VMware vSphere vSphere 5.0 User guide

Brand: VMware vSphere

Model: vSphere 5.0

Category: Software manuals

Type: User guide

vSphere Management Assistant Guide

vSphere 5.0

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000570-00

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2 VMware, Inc.

vSphere Management Assistant Guide

VMware, Inc. 3

Contents

AboutThisBook 5

1 IntroductiontovMA 7

vMACapabilities 7

vMAComponentOverview 8

vSphereAuthenticationMechanism 8

vMASamples 9

vMAUseCases 9

WritingorConvertingScripts 9

WritingorConvertingAgents 9

2 GettingStartedwithvMA 11

HardwareRequirements 12

SoftwareRequirements 12

RequiredAuthenticationInformation 12

DeployvMA 13

ConfigurevMAatFirstBoot 13

vMAConsoleandWebUI 14

ConfigurevMAforActiveDirectoryAuthentication 14

ConfigureUnattendedAuthenticationforActiveDirectoryTargets 15

TroubleshootingUnattendedAuthentication 16

Enablethevi‐userAccount 16

vMAUserAccountPrivileges 16

AddTargetServerstovMA 17

RunningvSphereCLIfortheTargets 19

Reconfigurea

TargetServer 19

RemoveTargetServersfromvMA 20

ModifyingScripts 20

ConfigurevMAtoUseaStaticIPAddress 21

ConfigureaStaticIPAddressfromtheConsole 21

ConfigureaStaticIPAddressfromtheWebUI 22

ConfigurevMAtoUseaDHCPServer 22

ConfigurevMAtoUseaDHCPServerfromtheConsole 22

ConfigurevMAtoUse

aDHCPServerfromtheWebUI 22

SettingtheTimeZone 22

SettingtheTimeZonefromtheConsole 23

SettingtheTimeZonefromtheWebUI 23

ShutDownvMA 23

DeletevMA 23

TroubleshootingvMA 24

UpdatevMA 24

ConfigureAutomaticvMAUpdates 25

3 vMAInterfaces 27

vMAInterfaceOverview 27

vifptargetCommandforvi‐fastpassInitialization 27

vSphere Management Assistant Guide

4 VMware, Inc.

vifpTargetManagementCommands 28

vifpaddserver 28

vifpremoveserver 29

vifprotatepassword 30

vifplistservers 31

vifpreconfigure 32

TargetManagementExampleSequence 32

UsingtheVmaTargetLibLibrary 33

VmaTargetLibReference 33

EnumeratingTargets 33

QueryingTargets 33

ProgrammaticLogin 34

ProgrammaticLogout 34

Index 35

VMware, Inc. 5

ThevSphereManagementAssistantGuideexplainshowtodeployandusevMAandincludesreference

informationforvMACLIsandlibraries.

Toviewthecurrentversionofthisbook,aswellasallVMwareAPIandSDKdocumentation,goto

http://www.vmware.com/support/pubs/sdk_pubs.html.

Revision History

Thisbook,thevSphereManagementAssistantGuide,isrevisedwitheachreleaseoftheproductorwhen

necessary.Arevisedversioncancontainminorormajorchanges.Table 1summarizesthesignificantchanges

ineachversionofthisbook.

Intended Audience

ThisbookisforadministratorsanddeveloperswithsomeexperiencesettingupaLinuxsystemandworking

inaLinuxenvironment.AdministratorscanusethevMAautomatedauthenticationfacilitiesandthesoftware

packagedwithvMAtointeractwithESXihostsandvCenterServersystems.Developerscancreateagentsthat

interactwith

ESXihostsandvCenterServersystems.

VMware Technical Publications Glossary

VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions

oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.

About This Book

NOTEThetopicsinwhichthisdocumentationusestheproductnameʺESXiʺareapplicabletoallsupported

releasesofESXandESXi.

Table 1. Revision History

Revision Description

20JAN2012 Chapter2,section“ConfigureUnattendedAuthenticationforActiveDirectoryTargets”isupdated.

24AUG2011 vMA5.0release.

13JUL2010 vMA4.1release

16NOV2009 Chapter1isenhancedtoprovide detailsaboutvMA’senhancedcapabilities,authenticationmechanisms

andthechangestothesamples.

Chapter2providesinformationaboutconfiguringvMAforActiveDirectory.Italsoexplainshow

to

reconfigureatargetserver.

Chapter3providesinformationaboutthenewvifptargetandvifp reconfigurecommands.Italso

describestheVmaTargetLiblibrary.

21MAY2009 vMA4.0documentation

27OCT2008 VIMA1.0documentation

vSphere Management Assistant Guide

6 VMware, Inc.

Document Feedback

VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Sendyourfeedbackto

[email protected].

Technical Support and Education Resources

Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversions

ofotherVMwarebooks,gotohttp://www.vmware.com/support/pubs.

Online and Telephone Support

Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and

Support Offerings

TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto

http://www.vmware.com/support/services.

