VMware vSphere 5.0 User guide

vSphere Management Assistant Guide

vSphere 5.0

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000570-00

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2 VMware, Inc.

vSphere Management Assistant Guide

VMware, Inc. 3

Contents

AboutThisBook 5

1 IntroductiontovMA 7

vMACapabilities 7

vMAComponentOverview 8

vSphereAuthenticationMechanism 8

vMASamples 9

vMAUseCases 9

WritingorConvertingScripts 9

WritingorConvertingAgents 9

2 GettingStartedwithvMA 11

HardwareRequirements 12

SoftwareRequirements 12

RequiredAuthenticationInformation 12

DeployvMA 13

ConfigurevMAatFirstBoot 13

vMAConsoleandWebUI 14

ConfigurevMAforActiveDirectoryAuthentication 14

ConfigureUnattendedAuthenticationforActiveDirectoryTargets 15

TroubleshootingUnattendedAuthentication 16

Enablethevi‐userAccount 16

vMAUserAccountPrivileges 16

AddTargetServerstovMA 17

RunningvSphereCLIfortheTargets 19

Reconfigurea

TargetServer 19

RemoveTargetServersfromvMA 20

ModifyingScripts 20

ConfigurevMAtoUseaStaticIPAddress 21

ConfigureaStaticIPAddressfromtheConsole 21

ConfigureaStaticIPAddressfromtheWebUI 22

ConfigurevMAtoUseaDHCPServer 22

ConfigurevMAtoUseaDHCPServerfromtheConsole 22

ConfigurevMAtoUse

aDHCPServerfromtheWebUI 22

SettingtheTimeZone 22

SettingtheTimeZonefromtheConsole 23

SettingtheTimeZonefromtheWebUI 23

ShutDownvMA 23

DeletevMA 23

TroubleshootingvMA 24

UpdatevMA 24

ConfigureAutomaticvMAUpdates 25

3 vMAInterfaces 27

vMAInterfaceOverview 27

vifptargetCommandforvi‐fastpassInitialization 27

vSphere Management Assistant Guide

4 VMware, Inc.

vifpTargetManagementCommands 28

vifpaddserver 28

vifpremoveserver 29

vifprotatepassword 30

vifplistservers 31

vifpreconfigure 32

TargetManagementExampleSequence 32

UsingtheVmaTargetLibLibrary 33

VmaTargetLibReference 33

EnumeratingTargets 33

QueryingTargets 33

ProgrammaticLogin 34

ProgrammaticLogout 34

Index 35

VMware, Inc. 5

ThevSphereManagementAssistantGuideexplainshowtodeployandusevMAandincludesreference

informationforvMACLIsandlibraries.

Toviewthecurrentversionofthisbook,aswellasallVMwareAPIandSDKdocumentation,goto

http://www.vmware.com/support/pubs/sdk_pubs.html.

Revision History

Thisbook,thevSphereManagementAssistantGuide,isrevisedwitheachreleaseoftheproductorwhen

necessary.Arevisedversioncancontainminorormajorchanges.Table 1summarizesthesignificantchanges

ineachversionofthisbook.

Intended Audience

ThisbookisforadministratorsanddeveloperswithsomeexperiencesettingupaLinuxsystemandworking

inaLinuxenvironment.AdministratorscanusethevMAautomatedauthenticationfacilitiesandthesoftware

packagedwithvMAtointeractwithESXihostsandvCenterServersystems.Developerscancreateagentsthat

interactwith

ESXihostsandvCenterServersystems.

VMware Technical Publications Glossary

VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions

oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.

About This Book

NOTEThetopicsinwhichthisdocumentationusestheproductnameʺESXiʺareapplicabletoallsupported

releasesofESXandESXi.

Table 1. Revision History

Revision Description

20JAN2012 Chapter2,section“ConfigureUnattendedAuthenticationforActiveDirectoryTargets”isupdated.

24AUG2011 vMA5.0release.

13JUL2010 vMA4.1release

16NOV2009 Chapter1isenhancedtoprovide detailsaboutvMA’senhancedcapabilities,authenticationmechanisms

andthechangestothesamples.

Chapter2providesinformationaboutconfiguringvMAforActiveDirectory.Italsoexplainshow

to

reconfigureatargetserver.

Chapter3providesinformationaboutthenewvifptargetandvifp reconfigurecommands.Italso

describestheVmaTargetLiblibrary.

21MAY2009 vMA4.0documentation

27OCT2008 VIMA1.0documentation

vSphere Management Assistant Guide

6 VMware, Inc.

Document Feedback

VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Sendyourfeedbackto

[email protected].

Technical Support and Education Resources

Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversions

ofotherVMwarebooks,gotohttp://www.vmware.com/support/pubs.

Online and Telephone Support

Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and

Support Offerings

TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto

http://www.vmware.com/support/services.

