WilliamLam.com

Quick Tip - Block or remove download URL for VMware Enhanced Authentication Plug-in (EAP)

by // 19 Comments

There was a new VMware Security Advisory (VMSA-2024-0003) that was published this week that affects the deprecated VMware Enhanced Authentication Plug-in (EAP) and as part of the remediation, per VMware KB 96442, there are instructions on how to uninstall the EAP plugin from desktop systems that had it installed.

I also noticed there were also questions from the community about disabling the EAP download itself, which is available as a hyperlink from the vSphere UI login page as shown in the screenshot below.


Having spent some time exploring and customizing the vSphere UI login page back in 2015, I knew there were a few ways of either blocking and/or removing the download URL all together, so I figure I would put together the list of options depending on what users were comfortable with.

[Read more...]

Automating certificate-manager CLI operations in vCenter Server (VCSA)

by // 3 Comments

I recently had a customer inquiry where they were interested in automating the certificate replacement for vCenter Solution Users when using the /usr/lib/vmware-vmca/bin/certificate-manager CLI, which is found within the vCenter Server Appliance (VCSA).


Note: One important thing to understand is that with vSphere 7.0, the vCenter Solution User certificates have been deprecated and the ability to replace the internal certificates will be removed in a future release as mentioned in the referenced vSphere blog post.

VMware does not recommend replacing the internal vCenter Solution User certificates, but for users who may have an organization requirement to do so, the operation is performed interactively using the certificate-manager CLI as mentioned earlier.

By design, the certificate-manager is meant to be consumed interactively and any non-interactive or automated use cases is not possible ...

[Read more...]

Google Chat space notification for failed vCenter Server Appliance (VCSA) backups using VEBA

by // Leave a Comment

It is always good idea to verify that your vCenter Server Appliance (VCSA) backups are occurring and if there are any failures, you are notified about them immediately!

As alluded to at the end of that blog post, you can easily build event-driven automation using the popular VMware Event Broker Appliance (VEBA) solution, triggering notifications based on several types of VCSA backup events:

  • com.vmware.applmgmt.backup.job.failed.event
  • com.vmware.applmgmt.backup.job.finished.event
  • com.vmware.applmgmt.backup.job.start.event

I recently built a PowerShell function that would send a notification to a Google Chat space by enabling their incoming webhook integration as you can seen from the screenshot below:


While the message customization is not as extensive as using Slack (e.g. supporting advanced layouts and emoji), it does get the job done and you will know immediately when a backup has failed or when it has started or has completed.

Note: For existing VEBA users (pre-v0.8 release), the function.yaml needs to be updated to trigger off of the subject keyword rather than the type, which is due to replacing the event router with Tanzu Sources for vSphere. You also need to ensure the prefix of "com.vmware.vsphere" is removed along with trailing "v0" as this is the next syntax for vCenter Events once VEBA v0.8 is released.

spec:
  broker: default
  filter:
    attributes:
      subject: com.vmware.applmgmt.backup.job.failed.event