VMware Professional Services

VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials

designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive

online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides

offeringsto helpyouassess,plan,

build,andmanageyourvirtualenvironment.Toaccessinformationabout

educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 7

ThevSphereManagementAssistant(vMA)isaSUSELinuxEnterpriseServer11‐basedvirtualmachinethat

includesprepackagedsoftwaresuchasthevSpherecommand‐lineinterface,andthevSphereSDKforPerl.

vMAallowsadministratorstorunscriptsoragentsthatinteractwithESXihostsandvCenterServersystems

withouthaving

toauthenticateeachtime.

Thechapterincludesthefollowingtopics:

 “vMACapabilities”onpage 7

 “vMAComponentOverview”onpage 8

 “vMAUseCases”onpage 9

TogetstartedwithvMArightaway,goto“GettingStartedwithvMA”onpage 11.

vMA Capabilities

vMAprovidesaflexibleandauthenticatedplatformforrunningscriptsandprograms.

 Asadministrator,youcanaddvCenterServersystemsandESXihostsastargetsandrunscriptsand

programsonthesetargets.Onceyouhaveauthenticatedwhileaddingatarget,youneednotloginagain

whilerunningavSphereCLIcommandoragentonanytarget.

 Asadeveloper,youcanusetheAPIsprovidedwiththeVmaTargetLiblibrarytoprogrammatically

connecttovMAtargetsbyusingPerlorJava.

 vMAenablesreuseofserviceconsolescriptsthatarecurrentlyusedforESXiadministration,though

minormodificationstothescriptsareusuallynecessary.

 vMAcomespreconfiguredwithtwouseraccounts,namely,vi‐adminandvi‐user.

 Asvi‐admin,youcanperformadministrativeoperationssuchasadditionandremovaloftargets.

You canalsorunvSphereCLIcommandsandagentswithadministrativeprivilegesonthe

added targets.

 Asvi‐user, youcanrunthevSphereCLIcommandsandagentswithread‐onlyprivilegesonthe

target.

 YoucanmakevMAjoinanActiveDirectorydomainandloginasanActiveDirectoryuser.Whenyourun

commandsfromsuchauseraccount,theappropriateprivilegesgiventotheuseronthevCenterServer

systemortheESXihostwouldbeapplicable.

 vMAcanrunagentcodethatmakeproprietaryhardwareorsoftwarecomponentscompatiblewith

VMwareESX.ThesecodecurrentlyrunintheserviceconsoleofexistingESXhosts.Youcanmodifymost

oftheseagentcodetoruninvMA,bycallingthevSphereAPI,ifnecessary.Developersmustmoveany



agentcodethatdirectlyinterfaceswithhardwareintoaprovider.

Introduction to vMA

vSphere Management Assistant Guide

8 VMware, Inc.

vMA Component Overview

WhenyouinstallvMA,youarelicensedtousethevirtualmachinethatincludesallvMAcomponents.

vMAincludesthefollowingcomponents.

 SUSELinuxEnterpriseServer11SP1–vMArunsSUSELinuxEnterpriseServeronthevirtualmachine.

YoucanmovefilesbetweentheESXihostandthevMAconsolebyusingthevifsvSphereCLIcommand.

 VMwareTools–Interfacetothehypervisor.

 vSphereCLI–CommandsformanagingvSpherefromthecommandline.SeethevSphereCommand‐Line

InterfaceInstallationandReferenceGuide.

 vSphereSDKforPerl–Client‐sidePerlframeworkthatprovidesascriptinginterfacetothevSphereAPI.

TheSDKincludesutilityapplicationsandsamplesformanycommontasks.

 JavaJREversion1.6–RuntimeengineforJava‐basedapplicationsbuiltwithvSphereWebServicesSDK.

 vi‐fastpass‐Authenticationcomponent.

vSphere Authentication Mechanism

vMA’sauthenticationinterfaceallowsusersandapplicationstoauthenticatewiththetargetserversusing

vi‐fastpassorActiveDirectory.Whileaddingaserverasatarget,theAdministratorcandetermineifthetarget

needstousevi‐fastpassorActiveDirectoryauthentication.Forvi‐fastpassauthentication,thecredentialsthat

auser

hasonthevCenterServersystemorESXihostarestoredinalocalcredentialstore.ForActiveDirectory

authentication,theuserisauthenticatedwithanActiveDirectoryserver.

WhenyouaddanESXihostasafastpasstargetserver,vi‐fastpasscreatestwouserswithobfuscated

passwordsonthetarget

serverandstoresthepasswordinformationonvMA:

 vi‐adminwithadministratorprivileges

 vi‐userwithread‐onlyprivileges

Thecreationofvi‐adminandvi‐userdoesnotapplyforActiveDirectoryauthenticationtargets.Whenyouadd

asystemasanActiveDirectorytarget,vMAdoesnotstoreanyinformationaboutthecredentials.Tousethe

ActiveDirectoryauthentication,theadministratormustconfigure

vMAforActiveDirectory.Formore

informationonhowtoconfigurevMAforActiveDirectory,see“ConfigurevMAforActiveDirectory

Authentication”onpage 14.

Afteraddingatargetserver,youmustinitializevi‐fastpasssothatyoudonothavetoauthenticateeachtime

yourunvSphereCLIcommands.Ifyou

runavSphereCLIcommandwithoutinitializingvi‐fastpass,youwill

beaskedforusernameandpassword.