VMware Professional Services

VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials

designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive

online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides

offeringsto helpyouassess,plan,

build,andmanageyourvirtualenvironment.Toaccessinformationabout

educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 7

ThevSphereManagementAssistant(vMA)isaSUSELinuxEnterpriseServer11‐basedvirtualmachinethat

includesprepackagedsoftwaresuchasthevSpherecommand‐lineinterface,andthevSphereSDKforPerl.

vMAallowsadministratorstorunscriptsoragentsthatinteractwithESXihostsandvCenterServersystems

withouthaving

toauthenticateeachtime.

Thechapterincludesthefollowingtopics:

 “vMACapabilities”onpage 7

 “vMAComponentOverview”onpage 8

 “vMAUseCases”onpage 9

TogetstartedwithvMArightaway,goto“GettingStartedwithvMA”onpage 11.

vMA Capabilities

vMAprovidesaflexibleandauthenticatedplatformforrunningscriptsandprograms.

 Asadministrator,youcanaddvCenterServersystemsandESXihostsastargetsandrunscriptsand

programsonthesetargets.Onceyouhaveauthenticatedwhileaddingatarget,youneednotloginagain

whilerunningavSphereCLIcommandoragentonanytarget.

 Asadeveloper,youcanusetheAPIsprovidedwiththeVmaTargetLiblibrarytoprogrammatically

connecttovMAtargetsbyusingPerlorJava.

 vMAenablesreuseofserviceconsolescriptsthatarecurrentlyusedforESXiadministration,though

minormodificationstothescriptsareusuallynecessary.

 vMAcomespreconfiguredwithtwouseraccounts,namely,vi‐adminandvi‐user.

 Asvi‐admin,youcanperformadministrativeoperationssuchasadditionandremovaloftargets.

You canalsorunvSphereCLIcommandsandagentswithadministrativeprivilegesonthe

added targets.

 Asvi‐user, youcanrunthevSphereCLIcommandsandagentswithread‐onlyprivilegesonthe

target.

 YoucanmakevMAjoinanActiveDirectorydomainandloginasanActiveDirectoryuser.Whenyourun

commandsfromsuchauseraccount,theappropriateprivilegesgiventotheuseronthevCenterServer

systemortheESXihostwouldbeapplicable.

 vMAcanrunagentcodethatmakeproprietaryhardwareorsoftwarecomponentscompatiblewith

VMwareESX.ThesecodecurrentlyrunintheserviceconsoleofexistingESXhosts.Youcanmodifymost

oftheseagentcodetoruninvMA,bycallingthevSphereAPI,ifnecessary.Developersmustmoveany



agentcodethatdirectlyinterfaceswithhardwareintoaprovider.

Introduction to vMA

vSphere Management Assistant Guide

8 VMware, Inc.

vMA Component Overview

WhenyouinstallvMA,youarelicensedtousethevirtualmachinethatincludesallvMAcomponents.

vMAincludesthefollowingcomponents.

 SUSELinuxEnterpriseServer11SP1–vMArunsSUSELinuxEnterpriseServeronthevirtualmachine.

YoucanmovefilesbetweentheESXihostandthevMAconsolebyusingthevifsvSphereCLIcommand.

 VMwareTools–Interfacetothehypervisor.

 vSphereCLI–CommandsformanagingvSpherefromthecommandline.SeethevSphereCommand‐Line

InterfaceInstallationandReferenceGuide.

 vSphereSDKforPerl–Client‐sidePerlframeworkthatprovidesascriptinginterfacetothevSphereAPI.

TheSDKincludesutilityapplicationsandsamplesformanycommontasks.

 JavaJREversion1.6–RuntimeengineforJava‐basedapplicationsbuiltwithvSphereWebServicesSDK.

 vi‐fastpass‐Authenticationcomponent.

vSphere Authentication Mechanism

vMA’sauthenticationinterfaceallowsusersandapplicationstoauthenticatewiththetargetserversusing

vi‐fastpassorActiveDirectory.Whileaddingaserverasatarget,theAdministratorcandetermineifthetarget

needstousevi‐fastpassorActiveDirectoryauthentication.Forvi‐fastpassauthentication,thecredentialsthat

auser

hasonthevCenterServersystemorESXihostarestoredinalocalcredentialstore.ForActiveDirectory

authentication,theuserisauthenticatedwithanActiveDirectoryserver.

WhenyouaddanESXihostasafastpasstargetserver,vi‐fastpasscreatestwouserswithobfuscated

passwordsonthetarget

serverandstoresthepasswordinformationonvMA:

 vi‐adminwithadministratorprivileges

 vi‐userwithread‐onlyprivileges

Thecreationofvi‐adminandvi‐userdoesnotapplyforActiveDirectoryauthenticationtargets.Whenyouadd

asystemasanActiveDirectorytarget,vMAdoesnotstoreanyinformationaboutthecredentials.Tousethe

ActiveDirectoryauthentication,theadministratormustconfigure

vMAforActiveDirectory.Formore

informationonhowtoconfigurevMAforActiveDirectory,see“ConfigurevMAforActiveDirectory

Authentication”onpage 14.

Afteraddingatargetserver,youmustinitializevi‐fastpasssothatyoudonothavetoauthenticateeachtime

yourunvSphereCLIcommands.Ifyou

runavSphereCLIcommandwithoutinitializingvi‐fastpass,youwill

beaskedforusernameandpassword.

