Enable and Configure ESXi Host Lockdown Mode

Posted on by
Reply

To enhance the security measures in a virtualized environment, it is often advisable to limit direct access to Esxi hosts and this is when lockdown mode concept comes into picture. Lockdown mode is used on Esxi hosts in order to improve security of the hosts which are centrally managed by vCenter server.

When the lockdown mode is enabled, the host is managed using the vSphere Client connected to the managing vCenter Server, VMware PowerCLI, or VMware vSphere Command-Line Interface (vCLI). The only difference is that access is authenticated through the vCenter Server instead of using a local account on the ESXi host.

When the lockdown mode is enabled, access to the host through SSH is unavailable except to configured exception users.

Lockdown mode in vSphere 6.0

With vSphere 6.0, VMware introduced a couple of new concepts into lockdown mode as listed below

  • Normal Lockdown Mode
  • Strict Lockdown Mode
  • Exception Users

Lets understand about these concepts one by one.… Read More

Configure SSL Timeouts on Esxi Host

Posted on by
Reply

To authenticate against vCenter SSO, solution users uses certificates to establish a secure connection. A solution user presents the certificate to vCenter SSO in 3 cases:

  • When solution user authenticates against sso for very first time.
  • After a reboot, and
  • After a timeout has elapsed.

The timeout value can be set from the Web Client. The default value for this is 2592000 seconds (30 days). To change the default value, login to vSphere Web Client and navigate to  Administration > Single Sign-On > Configuration > Policies > Token Policy.

On few blogs I read the following steps for configuring ssl timeouts. 

We can configure SSL timeouts for ESXi by editing a configuration file on the ESXi host.

Timeout periods can be set for 2 types of idle connections:

1: The Read Timeout setting applies to connections that have completed the SSL handshake process with port 443 of ESXi.

2: The Handshake Timeout setting applies to connections that have not completed the SSL handshake process on port 443 of ESXi.… Read More

Enable/Disable certificate checking on Esxi Host

Posted on by
Reply

The data that travels between clients and ESXi hosts is encrypted to ensure that the transactions are private and authenticated. The SSL is used to create a secure connection between the clients, ESXi hosts, and/or the vCenter Server.  SSL uses TCP/IP and allows SSL-enabled ESXi hosts and/or vCenter Server to authenticate with SSL-enabled clients. 

When an ESXi host or vCenter Server is installed, the installation includes SSL certificates. These preinstalled, auto generated certificates are not from an official certificate authority (CA), but they can be used to establish an initial connection.

The vCenter Server uses an SSL certificate when adding ESXi hosts and to connect to managed ESXi hosts whose passwords are stored in the vCenter Server database. After an authenticated encrypted connection is established, a smaller session key is encrypted and exchanged using public and private key pairs.

This shared session key is then used to encrypt and decrypt the data between client and server.… Read More

Refresh/Regenerate/Replace Esxi 6.0 SSL Certificates

Posted on by
Reply

To improve security in your virtualized environment, it is advisable to use the signed certificates because  ‘self-signed’ certificate will not be trusted by default in it’s communications with other systems. There are various ways to deploy signed certificates on your Esxi hosts and in this post we will look at available options.

Refreshing Esxi Certificates

If you have updated the certificate information and want to push those changes to certificate installed on Esxi host, the simplest method is to do a refresh certificate. Lets understand this by an example.

Suppose this is the current configuration of the vCenter certificate where country name is US and Org Unit is “VMware Engineering”

Now suppose you have updated the various configuration value for your vCenter certificate as shown below

Now if you select the Esxi host and navigate to Manage > Settings > Certificates, you will see it still contains the old information i.e… Read More

Configure and manage VMware Endpoint Certificate Store

Posted on by
Reply

VMware Endpoint Certificate Store (VECS) serves as a local repository for certificates, private keys, and other certificate information that can be stored in a keystore. You can decide not to use VMCA as your certificate authority and certificate signer, but you must use VECS to store all vCenter certificates, keys, and so on. ESXi certificates are stored locally on each host and not in VECS.

VECS runs as part of the VMware Authentication Framework Daemon (VMAFD). VECS runs on every embedded deployment, Platform Services Controller node, and management node (vCenter) and holds the keystores that contain the certificates and keys.

VECS polls VMware Directory Service (vmdir) periodically for updates to the TRUSTED_ROOTS store. You can also explicitly manage certificates and keys in VECS using vecs-cli commands.