Youcaninitializevi‐fastpassbyusingoneofthefollowingmethods:

 Runvifptarget.Formoreinformationaboutthisscript,see“vifptargetCommandforvi‐fastpass

Initialization”onpage 27.

 CalltheLoginmethodinaPerlorJavaprogram.Formoreinformationaboutthismethod,see

“VmaTargetLibReference”onpage 33.

Aftersettingupatargetusingthevifptargetcommand,youcanrunvSphereCLIcommandsorscriptsthat

usevSphereSDKforPerlwithoutprovidinganyauthenticationinformation.Torun

commandsagainstan

ESXihostthatismanagedbyavCenterServer ,youcanusethe--vihostoption.

EachtimeyoulogintovMA,youmustrunthevifptargetcommandortheLoginmethodonce.Thetarget

thatyouspecifyinthevifptargetcommandisthedefaulttarget.Targetservers

remaintargetsacross

reboots.Youcanoverrideitbyusingthe--serveroptionofthevSphereCLIcommandsasshowninthe

followingexample:

vifptarget -s esx1.foo.com

vicfg-nics -l #lists the nics on esx1.foo.com

vicfg-nics -l --server esx2.foo.com #lists the nics on esx2.foo.com

VMware, Inc. 9

Chapter 1 Introduction to vMA

vMA Samples

vMAsamplesillustratethevMACLIsandtheVmaTargetLiblibrary.ThesamplesareavailableinvMAat

/opt/vmware/vma/samples.

 bulkAddServers.pl–PerlsamplethataddsmultipletargetstovMA.

 mcli.pl–PerlsamplethatrunsavSphereCLIcommandonmultiplevMAtargetsspecifiedinafile

suppliedasanargument.Youmustrunvifptargetbeforerunningthisscript.

 listTargets.pl ‐PerlsamplethatretrievesinformationandversionofvMAtargetsusing

VmaTargetLib.

 listTargets.sh ‐JavasamplethatdemonstratesuseofVmaTargetLib.

vMA Use Cases

Thissectionlistsafewtypicalusecases.

Writing or Converting Scripts

YoucanrunexistingvSphereCLIorvSphereSDKforPerlscriptsfromvMA.Tosettargetserversandinitialize

vi‐fastpass,thescriptcanusetheVmaTarget.login() methodofVmaTargetLib.

Writing or Converting Agents

PartnersorcustomerscanusevMAtowriteorconvertagents.

 ApartnerorcustomerwritesanewagentinPerl.

WhenapartnerorcustomerwritesanewagentinPerl,thePerlscriptmustimporttheVmaTargetLib

PerlmoduleandallvSphereSDKforPerlmodules.InsteadofcallingthevSphereSDKforPerlsubroutine

Util::Connect(targetUrl, username, password),theagentcalls

VmaTargetLib::VmaTarget.login().

 ApartnerorcustomerrunsanagentwritteninPerlorJavaintheserviceconsoleandwantstoportthe

agenttovMA.

TheagentusescodesimilartothefollowingPerl‐likepseudocodetologintoESXihosts:

LoginToMyEsx() {

SessionManagerLocalTicket tkt = SessionManager.AcquireLocalTicket(userName);

UserSession us = sm.login(tkt.userName, tkt.passwordFilePath);

}

Thepartnerchangestheagenttousecodesimilartothefollowingpseudo‐codeinstead:

LoginToMyEsx(String myESXName) {

VmaTarget target = VmaTargetLib.query_target(myESXName);

UserSession us = target.login();

}

Thispseudo‐codeassumesonlyonevMAtarget.Formultipletargetservers,thecodecanspecifyany

targetserverorloopthroughalistoftargetservers.

 ApartnerorcustomerrunsanagentwritteninPerloutsidetheESXihostandportstheagenttovMA.

InsteadofcallingthevSphereSDKforPerlmethodUtil::Connect(),theagentcallsthevifplibrary

methodVmaTargetLib::VmaTarget.login().

vSphere Management Assistant Guide

10 VMware, Inc.

VMware, Inc. 11

YoushouldhavesomeexperiencesettingupaLinuxsystemandworkinginaLinuxenvironment.This

chapterexplainshowtodeployandconfigurevMA,howtoaddandremovetargetservers,andhowto

prepareandrunscripts.Thechapteralsoincludestroubleshootinginformation.

ReadChapter 1,“IntroductiontovMA,”on

page 7forbackgroundinformationonvMAfunctionalityand

availablevMAcomponents.

