WilliamLam.com

Default Password for vCenter SSO Admin Account on VCSA

by // 14 Comments

I thought I share this quick tidbit about the VCSA (vCenter Server Appliance) default password for the vCenter SSO Administrator account as I was just asked about it today and this was something I had research just earlier in the week. In the Windows version of vCenter SSO installation, users are prompted during the install to select a password for this account, you might have seen it show up as admin@System-Domain. For the VCSA, vCenter SSO is already installed and you might be wondering what the default password is?

Well, the answer is ... there is no default password. During the installation process, there is a random password that is generated and once the installation is complete, the password is then immediately removed. This is a good thing from a security perspective, by not having a default password set. This account is not only a vCenter SSO Administrator but it also the only account that has access to the internal RSA IMS system. You should definitely go in and set a password for this account after setting up your VCSA which can only be done through the vSphere Web Client.

Here are the steps:

1. Click on the Administration tab on the left hand side of the vSphere Web Client navigation bar.

2. Next click on "SSO Users ad Groups" and you should see the admin user account.

3. Lastly, you just need to right click and edit the user or select the pencil icon and set a password for the admin user account. Be sure to use a strong password, as there is a password validation before the system accepts the change.

Big thanks goes out to Michael Haines for helping me track down this answer about the default (or not so default) password for the admin account on the VCSA.

Configuring Additional Windows vSphere Web Client 5.1 Servers

by // 10 Comments

Did you know in vSphere 5.1, you can now configure multiple vSphere Web Client servers to multiple vCenter 5.1 Servers and get a single view of your entire infrastructure as well as provide redundancy to the vSphere Web Client? This is all made possible with the new vCenter SSO (Single Sign-On) and Lookup Service feature.

When you first install vCenter Server, you can install the vSphere Web Client on the same machine or you can install it on a separate machine. If you decide to install the vSphere Web Client on a separate system or add additional vSphere Web Client servers, you simply just need to point them to your main vCenter SSO instance.

Note: If you wish to re-point or re-register other vCenter Server components, there is nice VMware KB that goes over all the steps.

Before getting started, it is very important to ensure you have proper DNS resolution (forward / reverse working) on all your Windows servers.

If you are running Windows, when you install the vSphere Web Client, you will be brought to a screen to specify your SSO Administrator credentials (admin@System-Domain for windows) or (root for VCSA) as well as the Lookup Service URL which will be the same system running your vCenter SSO service.

Note: In my lab, I am using the VCSA for my vCenter Server as well as my SSO server, but this can also be a Windows vCenter Server and SSO Server.

You also have the ability to re-point your vSphere Web Client to another vCenter SSO server and you can do so by using the following script: C:\Program Files\VMware\Infrastructure\vSphereWebClient\scripts\client-repoint.bat To use the script, you just need to specify the new Lookup Service URL along with the SSO Administrator credentials.

C:\Program Files\VMware\Infrastructure\vSphereWebClient\scripts\client-repoint.bat https://172.30.0.181:7444/lookupservice/sdk root vmware

Once the script has finished registering with the new vCenter SSO server, you can now connect to the vSphere Web Client URL by going to https://[webclient-hostname-ip]:9443/vsphere-client and you now should be able to see all the vCenter Servers that have registered with the same vCenter SSO server.

Here is another view using the new VIN 1.2 (vSphere Infrastructure Navigator) to show that I have two vSphere Web Client servers (webclient 3 and webclient4) registered to my primary vCenter SSO Server (vcenter51-1) as well as two additional vCenter Server (vcenter51-2 and vcenter51-3) that are also registered with the same SSO Server.

As you can see this provides me with single view of all my vCenter Servers and I can now connect to either vSphere Web Client servers which can be used for both load balancing as well as redundancy. You probably might have guessed, the next logical step is to put an actual load balancer in front of multiple vSphere Web Clients and simply expose a single entry point for your end users .... stay tune 🙂

FYI - If you are interested in using the VCSA and only enabling the vSphere Web Client feature, the process is slightly different and I will share the procedure in a separate post.

A Pretty Cool Method of Upgrading to ESXi 5.1

by // 44 Comments

I recently came across an interesting article by Andreas Peetz which shows you how to patch an ESXi host using an image profile that is directly available on VMware's online depot within the ESXi shell. I knew that VMware had online depots for use with VUM and Auto Deploy but I was not aware of this particular method, especially directly from the host.

Disclaimer: This method assumes you can install the default ESXi Image Profile with no additional drivers or packages, else you may have connectivity issue after the upgrade. If you still need to customize the ESXi Image Profile before installation, you will still need to use something like Image Builder and then upload that to your online depot.

Note: There are many ways that you can patch/upgrade your ESXi hosts, here is another article that provides more details for command-line only methods.

Before you get started, you will need to make sure that your ESXi host has the httpClient firewall rule enabled, else you will not be able to connect to VMware's online depot. To enable this, run the following ESXCLI command:

esxcli network firewall ruleset set -e true -r httpClient

Also make sure that your ESXi host can reach the following URL (you can specify a proxy if needed):

https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml

To view the available ESXi Image Profiles, run the following ESXCLI command (use the --proxy if you need to specify a proxy to reach VMware's online depot):

esxcli software sources profile list -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml

If you are able to successfully connect to the online depot, you see a list of all the ESXi Image Profiles that are available to you. You will see two ESXi 5.1 Image Profiles (these were recently published), one with VMware Tools and one without VMware Tools.

Note: Before you begin, make sure you do not have any running VMs and put your host into maintenance mode.

Let's go ahead and upgrade our ESXi 5.0 Update 1 host to latest ESXi 5.1. To install the new Image Profile, run the following command:

esxcli software profile update -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml -p ESXi-5.1.0-799733-standard

This can take a few minutes to complete depending on how fast you can pull down the Image Profile. Once it is done, you will see all the new VIBs that have been updated and you will be asked to reboot for the changes to go into effect and then you will be running ESXi 5.1! Pretty cool IMO!