off a virtual machine. The powerop_mode can be hard or soft. Default is soft.
<config_file_path> suspend [soft|hard]: Suspends a virtual machine. The default powerop_mode is soft.

EXAMPLES

The following examples assume you are specifying connection options, either explicitly or, for example, by specifying the server, user name, and password. Run vmware-cmd --help for a list of common options including connection options.

SERVER OPERATIONS

List all the registered virtual machines:

 vmware-cmd <connection_options> -l

 vmware-cmd <connection_options>
    -s register /vmfs/volumes/storage1/MyVM/MyVM.vmx

Unregister a virtual machine:

 vmware-cmd <connection_options>
    -s unregister /vmfs/volumes/storage1/MyVM/MyVM.vmx

VIRTUAL MACHINE OPERATIONS

Get the execution state of a virtual machine:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getstate

Power on a virtual machine with 'soft' power mode (requires VMware Tools):

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx start soft

Power on a virtual machine with 'hard' power mode:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx start hard

Set a guest info variable for a virtual machine:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx setguestinfo VarABC 102

Retrieve the value for a guest info variable for a virtual machine:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getguestinfo VarABC

Get the platform information:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getproductinfo platform

Get the build information:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getproductinfo build

Connect a virtual CD/DVD drive to a virtual machine:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx connectdevice "CD/DVD Drive 2"

Disconnect a virtual CD/DVD drive from a virtual machine:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx disconnectdevice "CD/DVD Drive 2"

Retrieve the path to the configuration file for a virtual machine:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getconfigfile

Retrieve the uptime of a virtual machine's guest OS:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getuptime

Answer a question for a virtual machine requesting input:

 vmware-cmd <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx answer

Retrieve the VMware tools status:

 vmware-cmd -U <connection_options>
    /vmfs/volumes/storage1/MyVM/MyVM.vmx gettoolslastactive

DATACENTER OPERATIONS

You can perform any of the datacenter operations on a vCenter Server system by specifying the vCenterServer system using the -H option and the ESX/ESXi host using the --vihost | -h option. To register a virtual machine on a vCenter Server system, you have to specify the datacenter and resource pool name. For example:

 vmware-cmd -U <myuser> -P <mypassword> -H VCServerABC --vihost ESXHost
    -s register /vmfs/volumes/storage1/MyVM/MyVM.vmx DatacenterA PoolC

Get the execution state of a virtual machine.

 vmware-cmd -U <myuser> -P <mypassword> -H VCServerABC -h ESXHost
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getstate

Get the product information.

 vmware-cmd -U <myuser> -P <mypassword> -H VCServerABC --vihost ESXHost
    /vmfs/volumes/storage1/MyVM/MyVM.vmx getproductinfo product

Determine if the virtual machine has snapshot.

 vmware-cmd -U <myuser> -P <mypassword> -H VCServerABC -h ESXHost
    /vmfs/volumes/storage1/MyVM/MyVM.vmx hassnapshot

Create a snapshot.

 vmware-cmd -U <myuser> -P <mypassword> -H VCServerABC -h ESXHost
    /vmfs/volumes/storage1/MyVM/MyVM.vmx createsnapshot  <name> <description>
       <quiesce> <memory>

Revert the virtual machine to the last snapshot.

 vmware-cmd -U <myuser> -P <mypassword> -H VCServerABC -h ESXHost
    /vmfs/volumes/storage1/MyVM/MyVM.vmx revertsnapshot

Remove all the snapshots of virtual machine

 vmware-cmd -U <myuser> -P <mypassword> -H VCServerABC -h ESXHost
    /vmfs/volumes/storage1/MyVM/MyVM.vmx removesnapshots

Thanks to Vmware Documentation

vicfg-advcfg Command

NAME

vicfg-advcfg - query and modify advanced VMkernel options. Use when instructed by Technical Support.

vicfg-advcfg - enable and disable CIM providers.