Thischapterincludesthefollowingtopics:

 “HardwareRequirements”onpage 12

 “SoftwareRequirements”onpage 12

 “RequiredAuthenticationInformation”onpage 12

 “DeployvMA”onpage 13

 “ConfigurevMAatFirstBoot”onpage 13

 “vMAConsoleandWebUI”onpage 14

 “ConfigurevMAforActiveDirectoryAuthentication”onpage 14

 “ConfigureUnattendedAuthenticationforActiveDirectoryTargets”onpage 15

 “Enablethevi‐userAccount”onpage 16

 “vMAUserAccountPrivileges”onpage 16

 “A d d TargetServerstovMA”onpage 17

 “RunningvSphereCLIfortheTargets”onpage 19

 “ReconfigureaTargetServer”onpage 19

 “RemoveTargetServersfromvMA”onpage 20

 “ModifyingScripts”onpage 20

 “ConfigurevMAtoUseaStaticIPAddress”onpage 21

 “ConfigurevMAtoUseaDHCPServer”onpage 22

 “SettingtheTimeZone”onpage 22

 “ShutDownvMA”onpage 23

 “DeletevMA”onpage 23

 “TroubleshootingvMA”onpage 24

Getting Started with vMA

IMPORTANTYoucannotupgradeapreviousversionofvMAtovMA5.0.YoumustinstallafreshvMA5.0

instance.

vSphere Management Assistant Guide

12 VMware, Inc.

 “UpdatevMA”onpage 24

 “ConfigureAutomaticvMAUpdates”onpage 25

Hardware Requirements

TosetupvMA,youmusthaveanESXihost.BecausevMArunsa64‐bitLinuxguestoperatingsystem,the

ESXihostonwhichitrunsmustsupport64‐bitvirtualmachines.

TheESXihostmusthaveoneofthefollowingCPUs:

 AMDOpteron,revEorlater

 IntelprocessorswithEM64TsupportwithVTenabled.

Opteron64‐bitprocessorsearlierthanrevE,andIntelprocessorsthathaveEM64Tsupportbutdonothave

VTsupportenabled,donotsupporta64‐bitguestoperatingsystem.Fordetailedhardwarerequirements,see

theHardwareCompatibilityListontheVMware

Website.

Bydefault,vMAusesonevirtualprocessor,andrequires3GBofstoragespaceforthevMAvirtualdisk.The

recommendedmemoryforvMAis600MB.

Software Requirements

YoucandeployvMAonthefollowingsystems:

 vSphere5.0

 vSphere4.1orlater

 vSphere4.0Update2orlater

 vCenterApplication5.0

YoucandeployvMAbyusingavSphereClientconnectedtoanESXihostorbyusingavSphereClient

connectedtovCenterServer5.0,vCenterServer4.1orlater,vCenterServer4.0Update2orlater,orvCenter

Application5.0.

YoucanusevMAtotargetESX/ESXi

3.5Update5,ESX/ESXi4.0Update2orlater,ESX/ESXi4.1orlater,ESXi

5.0,vCenterServer4.0Update2orlater,vCenterServer4.1orlater,andvCenterServer5.0systems.

Atruntime,thenumberoftargetsasinglevMAinstancecansupportdependsonhowitisused.

Required Authentication Information

BeforeyoubeginvMAconfiguration,obtainthefollowingusernameandpasswordinformation:

 vCenterServersystem–IfyouwanttouseavCenterServersystemasthetargetserver,youmustbeable

toconnecttothatsystem.

IfyouareusingavCenterServertarget,youdonotneedpasswordsfortheESXihoststhatthevCenter

Serversystemmanages,unlessyou

runcommandsthatdonotsupportvCenterServertargets.

 ESXihost–Youmusthavetherootpasswordortheusernameandpasswordforauserwith

administrativeprivilegesforeachESXihostyouaddasavMAtarget.Youdonotneedtheauthentication

informationwhenyouremoveatargethost.

 vMA–WhenyoufirstconfigurevMA,vMApromptsforapasswordforthevi‐adminuser.Specifya

passwordandrememberitforsubsequentlogins.Thevi‐adminuserhasrootprivilegesonvMA.

MPORTANTTherootuseraccountisdisabledonvMA.Torunprivilegedcommands,typesudo

<command>.Bydefault,onlyvi‐admincanruncommandsthatrequiresudo.

VMware, Inc. 13

Chapter 2 Getting Started with vMA

Deploy vMA

YoucandeployvMAbyusingafileorfromaURL.Ifyouwanttodeployfromafile,downloadandunzipthe

vMAZIPfilebeforeyoustartthedeploymentprocess.

To deploy vMA

1UseavSphereClienttoconnecttoasystemthatisrunningthesupportedversionofESXiorvCenter

Server.

2IfconnectedtoavCenterServersystem,selectthehosttowhichyouwanttodeployvMAintheinventory

pane.

3 SelectFile>DeployOVFTemplate.

TheDeployOVFTemplatewizardappears.

4 SelectDeployfromafileorURLifyouhavealreadydownloadedandunzippedthe

vMAvirtual

appliancepackage.

5ClickBrowse,selecttheOVF,andclickNext.

6ClickNextwhentheOVFtemplatedetailsaredisplayed.

7AcceptthelicenseagreementandclickNext.

8Specifyanameforthevirtualmachine.

Youcanalsoacceptthedefaultvirtualmachinename.

9 Selectaninventorylocationforthevirtual

machinewhenprompted.

IfyouareconnectedtoavCenterServersystem,youcanselectafolder.

10 IfconnectedtoavCenterServersystem,selecttheresourcepoolforthevirtualmachine.

Bydefault,thetop‐levelrootresourcepoolisselected.