VECS Default Stores

1: Machine SSL Store (MACHINE_SSL_CERT)

This store is used by the reverse proxy service on every vSphere node. This store is also used by the VMware Directory Service (vmdir) on embedded deployments and on each Platform Services Controller node.… Read More

Replacing vSphere 6.0 certificates using VMCA as a Subordinate CA

Posted on by
Reply

vSphere 6.0 brought many enhancements with it and one of the most significant among them was VMware Certificate Authority which is VMware’s own CA and it eases the pain of certificate management in vSphere 6.

VMCA is itself a fully functional CA and can be used to issue certificates to all vSphere 6 components (vCenter and ESXi hosts) in your environment. VMCA dont have any graphical interface like Microsoft CA and is totally command line driven.

VMCA is part of Platform services controller and there are various deployment model available for configuring VMCA including:

  • VMCA as Root CA
  • VMCA as Subordinate CA to an External Enterprise CA
  • External CA
  • Hybrid mode

Derek Seamen has explained about these deployment options in greater detail here

By default, the VMCA self-signs its own certificate which is used by vCenter server and Esxi hosts. If  your organization policy don’t allow using self-signed certs then you can replace the certs generated by VMCA and sending them to an enterprise CA for signing.… Read More

Backup and Restore Resource Pool Configurations

Posted on by
Reply

When DRS is disabled on a cluster, it removes all the resource pools that are part of the cluster and the resource pool hierarchy and affinity rules are not re-established when DRS is turned back on. 

Now if you really want to disable DRS (for any maintenance activity) and want to save yourself from the pain of re-creating resource pools and configuring share/limits etc, you can take backup of resource pools and and restore it later post completing the maintenance and enabling DRS again.

In my lab I created a resource pool named “RP-Edge” and placed one VM in this resource pool.

When you disable DRS on a cluster, vSphere gives you an opportunity to save the resource pool tree in a file which can be used later to restore the resource pool hierarchy.

Just click on yes on the warning window presented.

save the file on your local PC.

At this point, the resource pool is gone and the Win-DR-Test VM is out of the resource pool.… Read More

Backup and Restore vDS Configurations

Posted on by
Reply

You can export vSphere distributed switch and distributed port group configurations to a file. The file preserves valid network configurations, enabling distribution of these configurations to other deployments.

This functionality is available only with the vSphere Web Client 5.1 or later. However, you can export settings from any version of a distributed switch if you use the vSphere Web Client or later.

To export vSphere Distributed Switch configurations using the vSphere Web Client:
 
1: Browse to a distributed switch in the vSphere Web Client navigator and Right-click the distributed switch and click Settings > Export Configuration
 

2: Select the Export the distributed switch configuration or Export the distributed switch configuration and all port groups option.

3: Click Yes to save the configuration file to your local system. 

Select a location your computer where you want to save the backup file and also provide a name for the backup file.

You now have a configuration file that contains all settings for the selected distributed switch and distributed port group.… Read More

Troubleshooting vSphere Replication plugin missing from vCenter Server

Posted on by
Reply

Last week I upgraded my VR appliance from 6.1.1 to 6.1.2 and registered VR to vCenter and to my surprise VR plugin was missing after I reloaded my vSphere Web Client. I tried logoff and login to Web Client a couple of times, but luck was not with my side. 

While configuring VR, I saw a succesful configuration message, So easily I can rule out issues with VR > VC registration. 

I even restarted Web Client service followed by bouncing vCenter server node but VR has decided to give up on me that day and still the plugin was missing from Web Client. This was a bit strange for me as I have deployed VR in my lab 3-4 times and never encountered this issue.

On googling the issue, I came across VMware KB-2149560 which clearly mentions that this is a known issue with VR 6.1.2. The KB has all the steps listed in order to fix the issue. … Read More

vSphere Replication & Multi Point in Time Snapshots

Posted on by
Reply

When configuring replication of a virtual machine, you might have noticed the option “Point in time instances” aka PIT. This setting allow for some snapshots to be maintained at the DR site for the replicated VM at certain intervals.  

During replication, vSphere Replication replicates all aspects of the virtual machine to the target site, including any potential viruses and corrupted applications. The benefit being that if a guest is corrupted, we have multiple points in time to failover from in case the corruption already replicated across sites

vSphere Replication retains a number of snapshot instances of the virtual machine on the target site based on the retention policy that you specify. vSphere Replication supports maximum of 24 snapshot instances. After you recover a virtual machine, you can revert it to a specific snapshot.

Multiple Point In Time (MPIT) recovery was first introduced in vSphere replication 5.5 and it enables an administrator to recover a virtual machine to the latest replicated copy at the target site and then revert, or “roll back,” that virtual machine to a previous point in time.… Read More