Youcaninitializevi‐fastpassbyusingoneofthefollowingmethods:

 Runvifptarget.Formoreinformationaboutthisscript,see“vifptargetCommandforvi‐fastpass

Initialization”onpage 27.

 CalltheLoginmethodinaPerlorJavaprogram.Formoreinformationaboutthismethod,see

“VmaTargetLibReference”onpage 33.

Aftersettingupatargetusingthevifptargetcommand,youcanrunvSphereCLIcommandsorscriptsthat

usevSphereSDKforPerlwithoutprovidinganyauthenticationinformation.Torun

commandsagainstan

ESXihostthatismanagedbyavCenterServer ,youcanusethe--vihostoption.

EachtimeyoulogintovMA,youmustrunthevifptargetcommandortheLoginmethodonce.Thetarget

thatyouspecifyinthevifptargetcommandisthedefaulttarget.Targetservers

remaintargetsacross

reboots.Youcanoverrideitbyusingthe--serveroptionofthevSphereCLIcommandsasshowninthe

followingexample:

vifptarget -s esx1.foo.com

vicfg-nics -l #lists the nics on esx1.foo.com

vicfg-nics -l --server esx2.foo.com #lists the nics on esx2.foo.com

VMware, Inc. 9

Chapter 1 Introduction to vMA

vMA Samples

vMAsamplesillustratethevMACLIsandtheVmaTargetLiblibrary.ThesamplesareavailableinvMAat

/opt/vmware/vma/samples.

 bulkAddServers.pl–PerlsamplethataddsmultipletargetstovMA.

 mcli.pl–PerlsamplethatrunsavSphereCLIcommandonmultiplevMAtargetsspecifiedinafile

suppliedasanargument.Youmustrunvifptargetbeforerunningthisscript.

 listTargets.pl ‐PerlsamplethatretrievesinformationandversionofvMAtargetsusing

VmaTargetLib.

 listTargets.sh ‐JavasamplethatdemonstratesuseofVmaTargetLib.

vMA Use Cases

Thissectionlistsafewtypicalusecases.

Writing or Converting Scripts

YoucanrunexistingvSphereCLIorvSphereSDKforPerlscriptsfromvMA.Tosettargetserversandinitialize

vi‐fastpass,thescriptcanusetheVmaTarget.login() methodofVmaTargetLib.

Writing or Converting Agents

PartnersorcustomerscanusevMAtowriteorconvertagents.

 ApartnerorcustomerwritesanewagentinPerl.

WhenapartnerorcustomerwritesanewagentinPerl,thePerlscriptmustimporttheVmaTargetLib

PerlmoduleandallvSphereSDKforPerlmodules.InsteadofcallingthevSphereSDKforPerlsubroutine

Util::Connect(targetUrl, username, password),theagentcalls

VmaTargetLib::VmaTarget.login().

 ApartnerorcustomerrunsanagentwritteninPerlorJavaintheserviceconsoleandwantstoportthe

agenttovMA.

TheagentusescodesimilartothefollowingPerl‐likepseudocodetologintoESXihosts:

LoginToMyEsx() {

SessionManagerLocalTicket tkt = SessionManager.AcquireLocalTicket(userName);

UserSession us = sm.login(tkt.userName, tkt.passwordFilePath);

}

Thepartnerchangestheagenttousecodesimilartothefollowingpseudo‐codeinstead:

LoginToMyEsx(String myESXName) {

VmaTarget target = VmaTargetLib.query_target(myESXName);

UserSession us = target.login();

}

Thispseudo‐codeassumesonlyonevMAtarget.Formultipletargetservers,thecodecanspecifyany

targetserverorloopthroughalistoftargetservers.

 ApartnerorcustomerrunsanagentwritteninPerloutsidetheESXihostandportstheagenttovMA.

InsteadofcallingthevSphereSDKforPerlmethodUtil::Connect(),theagentcallsthevifplibrary

methodVmaTargetLib::VmaTarget.login().

vSphere Management Assistant Guide

10 VMware, Inc.

VMware, Inc. 11

YoushouldhavesomeexperiencesettingupaLinuxsystemandworkinginaLinuxenvironment.This

chapterexplainshowtodeployandconfigurevMA,howtoaddandremovetargetservers,andhowto

prepareandrunscripts.Thechapteralsoincludestroubleshootinginformation.

ReadChapter 1,“IntroductiontovMA,”on

page 7forbackgroundinformationonvMAfunctionalityand

availablevMAcomponents.