11 Ifprompted,selectthedatastoretostorethevirtualmachineonandclickNext.

12 SelecttherequireddiskformatoptionandclickNext.

13 SelectthenetworkmappingandclickNext.

14 ReviewtheinformationandclickFinish.

ThewizarddeploysthevMAvirtualmachinetothehostthatyouselected.The deployprocesscantake

severalminutes.

NextyouconfigureyourvMAvirtualmachine.YouperformthistaskwhenyoulogintovMAthefirsttime.

Configure vMA at First Boot

WhenyoustartthevMAvirtualmachinethefirsttime,youcanconfigureit.

To configure vMA

1InthevSphereClient,right‐clickthevirtualmachine,andclickPowerOn.

2 SelecttheConsoletab.

3Answerthenetworkconfigurationprompts.

MPORTANTYoucannotupgradeanearlierversionofvMAtovMA5.0.YoumustinstallafreshvMA5.0

instance.

MPORTANTEnurethatvMAisconnectedtothemanagementnetworkonwhichthevCenterServer

systemandtheESXihoststhatareintendedvMAtargetsarelocated.

vSphere Management Assistant Guide

14 VMware, Inc.

4Whenprompted,specifyahostnameforvMA.

Thenamecancontain64alphanumericcharacters.YoucanchangethevMAhostnamelaterbymodifying

the/etc/HOSTNAME and/etc/hostsfiles,asyouwouldforaLinuxhost.YoucanalsousethevMA

consoletochangethehostname.

Fora

DHCPconfiguration,thehostnameisobtainedfromtheDNSserver.

5Whenprompted,specifyapasswordforthevi‐adminuser.

Ifpromptedforanoldpassword,pressEnterandcontinue.

ThenewpasswordmustconformtothevMApassword policy.Thepasswordmusthaveatleast:

 Eightcharacters

 Oneuppercasecharacter

 Onelowercasecharacter

 Onenumeralcharacter

 Onesymbolsuchas#,$

Youcanlaterchangethepasswordforthevi‐adminuserusingtheLinuxpasswdcommand.

Thisuserhasrootprivileges.

vMAisnowconfiguredandthevMAconsoleappears.TheconsoledisplaystheURLfromwhichyoucan

accesstheWebUI.

vMA Console and Web UI

vMAprovidestwointerfaces,theconsole,whichisacommand‐lineinterfaceandthebrowser‐basedWebUI.

Fromtheconsole,youcandothefollowingtasks:

 Loginasvi‐admin

 AddserverstovMA

 RuncommandsfromthevMAconsole

 Configurethenetworksettingsandproxyserversettings

 Configurethetimezonesettings.

ThewebUIenablesyoutodothefollowingtasks:

 Loginasvi‐admin

 Configurethenetworksettingsandproxyserversettings

 Configurethetimezonesettings.

 UpdatevMA

Configure vMA for Active Directory Authentication

ConfigurevMAforActiveDirectoryauthenticationsothatESXihostsandvCenterServersystemsaddedto

ActiveDirectorycanbeaddedtovMAwithouthavingtostorethepasswordsinvMA’scredentialstore.This

isamoresecurewayofaddingtargetstovMA.

EnsurethattheDNSserverconfiguredfor

vMAisthesameastheDNSserverofthedomain.Youcanchange

theDNSserverbyusingthevMAConsoleortheWebUI.

EnsurethatthedomainisaccessiblefromvMA.Also,ensurethatyoucanpingtheESXiandvCenterserver

systemsthatyouwanttoadd

tovMAandthatpingingresolvestheIPaddressto

<targetservername.domainname>,wheredomainnameisthedomaintowhichvMAistobeadded.

VMware, Inc. 15

Chapter 2 Getting Started with vMA

To add vMA to a domain

1FromthevMAconsole,runthefollowingcommand:

sudo domainjoin-cli join <domain-name> <domain-admin-user>

2Whenprompted,providetheActiveDirectoryadministratorʹspassword.

Onsuccessfulauthentication,thecommandaddsvMAasamemberofthedomain.Thecommandalso

addsentriesinthe/etc/hostsfilewithvmaHostname.domainname.

3RestartvMA.

Now,youcanaddanActiveDirectorytargettovMA.Forstepstodothis,see“A d d TargetServersto

vMA”onpage 17.

To check vMA's domain settings

FromthevMAconsole,runthefollowingcommand:

sudo domainjoin-cli query

ThecommanddisplaysthenameofthedomaintowhichvMAhasjoined.

To remove vMA from the domain

FromthevMAconsole,runthefollowingcommand:

sudo domainjoin-cli leave

ThevMAconsoledisplaysamessagestatingwhethervMAhaslefttheActiveDirectorydomain.

Configure Unattended Authentication for Active Directory Targets

Toconfigureunattendedauthentication(authenticationfromvi‐adminorrootcontext)toActiveDirectory

targets,youmustrenewtheKerberosticketsforthedomainuserusingwhichthetargetisadded.Unattended

authenticationissupportedforESXi4.1Update3andlater.YoumustensurethattheActiveDirectoryissetup



forunattendedlogin.

