WilliamLam.com

Enabling shell access for Active Directory users via SSH to vCenter Server Appliance (VCSA)

by // 5 Comments

I had a question the other day on whether it was possible to enable shell access for Active Directory users when logging into the vCenter Server Appliance (VCSA) via SSH? The answer is yes and though this is documented here, it is not very clear whether this is only applicable to SSO-based users only. In any case, the process to enable this is pretty straight forward and simply requires two steps which I have outlined below.

Step 0 - Ensure that your VCSA and/or PSC is joined to Active Directory before proceeding to the next step. If not, take a look at the documentation here for more details.

Step 1 - Login to vSphere Web Client and under Administration->System Configuration->Nodes->Manage->Settings->Access, go ahead and enable boh SSH and bash shell options. The first setting turns on SSH to the VCSA and the second setting allows users (local, SSO and AD) to access the shell on the VCSA.


Step 2 - In the vSphere Web Client and under Administration->Single Sign-On->Users and Groups->Groups, select the SystemConfiguration.BaseShellAdministrators group and add either an AD User and/or Group that you wish to allow to access the shell.


Once you have completed the steps above, you can now SSH to your VCSA/PSC using the AD user (UPN format) that you had authorized earlier. In the example below, I am logging into one of my VCSA using user *protected email* and as you can see, I am placed into the appliance shell by default.


At this point I can access all the appliancesh commands just like I normally would if I had logged as a root or *protected email*.

If we wish to change to bash shell, we simply just type "shell" which will enable shell access, assuming you had performed Step 2.


One thing that I noticed is that the default home directory for the AD user is /var/lib/nobody and apparently that does not exists by default, so users end up in / directory by default after enabling shell access. I am not sure if this is also related, but the username shows up as nobody as you can see from the prompt. This is something I will share with Engineering to see if we can improve upon as I am sure most of you would rather see the user that is actually logged in.

The good news from an auditing and logging standpoint is that for operations that are logged, it does properly show the username even though the prompt is showing up as nobody.

[Read more...]

VMware Fusion Powershell community module

by // 1 Comment

During the VMware Fusion 2017 Tech Preview, I was experimenting around with the new Fusion REST API and I had built a small prototype PowerShell Module as a way for me to learn how the API works. This allowed me to provide valuable feedback back to the Fusion Engineering team on improving the REST API UX. I was pleasantly happy to see that the majority of the feedback was indeed implemented for Fusion 10 which GA'ed a few weeks back.

Given the PowerShell module was pretty useful for my own use, I figure I would also publish it for others who might also be interested in Automating VM management using the new Fusion REST API, especially those with a PowerShell/PowerCLI background. Another nice thing about the module is that it can run across macOS/Linux via PowerShell Core or Windows using full blown PowerShell. I have been slowly tweaking the module to include the updated REST API changes and I am please to announce that the VMware.Hosted PowerShell Module which supports the new Fusion 10 REST API is now available!

The module includes the following 14 functions:

  • Connect-HostedServer
  • Disconnect-HostedServer
  • Get-HostedNetworks
  • Get-HostedVM
  • Get-HostedVMNic
  • Get-HostedVMSharedFolder
  • New-HostedVM
  • New-HostedVMSharedFolder
  • Remove-HostedVM
  • Remove-HostedVMSharedFolder
  • Resume-HostedVM
  • Start-HostedVM
  • Stop-HostedVM
  • Suspend-HostedVM


If you have ever used PowerCLI before, these functions should feel very familiar. We have basic Connect/Disconnect-HostedServer which will set an environmental variable called $DefaultHostedServer. This variable contains some basic information about the Fusion API endpoint as well as the base64 encoded credentials which are required when connecting to the new Fusion API. Below are a few examples using the new Fusion module, they are pretty basic and I have only implemented a sub-set of the Fusion REST API, so any community contributions are most welcome!

[Read more...]

VMworld Hackathon Hardware/Software BOM

by // 13 Comments

I know many of you have been asking about the hardware setup that we had used in this years VMworld Hackathon. I finally got a chance to document the details and you can find the complete hardware and software BOM below. For VMworld US, we had two different HW configurations, one for the primary Hackathon which was also re-used for VMworld Europe but we also had another configuration for the Hackathon Training sessions which was new this year. For VMworld Europe, we re-used the primary Hackathon hardware, but we also had the opportunity to take advantage of the new VMware Cloud on AWS offering and built a similiar configuration that teams could also remotely connect to as well. The only difference between the on-premises hardware and VMWonAWS, is the latter required users to RDP to a Windows jump host. Both options were provided and teams could select either environment to use.

Note: Internally, CDW is one of our vendors for purchasing hardware/software and that is why there are links directly to their site. However, you may find better pricing by looking online, especially Amazon which majority of the components are cheaper except for the server which you can get an exclusive vGhetto Discount at MITXPC. I have added links to both CDW/Amazon where applicable and I recommend doing research to find the best pricing if you are on a budget.

Here is a picture of the setup at VMworld US:


Here is a picture of the setup at VMworld EU:

[Read more...]