Thischapterincludesthefollowingtopics:

 “HardwareRequirements”onpage 12

 “SoftwareRequirements”onpage 12

 “RequiredAuthenticationInformation”onpage 12

 “DeployvMA”onpage 13

 “ConfigurevMAatFirstBoot”onpage 13

 “vMAConsoleandWebUI”onpage 14

 “ConfigurevMAforActiveDirectoryAuthentication”onpage 14

 “ConfigureUnattendedAuthenticationforActiveDirectoryTargets”onpage 15

 “Enablethevi‐userAccount”onpage 16

 “vMAUserAccountPrivileges”onpage 16

 “A d d TargetServerstovMA”onpage 17

 “RunningvSphereCLIfortheTargets”onpage 19

 “ReconfigureaTargetServer”onpage 19

 “RemoveTargetServersfromvMA”onpage 20

 “ModifyingScripts”onpage 20

 “ConfigurevMAtoUseaStaticIPAddress”onpage 21

 “ConfigurevMAtoUseaDHCPServer”onpage 22

 “SettingtheTimeZone”onpage 22

 “ShutDownvMA”onpage 23

 “DeletevMA”onpage 23

 “TroubleshootingvMA”onpage 24

Getting Started with vMA

IMPORTANTYoucannotupgradeapreviousversionofvMAtovMA5.0.YoumustinstallafreshvMA5.0

instance.

vSphere Management Assistant Guide

12 VMware, Inc.

 “UpdatevMA”onpage 24

 “ConfigureAutomaticvMAUpdates”onpage 25

Hardware Requirements

TosetupvMA,youmusthaveanESXihost.BecausevMArunsa64‐bitLinuxguestoperatingsystem,the

ESXihostonwhichitrunsmustsupport64‐bitvirtualmachines.

TheESXihostmusthaveoneofthefollowingCPUs:

 AMDOpteron,revEorlater

 IntelprocessorswithEM64TsupportwithVTenabled.

Opteron64‐bitprocessorsearlierthanrevE,andIntelprocessorsthathaveEM64Tsupportbutdonothave

VTsupportenabled,donotsupporta64‐bitguestoperatingsystem.Fordetailedhardwarerequirements,see

theHardwareCompatibilityListontheVMware

Website.

Bydefault,vMAusesonevirtualprocessor,andrequires3GBofstoragespaceforthevMAvirtualdisk.The

recommendedmemoryforvMAis600MB.

Software Requirements

YoucandeployvMAonthefollowingsystems:

 vSphere5.0

 vSphere4.1orlater

 vSphere4.0Update2orlater

 vCenterApplication5.0

YoucandeployvMAbyusingavSphereClientconnectedtoanESXihostorbyusingavSphereClient

connectedtovCenterServer5.0,vCenterServer4.1orlater,vCenterServer4.0Update2orlater,orvCenter

Application5.0.

YoucanusevMAtotargetESX/ESXi

3.5Update5,ESX/ESXi4.0Update2orlater,ESX/ESXi4.1orlater,ESXi

5.0,vCenterServer4.0Update2orlater,vCenterServer4.1orlater,andvCenterServer5.0systems.

Atruntime,thenumberoftargetsasinglevMAinstancecansupportdependsonhowitisused.

Required Authentication Information

BeforeyoubeginvMAconfiguration,obtainthefollowingusernameandpasswordinformation:

 vCenterServersystem–IfyouwanttouseavCenterServersystemasthetargetserver,youmustbeable

toconnecttothatsystem.

IfyouareusingavCenterServertarget,youdonotneedpasswordsfortheESXihoststhatthevCenter

Serversystemmanages,unlessyou

runcommandsthatdonotsupportvCenterServertargets.

 ESXihost–Youmusthavetherootpasswordortheusernameandpasswordforauserwith

administrativeprivilegesforeachESXihostyouaddasavMAtarget.Youdonotneedtheauthentication

informationwhenyouremoveatargethost.

 vMA–WhenyoufirstconfigurevMA,vMApromptsforapasswordforthevi‐adminuser.Specifya

passwordandrememberitforsubsequentlogins.Thevi‐adminuserhasrootprivilegesonvMA.

MPORTANTTherootuseraccountisdisabledonvMA.Torunprivilegedcommands,typesudo

<command>.Bydefault,onlyvi‐admincanruncommandsthatrequiresudo.

VMware, Inc. 13

Chapter 2 Getting Started with vMA

Deploy vMA

YoucandeployvMAbyusingafileorfromaURL.Ifyouwanttodeployfromafile,downloadandunzipthe

vMAZIPfilebeforeyoustartthedeploymentprocess.

To deploy vMA

1UseavSphereClienttoconnecttoasystemthatisrunningthesupportedversionofESXiorvCenter

Server.

2IfconnectedtoavCenterServersystem,selectthehosttowhichyouwanttodeployvMAintheinventory

pane.

3 SelectFile>DeployOVFTemplate.

TheDeployOVFTemplatewizardappears.

4 SelectDeployfromafileorURLifyouhavealreadydownloadedandunzippedthe

vMAvirtual

appliancepackage.

5ClickBrowse,selecttheOVF,andclickNext.

6ClickNextwhentheOVFtemplatedetailsaredisplayed.

7AcceptthelicenseagreementandclickNext.

8Specifyanameforthevirtualmachine.

Youcanalsoacceptthedefaultvirtualmachinename.

9 Selectaninventorylocationforthevirtual

machinewhenprompted.

IfyouareconnectedtoavCenterServersystem,youcanselectafolder.

10 IfconnectedtoavCenterServersystem,selecttheresourcepoolforthevirtualmachine.

Bydefault,thetop‐levelrootresourcepoolisselected.