SYNOPSIS

 vicfg-advcfg <connection_options>
   [--default <value> |
    --get <path> |
    --get-kernel <boot_parameter> |
    --quiet |
    --help |
    --set <value> <option> |
    --set 0|1 UserVars.CIMEnabled |
    --set 0|1 UserVars.CIMOEMProvidersEnabled |
    --set 0|1 UserVars.CIMCustomProvidersEnabled |
    --set-kernel <value> <boot_parameter> |
    --set-message <message> |
    --vihost <esx_target>]

DESCRIPTION

The vicfg-advcfg command offers a number of low-level advanced options.

Most options are not intended for customer use. You might use this command when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.

You can use the vicfg-advcfg -s option to enable and disable CIM providers.

OPTIONS

connection_options: Specifies the target server and authentication information if required. Run vicfg-advcfg --help for a list of all connection options.
--default | -d <option>: Sets the value of a specific configuration item to the default value defined by the VMkernel. Use this option when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.
--get | -g <config_option>: Gets the value of a configuration option based on its path, and print the value to stdout. Use this option when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.
--get-kernel | -j <boot_param>: Gets the value of a VMkernel boot parameter. Use this option when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.
--help: Prints a help message for each command-specific and each connection option. Calling the script with no arguments or with --help has the same effect.
--quiet | -q: No output to stdout while executing the command.
--set | -s <value> <option>: Sets the value of a configuration option based on its path. Use this option when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.
--set | -s 0|1 UserVars.CIMEnabled: Enables or disables all CIM providers.
--set | -s 0|1 UserVars.CIMOEMProvidersEnabled: Enables or disables OEM CIM providers.
--set | -s 0|1 UserVars.CIMCustomProvidersEnabled: Enables or disables IHV CIM providers.
--set-kernel | -k <value> <boot_param>: Sets the value of a VMkernel boot parameter. Use this option when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.
--set-message | -m <message>: Sets DCUI welcome message (valid for vSphere 4.0 and later). Use this option when VMware Technical Support or a VMware Knowledge Base article instruct you to do so.
--list | -l: Lists all VMkernel advanced config options.
--vihost | -h <esx_target<gt: When you execute a vSphere CLI with the --server option pointing to a vCenter Server System, you can use --vihost to specify the ESX/ESXi host to run the command against.

EXAMPLES

The following examples assume you are specifying connection options. Run vicfg-advcfg --help for a list of common options including connection options.

Set the value of a specific configuration item given its identifying path and the value to set:

 vicfg-advcfg <conn_options> -s 1 VMkernel.Boot.xapicForce

Get the value of a specific configuration item given its identifying path, and print the value to stdout:

 vicfg-advcfg <conn_options> -g VMkernel.Boot.xapicForce

Set the value of a specific configuration item to the default value defined by the VMkernel:

 vicfg-advcfg <conn_options> -d Irq.RoutingPolicy

Retrieve a VMkernel option:

 vicfg-advcfg <conn_options> --get-kernel assumeCommonBusClock

Set a VMkernel option:

 vicfg-advcfg <conn_options> --set-kernel 1 assumeCommonBusClock

Set a DCUI welcome message

 vicfg-advcfg <conn_options> --set-message "Welcome message"

Enable all CIM providers:

 vicfg-advcfg.pl <conn_options> -s 1 UserVars.CIMEnabled

Enable OEM CIM providers:

 vicfg-advcfg.pl <conn_options> -s 1 UserVars.CIMOEMProvidersEnabled

Disable IHV CIM providers:

 vicfg-advcfg.pl <conn_options> -s 0 UserVars.CIMCustomProvidersEnabled

Thanks to Vmware Documentation

vicfg-authconfig Command

NAME

vicfg-authconfig - manage Active Directory authentication schemes.

SYNOPSIS

        vicfg-authconfig 
           <conn_options>
          [--adpassword |
           --adusername |
           --authscheme |
           --currentdomain |
           --force |
           --getremoteauthstore |
           --help |
           --leavecurrentdomain |
           --listauthstores 
           --vihost]

DESCRIPTION

List information about Active Directory domains for a host, join an Active Directory domain, or leave the current domain.