To configure unattended authentication for Active Directory targets

1OnanyWindowsServer2003computerthatispartofthedomaintowhichvMAisadded,downloadand

installtheKtpasstoolfromtheMicrosoftwebsite.

2Openthecommandpromptandrunthefollowingcommand:

ktpass /out foo.keytab /princ [email protected] /pass ca... /ptype KRB5_NT_PRINCIPAL

-mapuser <vma-dc>\<foo>

where,<vma‐dc>isthenameofthedomainandfooistheuserhavingpermissionsforthevCenter

administration.

Thiscommandcreatesafilecalledfoo.keytab.

3Movethefoo.keytabfileto/home/local/VMA-DC/foo.

YoucanuseWinSCPandloginasuservma-dc\footomovethefile.

4 (Optional)Makesurethat

theuservma‐dc\fooonvMAownsthefoo.keytabfilebyusingthefollowing

commands:

ls -l /home/local/VMA-DC/foo/foo.keytab

chown ‘vma-dc\foo’

/home/local/VMA-DC/foo/foo.keytab

5OnvMA,createascriptin/etc/cron.hourly/kticket-renewwiththefollowingcontents:

#!/bin/sh

su - vma-dc\\foo -c '/usr/bin/kinit -k -t /home/local/VMA-DC/foo/foo.keytab foo'

Thisscriptwillrenewtheticketfortheuserfooeveryhour.

Youcanalsoaddtheabovescripttoaservicein/etc/init.dtorefreshtheticketswhenvMAisbooted.

vSphere Management Assistant Guide

16 VMware, Inc.

Troubleshooting Unattended Authentication

IfyouarenotabletoauthenticatefromvMAorcannotaddvMAtothedomaincontroller,verifythefollowing

conditions:

 YourDNSserversetupinvMAresolvestheIPaddressorhostnameofthevCenterservertoafully

qualifieddomainname(FQDN)andthattheFQDNcontainsthedomainnametowhichvMAisadded.

 Thecommandvifp listserversshowsthenameofvCenterserverastheFQDNthatcontainsthe

domainnametowhichvMAisaddedasthesuffix.

 ThedateandtimesettingsonvMA,thedomaincontrollerandthevCenterserverarethesame.Verifythe

timezoneaswell.Thetimemayvarybyanhour,butalargetimeskewmightcauseauthentication

problems.

Enable the vi-user Account

Aspartofconfiguration,vMAcreatesavi‐useraccountwithnopassword.However,youcannotusethe

vi‐useraccountuntilyouhavespecifiedavi‐userpassword.

To enable the vi-user account

1LogintovMAasvi‐admin.

2RuntheLinuxpasswdcommandforvi‐userasfollows:

sudo passwd vi-user

IfthisisthefirsttimeyouusesudoonvMA,amessageaboutrootuserprivilegesappears,andyouare

promptedforthevi‐adminpassword.

3Specifythevi‐adminpassword.

4Whenprompted,typeandconfirmthepasswordforvi‐user.

Afterthevi‐useraccountisenabledonvMA,

ithasnormalprivilegesonvMAbutisnotinthesudoerslist.

WhenyouaddESXitargetservers,vMAcreatestwousersoneachtarget:

 vi‐adminhasadministrativeprivilegesonthetargetsystem.

 vi‐userhasread‐onlyprivilegesonthetargetsystem.vMAcreatesvi‐useroneachtargetthatyouadd,

evenifvi‐userisnotcurrentlyenabledonvMA.

WhenauserisloggedintovMAasvi‐user,vMAusesthataccountontargetESXihosts,andthe

usercanrun

onlycommandsontargetESXihoststhatdonotrequireadministrativeprivileges.

vMA User Account Privileges

Table 2‐1liststheprivilegesthatthedifferentuseraccountshaveforvCLIusageagainstdifferenttargets.

MPORTANTThevi‐useraccounthaslimitedprivilegesonthetargetESXihostsandcannotrunany

commandsthatrequiresudoexecution.Youcannotusevi‐usertoruncommandsforActiveDirectorytargets

(ESXiorvCenterServer).ToruncommandsfortheActiveDirectorytargets,usethevi-adminuseror

login

asanActiveDirectoryusertovMA.

Table 2-1. Account Privileges for vCLI Usage

Target

Authentication

Policy vi-admin vi-user domain user

ESXifpauthYYN

ESXi adauth Y N Y

vCenterServer fpauth Y N N

vCenterServer adauth Y N Y

VMware, Inc. 17

Chapter 2 Getting Started with vMA

Add Target Servers to vMA

AfteryouconfigurevMA,youcanaddtargetserversthatrunthesupportedvCenterServerorESXiversion.

ForvCenterServerandESXisystemtargets,youmusthavethenameandpasswordofauserwhocanconnect

tothatsystem.

See“vifpaddserver”onpage 28forthecompletesyntax.

To add a vCenter Server system as a vMA target for Active Directory Authentication

1LogintovMAasvi‐admin.

2AddaserverasavMAtargetbyrunningthe followingcommand:

vifp addserver vc1.mycomp.com --authpolicy adauth --username ADDOMAIN\\user1

Here,--authpolicy adauthindicatesthatthetargetneedstousetheActiveDirectoryauthentication.