11 Ifprompted,selectthedatastoretostorethevirtualmachineonandclickNext.

12 SelecttherequireddiskformatoptionandclickNext.

13 SelectthenetworkmappingandclickNext.

14 ReviewtheinformationandclickFinish.

ThewizarddeploysthevMAvirtualmachinetothehostthatyouselected.The deployprocesscantake

severalminutes.

NextyouconfigureyourvMAvirtualmachine.YouperformthistaskwhenyoulogintovMAthefirsttime.

Configure vMA at First Boot

WhenyoustartthevMAvirtualmachinethefirsttime,youcanconfigureit.

To configure vMA

1InthevSphereClient,right‐clickthevirtualmachine,andclickPowerOn.

2 SelecttheConsoletab.

3Answerthenetworkconfigurationprompts.

MPORTANTYoucannotupgradeanearlierversionofvMAtovMA5.0.YoumustinstallafreshvMA5.0

instance.

MPORTANTEnurethatvMAisconnectedtothemanagementnetworkonwhichthevCenterServer

systemandtheESXihoststhatareintendedvMAtargetsarelocated.

vSphere Management Assistant Guide

14 VMware, Inc.

4Whenprompted,specifyahostnameforvMA.

Thenamecancontain64alphanumericcharacters.YoucanchangethevMAhostnamelaterbymodifying

the/etc/HOSTNAME and/etc/hostsfiles,asyouwouldforaLinuxhost.YoucanalsousethevMA

consoletochangethehostname.

Fora

DHCPconfiguration,thehostnameisobtainedfromtheDNSserver.

5Whenprompted,specifyapasswordforthevi‐adminuser.

Ifpromptedforanoldpassword,pressEnterandcontinue.

ThenewpasswordmustconformtothevMApassword policy.Thepasswordmusthaveatleast:

 Eightcharacters

 Oneuppercasecharacter

 Onelowercasecharacter

 Onenumeralcharacter

 Onesymbolsuchas#,$

Youcanlaterchangethepasswordforthevi‐adminuserusingtheLinuxpasswdcommand.

Thisuserhasrootprivileges.

vMAisnowconfiguredandthevMAconsoleappears.TheconsoledisplaystheURLfromwhichyoucan

accesstheWebUI.

vMA Console and Web UI

vMAprovidestwointerfaces,theconsole,whichisacommand‐lineinterfaceandthebrowser‐basedWebUI.

Fromtheconsole,youcandothefollowingtasks:

 Loginasvi‐admin

 AddserverstovMA

 RuncommandsfromthevMAconsole

 Configurethenetworksettingsandproxyserversettings

 Configurethetimezonesettings.

ThewebUIenablesyoutodothefollowingtasks:

 Loginasvi‐admin

 Configurethenetworksettingsandproxyserversettings

 Configurethetimezonesettings.

 UpdatevMA

Configure vMA for Active Directory Authentication

ConfigurevMAforActiveDirectoryauthenticationsothatESXihostsandvCenterServersystemsaddedto

ActiveDirectorycanbeaddedtovMAwithouthavingtostorethepasswordsinvMA’scredentialstore.This

isamoresecurewayofaddingtargetstovMA.

EnsurethattheDNSserverconfiguredfor

vMAisthesameastheDNSserverofthedomain.Youcanchange

theDNSserverbyusingthevMAConsoleortheWebUI.

EnsurethatthedomainisaccessiblefromvMA.Also,ensurethatyoucanpingtheESXiandvCenterserver

systemsthatyouwanttoadd

tovMAandthatpingingresolvestheIPaddressto

<targetservername.domainname>,wheredomainnameisthedomaintowhichvMAistobeadded.

VMware, Inc. 15

Chapter 2 Getting Started with vMA

To add vMA to a domain

1FromthevMAconsole,runthefollowingcommand:

sudo domainjoin-cli join <domain-name> <domain-admin-user>

2Whenprompted,providetheActiveDirectoryadministratorʹspassword.

Onsuccessfulauthentication,thecommandaddsvMAasamemberofthedomain.Thecommandalso

addsentriesinthe/etc/hostsfilewithvmaHostname.domainname.

3RestartvMA.

Now,youcanaddanActiveDirectorytargettovMA.Forstepstodothis,see“A d d TargetServersto

vMA”onpage 17.

To check vMA's domain settings

FromthevMAconsole,runthefollowingcommand:

sudo domainjoin-cli query

ThecommanddisplaysthenameofthedomaintowhichvMAhasjoined.

To remove vMA from the domain

FromthevMAconsole,runthefollowingcommand:

sudo domainjoin-cli leave

ThevMAconsoledisplaysamessagestatingwhethervMAhaslefttheActiveDirectorydomain.

Configure Unattended Authentication for Active Directory Targets

Toconfigureunattendedauthentication(authenticationfromvi‐adminorrootcontext)toActiveDirectory

targets,youmustrenewtheKerberosticketsforthedomainuserusingwhichthetargetisadded.Unattended

authenticationissupportedforESXi4.1Update3andlater.YoumustensurethattheActiveDirectoryissetup



forunattendedlogin.