OPTIONS

--adpassword | -w <password>: Password with which to log into the domain controller. Use this option with the --joindomain option. If you do not specify an AD password at the command line, the system prompts you.
--adusername | -U <name>: User name with which to log in to the domain controller. Use this option with the --joindomain option. If you do not specify an AD user at the command line, the system prompts you.
--authscheme | -t AD: The authentication scheme to be configured. Currently the only supported argument is AD.
conn_options: Specifies the target server and authentication information if required. Run vicfg-authconfig --help for a list of all connection options.
--currentdomain | -c: Displays the currently joined domain. Use this option in conjunction with the --authscheme option. This option takes no arguments.
--force | -f: Use this option with the --leavecurrentdomain option to delete any AD user permissions on entities. If you run vicfig-authcfg --leavecurrentdomain, AD user permissions are present, and you do not use --force, the operation fails.
--getremoteauthstore | -a: Prints the active authentication mechanisms. This option takes no arguments.
--help: Prints a help message for each command-specific and each connection option. Calling the command with no arguments or with --help has the same effect.
--joindomain | -j <domain_FQDN>: Joins the specified Active Directory domain. Use this option with the --authscheme option. This option takes in the FQDN of the directory server as the argument.
--leavecurrentdomain | -L: Leaves the currently joined domain. Use this option with the --authscheme option. If AD user permissions on entities exist, the operation fails unless you specify--force. This option takes no arguments.
--listauthstores | -l: Prints the supported authentication mechanisms. This option takes no arguments.
--vihost | -h <esx_host>: When you execute a vSphere CLI with the --server option pointing to a vCenter Server system, use --vihost to specify the ESX/ESXi host to run the command against.

EXAMPLES

The following examples assume you are specifying connection options, either explicitly or, for example, by specifying the server, user name, and password. Run vicfg-authconfig --help for a list of common options including connection options.

List the supported authentication schemes:

 vicfg-authconfig <conn_options> --listauthstores

Get the currently set authentication schemes:

 vicfg-authconfig <conn_options> --getremoteauthstore

Join the specified AD Domain:

 vicfg-authconfig <conn_options> <ad_conn_options> --authscheme AD --joindomain <domain_FQDN>

Leave the current AD Domain:

 vicfg-authconfig <conn_options> --authscheme AD --leavecurrentdomain [--force]

Display the current AD Domain:

 vicfg-authconfig <conn_options> --authscheme AD --currentdomain

Thanks to Vmware Documentation

vifs command (ESXi)

NAME

vifs - perform file system operations on remote hosts

SYNOPSIS

 vifs [<connection_options>]
   [--copy <source> <target> |
    --dir <remote_dir> |
    --help |
    --force |
    --get <remote_path> <local_path> |
    --listdc |
    --listds [--dc <datacenter>] |
    --mkdir <remote_dir> |
    --move <source> <target> |
    --put <local_path> <remote_path> |
    --rm <remote_path> |
    --rmdir <remote_dir> ]

DESCRIPTION

The vifs command performs common operations such as copy, remove, get, and put on files and directories. The command is supported against ESX/ESXi hosts but not against vCenter Server systems.

Note: While there are some similarities between vifs and DOS or Unix file system management utilities, there are also many differences. For example, vifs does not support wildcard characters or current directories and, as a result, relative path names. Use vifs only as documented.