Ifyourunthiscommandwithoutthe--usernameoption,vMApromptsforthenameoftheuserthatcan

connecttothevCenterServersystem.Youcanspecifythisusernameasshowninthefollowingexample:

Enter username for machinename.example.com: ADDOMAIN\user1

If--authpolicyisnotspecifiedinthecommand,thenfpauthistakenasthedefaultauthentication

policy.

3Verifythatthetargetserverhasbeenadded.

Thedisplayshowsalltargetserversandtheauthenticationpolicyusedforeachtarget.

vifp listservers --long

server1.mycomp.com ESX adauth

server2.mycomp.com ESX fpauth

server3.mycomp.com ESXi adauth

vc1.mycomp.com vCenter adauth

4Setthetargetasthedefaultforthecurrentsession:

vifptarget --set | -s <server>

5VerifythatyoucanrunavSphereCLIcommandwithoutauthenticationbyrunningacommandonone

oftheESXihosts,forexample:

esxcli --server <VC_server> --vihost <esx_host> network nic list

Thecommandrunswithoutpromptingforauthenticationinformation.

To add a vCenter Server system as a vMA target for fastpass Authentication

1LogintovMAasvi‐admin.

2AddaserverasavMAtargetbyrunningthe followingcommand:

vifp addserver vc2.mycomp.com --authpolicy fpauth

Here,--authpolicy fpauthindicatesthatthetargetneedstousethefastpassauthentication.

3Specifytheusernamewhenprompted:

Enter username for machinename.example.com: MYDOMAIN\user1

4Specifythepasswordforthatuserwhenprompted.

[email protected]'s password: <not echoed to screen>

5Reviewandacceptthesecurityriskinformation.

MPORTANTIfthenameofatargetserverchanges,youmustremovethetargetserverbyusingvifp

removeserverwiththeoldname,thenaddtheserverusingvifp addserverwiththenewname.

vSphere Management Assistant Guide

18 VMware, Inc.

6Verifythatthetargetserverhasbeenadded.

Thedisplayshowsalltargetserversandtheauthenticationpolicyusedforeachtarget.

vifp listservers --long

server1.mycomp.com ESX adauth

server2.mycomp.com ESX fpauth

server3.mycomp.com ESXi adauth

vc1.mycomp.com vCenter adauth

vc2.mycomp.com vCenter fpauth

7Setthetargetasthedefaultforthecurrentsession.

vifptarget --set | -s <server>

8VerifythatyoucanrunavSphereCLIcommandwithoutauthenticationbyrunningacommandonone

oftheESXihosts,forexample:

esxcli --server <VC_server> --vihost <esx_host> network nic list

Thecommandrunswithoutpromptingforauthenticationinformation.

To add an ESXi host as a vMA target

1LogintovMAasvi‐admin.

2RunaddservertoaddaserverasavMAtarget.

vifp addserver <servername>

Youarepromptedforthetargetserver’srootuserpassword.

root@<servername>’s password:

3SpecifytherootpasswordfortheESXihostthatyouwanttoadd.

vMAdoesnotretaintherootpassword.Instead,vMAaddsvi‐adminandvi‐usertotheESXihost,and

storestheobfuscatedpasswordsthatitgeneratesforthoseusersintheVMwarecredentialstore.

InavSphere

clientconnectedtothetargetserver,theRecentTaskspaneldisplaysinformationaboutthe

usersthatvMAadds.Thetargetserver’sUsersandGroupspaneldisplaystheusersifyouselectit.

4Verifythatthetargetserverhasbeenadded:

vifp listservers

5Setthetargetasthedefaultforthecurrentsession.

vifptarget --set | -s <server>

6VerifythatyoucanrunavSphereCLIcommandwithoutauthenticationbyrunningacommand,forexample:

esxcli network nic list

IMPORTANTIfthenameofatargetserverchanges,youmustremovethetargetserverbyusingvifp

removeserverwiththeoldname,thenaddtheserverusingvifp addserverwiththenewname.

CAUTIONRemoveusersaddedbyvMAfromthetargetserveronlyifyoudeletedthevMAvirtual

machinebutdidnotremovethetargetservers.

IMPORTANTIfthenameofatargetserverchanges,youmustremovethetargetserverusingvifp

removeserverwiththeoldname,thenaddtheserverusingvifp addserverwiththenewname.

VMware, Inc. 19

Chapter 2 Getting Started with vMA

Running vSphere CLI for the Targets

Ifyouhaveaddedmultipletargetservers,bydefault,vMAexecutescommandsonthefirstserverthatyou

added.Youshouldspecifytheserverexplicitlywhenrunningcommands.

To run vSphere CLI for the targets

1AddserversasvMAtargets.

vifp addserver <server1>

vifp addserver <server2>

2Verifythatthetargetserverhasbeenadded:

vifp listservers

3Runvifptarget.

vifptarget -s <server2>

Thecommandinitializesthespecifiedtargetserver.Now,thisserverwillbetakenasthedefaulttargetfor

thevSphereCLIorvSphereSDKforPerlscripts.