To configure unattended authentication for Active Directory targets

1OnanyWindowsServer2003computerthatispartofthedomaintowhichvMAisadded,downloadand

installtheKtpasstoolfromtheMicrosoftwebsite.

2Openthecommandpromptandrunthefollowingcommand:

ktpass /out foo.keytab /princ [email protected] /pass ca... /ptype KRB5_NT_PRINCIPAL

-mapuser <vma-dc>\<foo>

where,<vma‐dc>isthenameofthedomainandfooistheuserhavingpermissionsforthevCenter

administration.

Thiscommandcreatesafilecalledfoo.keytab.

3Movethefoo.keytabfileto/home/local/VMA-DC/foo.

YoucanuseWinSCPandloginasuservma-dc\footomovethefile.

4 (Optional)Makesurethat

theuservma‐dc\fooonvMAownsthefoo.keytabfilebyusingthefollowing

commands:

ls -l /home/local/VMA-DC/foo/foo.keytab

chown ‘vma-dc\foo’

/home/local/VMA-DC/foo/foo.keytab

5OnvMA,createascriptin/etc/cron.hourly/kticket-renewwiththefollowingcontents:

#!/bin/sh

su - vma-dc\\foo -c '/usr/bin/kinit -k -t /home/local/VMA-DC/foo/foo.keytab foo'

Thisscriptwillrenewtheticketfortheuserfooeveryhour.

Youcanalsoaddtheabovescripttoaservicein/etc/init.dtorefreshtheticketswhenvMAisbooted.

vSphere Management Assistant Guide

16 VMware, Inc.

Troubleshooting Unattended Authentication

IfyouarenotabletoauthenticatefromvMAorcannotaddvMAtothedomaincontroller,verifythefollowing

conditions:

 YourDNSserversetupinvMAresolvestheIPaddressorhostnameofthevCenterservertoafully

qualifieddomainname(FQDN)andthattheFQDNcontainsthedomainnametowhichvMAisadded.

 Thecommandvifp listserversshowsthenameofvCenterserverastheFQDNthatcontainsthe

domainnametowhichvMAisaddedasthesuffix.

 ThedateandtimesettingsonvMA,thedomaincontrollerandthevCenterserverarethesame.Verifythe

timezoneaswell.Thetimemayvarybyanhour,butalargetimeskewmightcauseauthentication

problems.

Enable the vi-user Account

Aspartofconfiguration,vMAcreatesavi‐useraccountwithnopassword.However,youcannotusethe

vi‐useraccountuntilyouhavespecifiedavi‐userpassword.

To enable the vi-user account

1LogintovMAasvi‐admin.

2RuntheLinuxpasswdcommandforvi‐userasfollows:

sudo passwd vi-user

IfthisisthefirsttimeyouusesudoonvMA,amessageaboutrootuserprivilegesappears,andyouare

promptedforthevi‐adminpassword.

3Specifythevi‐adminpassword.

4Whenprompted,typeandconfirmthepasswordforvi‐user.

Afterthevi‐useraccountisenabledonvMA,

ithasnormalprivilegesonvMAbutisnotinthesudoerslist.

WhenyouaddESXitargetservers,vMAcreatestwousersoneachtarget:

 vi‐adminhasadministrativeprivilegesonthetargetsystem.

 vi‐userhasread‐onlyprivilegesonthetargetsystem.vMAcreatesvi‐useroneachtargetthatyouadd,

evenifvi‐userisnotcurrentlyenabledonvMA.

WhenauserisloggedintovMAasvi‐user,vMAusesthataccountontargetESXihosts,andthe

usercanrun

onlycommandsontargetESXihoststhatdonotrequireadministrativeprivileges.

vMA User Account Privileges

Table 2‐1liststheprivilegesthatthedifferentuseraccountshaveforvCLIusageagainstdifferenttargets.

MPORTANTThevi‐useraccounthaslimitedprivilegesonthetargetESXihostsandcannotrunany

commandsthatrequiresudoexecution.Youcannotusevi‐usertoruncommandsforActiveDirectorytargets

(ESXiorvCenterServer).ToruncommandsfortheActiveDirectorytargets,usethevi-adminuseror

login

asanActiveDirectoryusertovMA.

Table 2-1. Account Privileges for vCLI Usage

Target

Authentication

Policy vi-admin vi-user domain user

ESXifpauthYYN

ESXi adauth Y N Y

vCenterServer fpauth Y N N

vCenterServer adauth Y N Y

VMware, Inc. 17

Chapter 2 Getting Started with vMA

Add Target Servers to vMA

AfteryouconfigurevMA,youcanaddtargetserversthatrunthesupportedvCenterServerorESXiversion.

ForvCenterServerandESXisystemtargets,youmusthavethenameandpasswordofauserwhocanconnect

tothatsystem.

See“vifpaddserver”onpage 28forthecompletesyntax.

To add a vCenter Server system as a vMA target for Active Directory Authentication

1LogintovMAasvi‐admin.