OPTIONS

connection_options: Specifies the target server and authentication information if required. Run vifs --help for a list of all connection options
--copy | -c <source> <target>: Copies a file in a datastore to another location in a datastore. The <source> must be a remote source path, the <target> a remote target path or directory. Use the--force option to replace existing destination files.
--dir | -D <remote_dir>: Lists the contents of a datastore or host directory.
--help: Prints a help message for each command-specific and each connection option. Calling the command with no arguments or with --help has the same effect.
--force | -f: Overwrites the destination file. Use with --copy and --move.
--get | -g <remote_path> <local_path>: Downloads a file from the ESX/ESXi host to the machine on which you run the vCLI commands. This operation uses HTTP GET.
--listdc | -c: Lists the datacenter paths available on an ESX/ESXi system.
--listds | -S: Lists the datastore names on the ESX/ESXi system. When multiple datacenters are available, you can use the --dc|-Z <datacenter> argument to specify the name of the datacenter from which you want to list the datastore.
--mkdir | -M <remote_dir>: Creates a directory in a datastore. This operation fails if the parent directory of remote_dir does not exist.
--move | -m <source> <target>: Moves a file in a datastore to another location in a datastore. The <source> must be a remote source path, the <target> a remote target path or directory. The --force option replaces existing destination files.
--put | -p <local_path> <remote_path>: Uploads a file from the machine on which you run the vCLI commands to the ESX/ESXi host. This operation uses HTTP PUT. This command can replace existing host files but cannot create new files.
--rm | -r <remote_path>: Deletes a file or a directory.
--rmdir | -r <remote_dir>: Deletes a datastore directory. This operation fails if the directory is not empty.

EXAMPLES

The following examples assume you are specifying connection options, either explicitly or, for example, by specifying the server, user name, and password. Run vifs --help for a list of common options including connection options.

Copy a file to another location:

 vifs <connection_options> -c "[StorageName] VM/VM.vmx" "[StorageName] VM_backup/VM.vmx"

List all the datastores:

 vifs <connection_options> -S

List all the directories:

 vifs --server <connection_options> -D "[StorageName] vm"

Upload a file to the remote datastore:

 vifs <connection_options> -p "tmp/backup/VM.pl"
    "[StorageName] VM/VM.txt" -Z "ha-datacenter"

Delete a file:

 vifs <connection_options> -r "[StorageName] VM/VM.txt" -Z "ha-datacenter"

 vifs <connection_options> -rmdir "[StorageName] VM/VM.txt" -Z "ha-datacenter"

List the paths to all datacenters available in the server:

 vifs <connection_options> -C

Download a file on the host to a local path:

 vifs <connection_options> -g  "[StorageName] VM/VM.txt" 
    -Z "ha-datacenter" "tmp/backup/VM.txt"

Move a file to another location:

 vifs <connection_options> -m  "[StorageName] VM/VM.vmx"  
    "[StorageName] vm/vm_backup.vmx" -Z "ha-datacenter"

Remove an existing directory:

 vifs <connection_options> -R "[StorageName] VM/VM" -Z "ha-datacenter"

 vifs <connection_options> --rm "[StorageName] VM/VM" -Z "ha-datacenter"

Thanks to Vmware Documentation

Saturday, 1 February 2014

Using ESXi Shell in ESXi 5.0 and 5.1 (2004746)

Purpose

This article provides guidance on the recommended use of ESXi Shell for VMware ESXi 5.0 and 5.1.

Resolution

Enabling ESXi Shell access using the vSphere Client

Use the vSphere Client to enable local and remote access to the ESXi Shell:

Log into a vCenter Server system using the vSphere Client.
Select the host in the inventory panel.
Click the Configuration tab and click Security Profile.
In the Services section, click Properties.
Select ESXi Shell from this list:

ESXi Shell SSH Direct Console UI
Click Options and select Start and stop manually.

Note: When you select Start and stop manually, the service does not start when you reboot the host. If you want the service to start when you reboot the host, select Start and stop with host.
Click Start to enable the service.
Click OK.

Enabling ESXi Shell access using the Direct Console User Interface

Use the direct console user interface to enable the ESXi Shell:

From the Direct Console User Interface, press F2 to access the System Customization menu.
Select Troubleshooting Options and press Enter.
From the Troubleshooting Mode Options menu, select Enable ESXi Shell.

Enable ESXi Shell Enable SSH
Press Enter to enable the service.

