Security – Page 8

vCenter Server 6.0 Tidbits Part 11: Automate SSO Admin password change

06.09.2015 by William Lam // 1 Comment

After publishing my last article around the topic of Automating SSO Admin configurations using some simple LDAP commands which is applicable for both vSphere 5.5 and 6.0. It was pointed out to me by my buddy G. Blair Fritz who works over in our GSS Organization that another handy operation to share with customers is the ability to easily and quickly change an SSO Administrator password across multiple Platform Services Controllers (PSC). This is especially important for customers who have a password rotation policy set fourth by their Security team which most Enterprise customers have and are require to update their admin passwords every N-number of days.

Though you will not be able to query for an existing SSO Administrator's password (it is encrypted), you can however modify the password and this will require you to provide a valid SSO Administrator's account to connect with. To modify an LDAP entry, we will need to first create a file that contains the change, in the example here we are going to name it change.ldif and it should contain the following where the "replace" keyword shows which property is getting modified and the next line after shows the value that it will be changed to. Make sure to also replace the dc=vghetto with the name of your SSO Site Name

dn: cn=administrator,cn=users,dc=vghetto,dc=local
changetype: modify
replace: userpassword
userpassword: VMware1!

To apply the change, we will now run the following ldapmodify command and specifying our change.ldif configuration file:

/opt/likewise/bin/ldapmodify -f change.ldif -h 192.168.1.60 -D "cn=administrator,cn=users,dc=vghetto,dc=local" -w 'VMware1!!'

The really nice thing about this is that you can quickly change the password for your SSO Administrators across multiple Platform Services Controller and across multiple SSO Domains with a couple slight modifications to the command. How cool is that!? Thanks to Blair for sharing this awesome tidbit!

vCenter Server 6.0 Tidbits Part 6: Customizing VCSA's DCUI

04.21.2015 by William Lam // Leave a Comment

For those of you who have deployed the latest VCSA 6.0, you may have noticed that it now includes a DCUI interface similar to that of ESXi. Just like ESXi, it provides some basic functionality such as network configuration, restarting of the management interface, enabling SSH/Shell access and viewing support logs. For some customers, there is a mandatory requirement in terms of compliance to be able to display a security or warning banner prior to logging into a system which can also include interactive console UI's like the DCUI.

With ESXi, it was possible to customize the DCUI as seen in the screenshot below (more serious customizations are used in customer environments of course). For more details, please take a look at this blog post here.

Luckily, with the VCSA 6.0, it is also now possible to customize some of the text on the DCUI interface. However, you will not have complete free range like you did with the ESXi's DCUI interface but will be specific part of the screen. Here is an example of what can be added to the VCSA's DCUI screen:

There is a section before the IP Address and a section after the IP Address which you can append custom text. This is controlled by the following configuration file located in: /etc/vmware/appliance/dcui.cfg and specifically with the following two variables: CONNECTION_MESSAGE which is the message before the IP Address and CONNECTION_MESSAGE_AFTER_IP for the message after the IP Address.

Here is an example of what the above customization looks like:

{
    "PRODUCT_NAME": "VMware vCenter Server Appliance 6.0",
    "CONNECTION_MESSAGE_BEFORE_IP": "https://",
    "CONNECTION_PORT": "443",
    "CONNECTION_MESSAGE": "\n\t### Message BEFORE IP ###\n",
    "CONNECTION_MESSAGE_AFTER_IP": "\n\n\t### Message AFTER IP ###\n"
}

For the changes to take affect, you will need to reload the DCUI interface which you can do by running the following command:

kill $(ps -ef | grep dcui.py | grep -v grep | awk '{print $2}')

How to recover VCSA 5.5 from an expired administrator account?

09.10.2013 by William Lam // 9 Comments

Last week I wrote about a new security feature in the new VCSA 5.5 where the administrator account (root) password will now expire automatically after 90 days of powering on the VCSA if the password is not changed before then. This new enhancement is to ensures that administrative passwords are rotated routinely for good security practices. However, in the event that you forget to change the password before the expiration, you can still recover the VCSA and this article will walk you through that process.

As a lab exercise, I have configured my root password to expire in one day and purposely let it expire. If you try to login to the VAMI UI, you will get an "Unable to authenticate user" error and you will see something similar if you login to the SSH console. Ideally, this message should be a bit more descriptive to say something like the password has expired (which I have filed an internal bug for).

Requirements:

You will need console access to your VCSA
You will also need a Linux LiveCD, I personally like using KNOPPIX

Step 1 - Mount the Linux LiveCD to your VCSA and boot into the image. You will need to bring up a terminal shell. The version I am using has a menu and I just select the "shell" option.

Step 2 - Once you are in the terminal, you will need to switch to the root user by running the following command:

su -

Step 3 - Next, we need to mount the VCSA root partition which will be /dev/sda3 to /mnt directory by running the following command:

mount /dev/sda3 /mnt

Step 4 - We now need to edit /etc/shadow file on our VCSA which is located in /mnt/etc/shadow to disable the account lock. You will need to use an editor such as vi to open up the file.

You need to delete "x" in the 2nd field and the numeric value on the 5th field (if it exists, this should be the number of days for expiration, default is 90) for the root user account. The screenshot above shows what values needs to be deleted. Once you have made the changes, go ahead and save the file.

Step 5 - Reboot the VCSA and now you can login to both the VAMI UI interface as well as the SSH console.

Note: If you had the password expiration feature enabled, it has now been disabled for you to login. If you wish to re-enable it, you will need to configure it in the VAMI UI or through the CLI. Please refer to this article here for more details.