2AddaserverasavMAtargetbyrunningthe followingcommand:

vifp addserver vc1.mycomp.com --authpolicy adauth --username ADDOMAIN\\user1

Here,--authpolicy adauthindicatesthatthetargetneedstousetheActiveDirectoryauthentication.

Ifyourunthiscommandwithoutthe--usernameoption,vMApromptsforthenameoftheuserthatcan

connecttothevCenterServersystem.Youcanspecifythisusernameasshowninthefollowingexample:

Enter username for machinename.example.com: ADDOMAIN\user1

If--authpolicyisnotspecifiedinthecommand,thenfpauthistakenasthedefaultauthentication

policy.

3Verifythatthetargetserverhasbeenadded.

Thedisplayshowsalltargetserversandtheauthenticationpolicyusedforeachtarget.

vifp listservers --long

server1.mycomp.com ESX adauth

server2.mycomp.com ESX fpauth

server3.mycomp.com ESXi adauth

vc1.mycomp.com vCenter adauth

4Setthetargetasthedefaultforthecurrentsession:

vifptarget --set | -s <server>

5VerifythatyoucanrunavSphereCLIcommandwithoutauthenticationbyrunningacommandonone

oftheESXihosts,forexample:

esxcli --server <VC_server> --vihost <esx_host> network nic list

Thecommandrunswithoutpromptingforauthenticationinformation.

To add a vCenter Server system as a vMA target for fastpass Authentication

1LogintovMAasvi‐admin.

2AddaserverasavMAtargetbyrunningthe followingcommand:

vifp addserver vc2.mycomp.com --authpolicy fpauth

Here,--authpolicy fpauthindicatesthatthetargetneedstousethefastpassauthentication.

3Specifytheusernamewhenprompted:

Enter username for machinename.example.com: MYDOMAIN\user1

4Specifythepasswordforthatuserwhenprompted.

[email protected]'s password: <not echoed to screen>

5Reviewandacceptthesecurityriskinformation.

MPORTANTIfthenameofatargetserverchanges,youmustremovethetargetserverbyusingvifp

removeserverwiththeoldname,thenaddtheserverusingvifp addserverwiththenewname.

vSphere Management Assistant Guide

18 VMware, Inc.

6Verifythatthetargetserverhasbeenadded.

Thedisplayshowsalltargetserversandtheauthenticationpolicyusedforeachtarget.

vifp listservers --long

server1.mycomp.com ESX adauth

server2.mycomp.com ESX fpauth

server3.mycomp.com ESXi adauth

vc1.mycomp.com vCenter adauth

vc2.mycomp.com vCenter fpauth

7Setthetargetasthedefaultforthecurrentsession.

vifptarget --set | -s <server>

8VerifythatyoucanrunavSphereCLIcommandwithoutauthenticationbyrunningacommandonone

oftheESXihosts,forexample:

esxcli --server <VC_server> --vihost <esx_host> network nic list

Thecommandrunswithoutpromptingforauthenticationinformation.

To add an ESXi host as a vMA target

1LogintovMAasvi‐admin.

2RunaddservertoaddaserverasavMAtarget.

vifp addserver <servername>

Youarepromptedforthetargetserver’srootuserpassword.

root@<servername>’s password:

3SpecifytherootpasswordfortheESXihostthatyouwanttoadd.

vMAdoesnotretaintherootpassword.Instead,vMAaddsvi‐adminandvi‐usertotheESXihost,and

storestheobfuscatedpasswordsthatitgeneratesforthoseusersintheVMwarecredentialstore.

InavSphere

clientconnectedtothetargetserver,theRecentTaskspaneldisplaysinformationaboutthe

usersthatvMAadds.Thetargetserver’sUsersandGroupspaneldisplaystheusersifyouselectit.

4Verifythatthetargetserverhasbeenadded:

vifp listservers

5Setthetargetasthedefaultforthecurrentsession.

vifptarget --set | -s <server>

6VerifythatyoucanrunavSphereCLIcommandwithoutauthenticationbyrunningacommand,forexample:

esxcli network nic list

IMPORTANTIfthenameofatargetserverchanges,youmustremovethetargetserverbyusingvifp

removeserverwiththeoldname,thenaddtheserverusingvifp addserverwiththenewname.

CAUTIONRemoveusersaddedbyvMAfromthetargetserveronlyifyoudeletedthevMAvirtual

machinebutdidnotremovethetargetservers.

IMPORTANTIfthenameofatargetserverchanges,youmustremovethetargetserverusingvifp

removeserverwiththeoldname,thenaddtheserverusingvifp addserverwiththenewname.

VMware, Inc. 19

Chapter 2 Getting Started with vMA

Running vSphere CLI for the Targets

Ifyouhaveaddedmultipletargetservers,bydefault,vMAexecutescommandsonthefirstserverthatyou

added.Youshouldspecifytheserverexplicitlywhenrunningcommands.

To run vSphere CLI for the targets

1AddserversasvMAtargets.

vifp addserver <server1>

vifp addserver <server2>

2Verifythatthetargetserverhasbeenadded:

vifp listservers

3Runvifptarget.

vifptarget -s <server2>

Thecommandinitializesthespecifiedtargetserver.Now,thisserverwillbetakenasthedefaulttargetfor

thevSphereCLIorvSphereSDKforPerlscripts.

