WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud
  • Tanzu
    • Application Modernization
    • Tanzu services
    • Tanzu Community Edition
    • Tanzu Kubernetes Grid
    • vSphere with Tanzu
  • Home Lab
  • Nested Virtualization
  • Apple
You are here: Home / vSphere / Quick Tip - How to disable the landing page for vCenter Server 5.x & 6.x?

Quick Tip - How to disable the landing page for vCenter Server 5.x & 6.x?

07.25.2016 by William Lam // 2 Comments

The question of wanting to disable the default landing page for the vCenter Server is one that comes up infrequently. In fact, I probably see this maybe once or twice a year. However, when it does come up, it usually revolves around two topics: some sort of security risk and limiting users from obtaining software provided through these landing pages. In both case, simply disabling these landing pages will not solve either of these perceived issues.

I generally find these landing pages quite useful as they provide links to software downloads such as our legacy vSphere C# Client, SDK documentation as well as links to other interfaces to vCenter Server like the vSphere Web Client login, the datastore browser or the vSphere MOB. All of this information can be obtained through other official channels, so simply disabling this page does not really prevent users from downloading this content or accessing these interfaces.

On the second topic around security (which by no means am I an expert in), some customers feel that simply removing these default landing pages would some how prevent a security risk because a version of the software is no longer listed on that page? This is what some folks would call security through obscurity which just does not work. There are many different ways of identifying a version of vCenter Server and some of its components as well checking if the service is running. Simply removing these pages does little to nothing from stopping someone from retrieving this information using other methods. Instead, users should really be focusing how they are implementing security both in the software as well as the policies and processes they have in place which hopefully are inline with modern security practices.

In fact, by disabling some of these pages, you might even be hurting your overall customer experience depending on their familiarity with vCenter Server.

In any case, for those that are still inclined to disable these pages, below are the instructions on how to disable the various landing pages as I have not really seen this documented anywhere. The solution is actually quite simple which is to just rename the index files to something else which will prevent them from being loaded by the webserver.

Landing page for vCenter Server 5.x 

  • Windows VC: C:\ProgramData\VMware\VMware VirtualCenter\docRoot\index.html
  • VCSA: /etc/vmware-vpx/docRoot/index.html

disable-vcenter-server-landing-splash-page-0
Tomcat landing page for vCenter Server 5.x

  • Windows VC: C:\Program Files\VMware\Infrastructure\tomcat\webapps\ROOT\index.jsp
  • VCSA: /usr/lib/vmware-vpx/tomcat/webapps/tomcat/webapps/ROOT/index.jsp

disable-vcenter-server-landing-splash-page-1
Landing page for vCenter Server 6.x 

  • Windows VC: C:\ProgramData\VMware\VMware VirtualCenter\docRoot\index.html
  • VCSA: /etc/vmware-vpx/docRoot/index.html

disable-vcenter-server-landing-splash-page-2
Landing page for Platform Services Controll (vSphere 6.x)

  • Windows VC: C:\ProgramData\VMware\vCenterServer\runtime\VMwareSTSService\webapps\websso\WEB-INF\views\index.jsp
  • VCSA: /usr/lib/vmware-sso/vmware-sts/webapps/websso/WEB-INF/views/index.jsp

disable-vcenter-server-landing-splash-page-3

More from my site

  • Will I get Photon OS when I upgrade my VCSA 5.5/6.0 to VCSA 6.5?
  • Generating vCenter Server & Platform Services Controller deployment topology diagrams
  • Which Platform Services Controller (PSC) is my vCenter Server pointing to?
  • vCenter Server 6.0 Tidbits Part 4: Finding all deployed vCenter Servers
  • vCenter Server 6.0 Tidbits Part 1: What install & deployment parameters did I use?

Categories // vSphere, vSphere 5.5, vSphere 6.0, vSphere Web Client Tags // landing page, splash page, tcServer, vCenter Server, vcenter server appliance, vSphere 5.1, vSphere 5.5, vSphere 6.0

Comments

  1. Schorschi says

    07/25/2016 at 3:19 pm

    Your comments are just not correct, the blocking of the landing package is not a security scenario per se. The reason for disable of the landing page is a control feature, not a security feature. Enterprise scale customers do not want random download of clients or plugins. Enterprise customers deploy clients and plugins as a controlled process, so any link that allows access to a client or plugin is not only misleading, but creates confusion. Moreover, given that such links are blocked by control polices if a typical user does happen to click on one, and it fails it reflects inappropriately on all concerned including VMware. It is clear you did not take a enterprise customer perspective in your comments above.

    Reply
  2. Patel Mike says

    09/01/2018 at 9:15 pm

    I am looking to find out if we can change how 404-error-page gets display. The vCenter does not show it however, if you have an external PSC server, then the https://PSC-FQDN/Random-string will give you the default-tomacat-404-page which displays Tomacat version number. Many of the security scanning software such as Tanable flag it as security vulnerability.

    Reply

Thanks for the comment! Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search

Author

William Lam is a Senior Staff Solution Architect working in the VMware Cloud team within the Cloud Infrastructure Business Group (CIBG) at VMware. He focuses on Cloud Native technologies, Automation, Integration and Operation for the VMware Cloud based Software Defined Datacenters (SDDC)

Connect

  • Email
  • GitHub
  • LinkedIn
  • RSS
  • Twitter
  • Vimeo

Recent

  • vSphere with Tanzu using Intel Arc GPU 01/26/2023
  • Quick Tip - Automating allowed and not allowed Datastores for use with vSphere Cluster Services (vCLS) 01/25/2023
  • ESXi with Intel Arc 750 / 770 GPU 01/24/2023
  • How to bootstrap vSAN Express Storage Architecture (ESA) on unsupported hardware? 01/19/2023
  • Automating Virtual Machine screenshots in vSphere 01/18/2023

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2023

 

Loading Comments...