Configuring the timeout for the ESXi Shell

By default, the timeout setting for the ESXi Shell is 0 (disabled). The timeout setting is the number of minutes that can elapse before you must log in after the ESXi Shell is enabled. After the timeout period, if you have not logged in, the shell is disabled.

Note: If you are logged in when the timeout period elapses, your session persists. However, the ESXi Shell is disabled and it prevents other users from logging in.

To set the ESXi Shell timeout from the Direct Console User Interface:
1. From the Direct Console User Interface, press F2 to access the System Customization menu.
2. Click Troubleshooting Mode Options.
3. Modify ESXi Shell and SSH timeouts and press Enter.
4. Enter the timeout in minutes.
5. Press Enter.
6. Press Esc until you return to the main menu of the Direct Console User Interface.
To set the ESXi Shell timeout from vSphere Client:
1. Log into a vCenter Server system using the vSphere Client.
2. Select the host in the inventory panel and click Configuration tab.
3. Under Software, click Advanced Settings.
4. In the left panel, click UserVars.
5. In the UserVars.ESXiShellTimeOut field, enter the timeout setting.
6. Click OK.

Note: If ESXi Shell and SSH are enabled, the option to modify the timeout value is grayed out. To change the timeout value, ensure both ESXi Shell and SSH are disabled. This is by design and is intended to indicate when the timeout values would take effect.

Accessing the local ESXi Shell

If you have direct access to the host, press Alt+F1 to open the log in page on the machine's physical console.
Provide credentials when prompted.

Accessing the remote ESXi Shell

Open an SSH client.
Specify the IP address or domain name of the ESXi host.

Notes:
- Steps may vary depending on the SSH client you are using. For more information, consult the client documentation and support.
- By default, SSH works on TCP port 22.
Provide credentials when prompted.

Source:-

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2004746

vSphere 5.1 – Full Admin Support for Named User Accounts (Shared root access is no longer required.)

Nestled among the many new features and capabilities introduced with vSphere 5.1 are some nice security improvements to the ESXi Shell. One of the more notable improvements is the ability to assign full admin privileges to named user accounts. This means there is no longer a dependency on a shared “root” account when working from the ESXi Shell.

Versions of ESXi prior to 5.1 only allow for a single administrative account on the host, and this was of course the “root” user. While it is possible to create named user accounts and to use these accounts to logon to the ESXi Shell and perform many operations, these users are not granted full administrative rights on the host. As such these named users often need to “su” to root in order to perform privileged operations such as viewing logs, creating a log bundle for support, or running commands like esxtop or vmkfstools. This presents some challenges in terms of both security and auditing. Not only is there an inherent dependency on a shared root account, but key administrative actions performed on the host are logged as “root” making it difficult to audit individual user activity on the host.

With vSphere 5.1 there is no longer a dependency on a shared root account. ESXi 5.1 now allows assigning full administration rights to named users. With this, users can now logon to the ESXi shell using individual accounts without the need to “su” to root, and because there is no longer a dependency on a shared root account all actions performed on the host are logged under the named user rather than the shared “root” account. Thus helping to better secure the host while at the same time improve logging and auditing.

The ability to assign full admin rights to named users helps improve host security and allows you to limit access to the root account. A couple things to remember when it comes to creating named users on an ESXi host:

You cannot create local ESXi users from the Web Client. To create local users using the UI you need to use the vSphere client to connect directly to the ESXi host.
You can also use Host Profiles to create local users and assign privileges. This can be very beneficial if you have a lot of hosts and want to ensure a common set of local user accounts gets created on each.

As an alternative to creating local user accounts on each ESXi hosts I would encourage you to consider adding your hosts to Active Directory (AD) instead. This not only enables users to use their existing AD credentials to manage ESXi hosts, but it also simplifies the configuration by eliminating the need to create and maintain local user accounts on each host. I’ll be posting some more info on this so be sure to check back.

Source:-
http://blogs.vmware.com/vsphere/2012/09/vsphere-5-1-full-admin-support-for-named-user-accounts.html