4RunvSphereCLIorvSphereSDKforPerlscripts,byspecifyingthetargetserver.Forexample:

esxcli --server server2 network nic list

Reconfigure a Target Server

Youcanreconfigureatargetserverifyouwanttoperformanyofthefollowingtasks:

 ChangetheauthenticationmodeofavMAtargetfromvi‐fastpasstoActive Directoryorviceversa.

 ChangetheconfigureduserfortheActiveDirectorytarget.

 Recoverusersforthevi‐fastpasstarget.AuserneedstoberecoveredifthecredentialstoreonvMAis

corruptedor ifthecredentialsofuserscorrespondingtovMAusersaremodifiedandnotreflectedinvMA.

To change the authentication policy

1LogintovMAasvi‐admin.

2Runreconfigure

vifp reconfigure <servername> --authpolicy <authpolicy>

3Whenprompted,provideyourcredentials.

 IfyoureconfigureanActiveDirectorytargettovi‐fastpassauthentication,thenspecifytheroot

passwordforESXitargetsandtherootusernameandpasswordforvCentertargets.

 Ifyoureconfigureavi‐fastpasstargettoActiveDirectoryauthentication,thenspecifytheroot

usernameforthetarget.

To change the configured user or to recover users

1LogintovMAasvi‐admin.

2Runreconfigure.

vifp reconfigure <servername>

3Whenprompted,provideyourcredentials.

 IfyoureconfigureanActiveDirectorytarget,specifyausernameforthetarget.

 Ifyoureconfigureavi‐fastpasstarget,specifytherootpasswordoftheESXitarget,andthepassword

forusernameusedtoaddthevCenterServertarget.

vSphere Management Assistant Guide

20 VMware, Inc.

Example 2-1. Adding and Reconfiguring a Target

vi-admin@example-dhcp:~> vifp addserver 90.100.110.120

Enter username for 90.100.110.120: administrator

[email protected]'s password:

This will store username and password in credential store which is a security risk. Do you want

to continue?(yes/no): yes

vi-admin@example-dhcp:~> vifp reconfigure 90.100.110.120

[email protected]'s password:

vi-admin@example-dhcp:~>

Remove Target Servers from vMA

BeforeyoudeleteavMAvirtualmachine,removealltargetserversfromvMA.Ifyoudonotremovetarget

ESXihosts,thevi‐adminandvi‐userusersremainonthetargetservers.

To remove a vCenter Server system from vMA

1LogintovMAasvi‐admin.

2ToremoveatargetvCenterServersystemfromvMA,runthe

followingcommand:

vifp removeserver <servername>

ThevCenterServersystemisnolongeravMAtarget.

To remove an ESXi host from vMA

1LogintovMAasvi‐admin.

2ToremoveanESXihostthatisavMAtarget,runthefollowingcommand:

vifp removeserver <host>

TheRecentTaskspanelofthetargetserverdisplaysinformationaboutthevi‐adminandvi‐userusersthat

arebeingremoved.TheUsersandGroupspanelofthetargetservernolongerdisplaystheusers.

Modifying Scripts

YoucanmodifyserviceconsolescriptstorunfromvMA.

 Linuxcommands–ScriptsrunninginvMAcannotuseLinuxcommandsinthewaythattheydoonthe

ESXserviceconsolebecausetheLinuxcommandsarerunningonvMAandnotontheESXhost.

 AccesstoESXifiles–IfyouneedaccesstofoldersorfilesonanESXihost,youcanmakethathostatarget

serverandusethevifsvSphereCLIcommandtoview,retrieve,ormodifyfoldersandfiles.

 Referencestolocalhost–Scriptscannotrefertolocalhost.

 Ifvi‐fastpassisinitialized,allcommandsthatdonotspecify--serverapplytothedefaulttarget.

 Ifvi‐fastpassisinitialized,allcommandsthatspecifyhostnameorIPofthetargetapplyto thetarget

specified.

 Programmaticconnection–InPerlscriptsorJavaprograms,youcancallVmaTarget.login() method

of VmaTargetLibandspecifythehosttoconnectto.Thedirectory/opt/vmware/vma/samplescontains

examplesinPerlandJava.vMAhandlesauthenticationiftheserverhasbeenestablishedasatarget

server.ProgramscanuseVmaTargetLiblibrarycommands.See

“UsingtheVmaTargetLibLibrary”on

page 33.

 Noprocnodes–SomeserviceconsolescriptsstilluseVMwareprocnodes,whichwereofficiallymade

obsoletewithESXServer3.0andarenotavailableinESX/ESXi4.0andlater.Youcanextractinformation

thatwasavailableinVMwareprocnodesusingthevSphereCLIcommandsavailableonvMA.

 Targetspecification–Youmustspecifythetargetserverwhenyouruncommandsorscripts.

Page is loading ...

VMware vSphere vSphere 5.0 User guide

Brand: VMware vSphere

Model: vSphere 5.0

Category: Software manuals

Type: User guide

Download PDF

report

VMware vSphere vSphere 5.0 User guide

VMware vSphere vSphere 5.0 User guide

Related papers

Other documents