4RunvSphereCLIorvSphereSDKforPerlscripts,byspecifyingthetargetserver.Forexample:

esxcli --server server2 network nic list

Reconfigure a Target Server

Youcanreconfigureatargetserverifyouwanttoperformanyofthefollowingtasks:

 ChangetheauthenticationmodeofavMAtargetfromvi‐fastpasstoActive Directoryorviceversa.

 ChangetheconfigureduserfortheActiveDirectorytarget.

 Recoverusersforthevi‐fastpasstarget.AuserneedstoberecoveredifthecredentialstoreonvMAis

corruptedor ifthecredentialsofuserscorrespondingtovMAusersaremodifiedandnotreflectedinvMA.

To change the authentication policy

1LogintovMAasvi‐admin.

2Runreconfigure

vifp reconfigure <servername> --authpolicy <authpolicy>

3Whenprompted,provideyourcredentials.

 IfyoureconfigureanActiveDirectorytargettovi‐fastpassauthentication,thenspecifytheroot

passwordforESXitargetsandtherootusernameandpasswordforvCentertargets.

 Ifyoureconfigureavi‐fastpasstargettoActiveDirectoryauthentication,thenspecifytheroot

usernameforthetarget.

To change the configured user or to recover users

1LogintovMAasvi‐admin.

2Runreconfigure.

vifp reconfigure <servername>

3Whenprompted,provideyourcredentials.

 IfyoureconfigureanActiveDirectorytarget,specifyausernameforthetarget.

 Ifyoureconfigureavi‐fastpasstarget,specifytherootpasswordoftheESXitarget,andthepassword

forusernameusedtoaddthevCenterServertarget.

vSphere Management Assistant Guide

20 VMware, Inc.

Example 2-1. Adding and Reconfiguring a Target

vi-admin@example-dhcp:~> vifp addserver 90.100.110.120

Enter username for 90.100.110.120: administrator

[email protected]'s password:

This will store username and password in credential store which is a security risk. Do you want

to continue?(yes/no): yes

vi-admin@example-dhcp:~> vifp reconfigure 90.100.110.120

[email protected]'s password:

vi-admin@example-dhcp:~>

Remove Target Servers from vMA

BeforeyoudeleteavMAvirtualmachine,removealltargetserversfromvMA.Ifyoudonotremovetarget

ESXihosts,thevi‐adminandvi‐userusersremainonthetargetservers.

To remove a vCenter Server system from vMA

1LogintovMAasvi‐admin.

2ToremoveatargetvCenterServersystemfromvMA,runthe

followingcommand:

vifp removeserver <servername>

ThevCenterServersystemisnolongeravMAtarget.

To remove an ESXi host from vMA

1LogintovMAasvi‐admin.

2ToremoveanESXihostthatisavMAtarget,runthefollowingcommand:

vifp removeserver <host>

TheRecentTaskspanelofthetargetserverdisplaysinformationaboutthevi‐adminandvi‐userusersthat

arebeingremoved.TheUsersandGroupspanelofthetargetservernolongerdisplaystheusers.

Modifying Scripts

YoucanmodifyserviceconsolescriptstorunfromvMA.

 Linuxcommands–ScriptsrunninginvMAcannotuseLinuxcommandsinthewaythattheydoonthe

ESXserviceconsolebecausetheLinuxcommandsarerunningonvMAandnotontheESXhost.

 AccesstoESXifiles–IfyouneedaccesstofoldersorfilesonanESXihost,youcanmakethathostatarget

serverandusethevifsvSphereCLIcommandtoview,retrieve,ormodifyfoldersandfiles.

 Referencestolocalhost–Scriptscannotrefertolocalhost.

 Ifvi‐fastpassisinitialized,allcommandsthatdonotspecify--serverapplytothedefaulttarget.

 Ifvi‐fastpassisinitialized,allcommandsthatspecifyhostnameorIPofthetargetapplyto thetarget

specified.

 Programmaticconnection–InPerlscriptsorJavaprograms,youcancallVmaTarget.login() method

of VmaTargetLibandspecifythehosttoconnectto.Thedirectory/opt/vmware/vma/samplescontains

examplesinPerlandJava.vMAhandlesauthenticationiftheserverhasbeenestablishedasatarget

server.ProgramscanuseVmaTargetLiblibrarycommands.See

“UsingtheVmaTargetLibLibrary”on

page 33.

 Noprocnodes–SomeserviceconsolescriptsstilluseVMwareprocnodes,whichwereofficiallymade

obsoletewithESXServer3.0andarenotavailableinESX/ESXi4.0andlater.Youcanextractinformation

thatwasavailableinVMwareprocnodesusingthevSphereCLIcommandsavailableonvMA.

 Targetspecification–Youmustspecifythetargetserverwhenyouruncommandsorscripts.

Page is loading ...

VMware vSphere 5.0 User guide

Related papers

Other documents