ESXi Security Service Configurator (PowerCLI)

4 08 2012

Personally, I get annoyed when I have to dig through the vSphere Client GUI to turn on or off certain ESXi services on a regular basis. Since admins are generally on top of it in terms of following good security standards, I see Lockdown Mode on and SSH off by default on their ESXi hosts in many environments. When troubleshooting issues or configuring certain VMware-integrated products (such as HyTrust Appliance), it is sometimes necessary to temporarily undo this setup (enable SSH and disable Lockdown Mode).

The tool linked below can be used to turn on or off SSH and/or Lockdown Mode for a single host or all hosts in the environment. As usual, feel free to use all, some, or none of the code. I’m hoping to add additional services to it in the future, but these two are consistently needing to be toggled…

http://db.tt/dCanI8Fx

What it looks like in action:

Advertisements




Find virtual machine snapshots with PowerCLI

2 10 2011

Run from a PowerCLI session connected to a vCenter environment to find and list all of the snapshots (and users  who took them, which Get-VM | Get-Snapshot won’t do) on your managed ESX/ESXi hosts:

$myVMs = Get-VM
$VMsWithSnaps = @()
foreach ($vm in $myVMs) {
    $vmView = $vm | Get-View
    if ($vmView.snapshot -ne $null) {
        Write-Host "VM $vm has a snapshot"
        $SnapshotEvents = Get-VIEvent -Entity $vm -type info -MaxSamples 1000 | Where { 
            $_.FullFormattedMessage.contains("Create virtual machine snapshot")}
        try {
        $user = $SnapshotEvents[0].UserName
        $time = $SnapshotEvents[0].CreatedTime
        } catch [System.Exception] {
            $user = $SnapshotEvents.UserName
            $time = $SnapshotEvents.CreatedTime
        }
        $VMInfo = “” | Select "VM","CreationDate","User"
        $VMInfo."VM" = $vm.Name
        $VMInfo."CreationDate" = $time
        $VMInfo."User" = $user
        $VMsWithSnaps += $VMInfo
    }
}
$VMsWithSnaps | Sort CreationDate




Implementing the HyTrust Appliance – Part 3

16 08 2011

Roles, Rules, & Constraints (Oh my.)

IMO, the flagship features of the HyTrust Appliance (HTA) are the additions to the default vCenter Server security mechanisms through a more granular set of access controls to the virtual environment.  As always, a layered approach to security is ideal, and use of the appliance provides just that. For more background, check out my previous posts on the HTA:

Implementing the HyTrust Appliance – Part 1 (deployment, configuration considerations)

Implementing the HyTrust Appliance – Part 2 (compliance templates, root password vaulting)

Read the rest of this entry »





Implementing the HyTrust Appliance – Part 2

29 03 2011

Last time I went into our deployment of the HyTrust Appliance (HTA), some configuration considerations, and setting up the appliance for centralized authentication using Active Directory.  For this post I will talk a bit about our use of host compliance templates and, my favorite feature, root password vaulting. Read the rest of this entry »





Implementing the HyTrust Appliance – Part 1

25 02 2011

It happened for our Windows infrastructure several years ago, and now it’s happening at the hardware virtualization layer – we’re too big for our britches and lack a solid methodology for monitoring, securing, and maintaining our vSphere systems as we continue to expand.  Originally, I approached HyTrust regarding their HyTrust Appliance (HTA) primarily as a means to implement two-factor authentication for the virtual infrastructure via RSA SecureID.  Our RSA/two-factor project is in limbo, but I quickly realized that HyTrust had much more to offer us than just two-factor authentication.  Their implementation of host configuration templates alone has made it worth the purchase, not to mention the granular access policies and auditing, and root password vaulting (my favorite).  Over a couple of posts, I hope to relay some of the implementation trials, tribulations, and successful milestones as we roll the HTA into production and start to get a better handle on our environment.

Read the rest of this entry »





Upcoming Feature: vCenter Connector

10 02 2011

Just read about this yesterday and thought I would share for anyone that missed it.  If you’re in a VMware environment, this (not-yet-released) free plugin will allow you to create a hybrid cloud infrastructure by managing your outsourced virtual machines the same way as your internal ones.  Also, if the external vendor supports import/export via the OVF format, you will be able to cold migrate VMs between the private and public clouds.  More info here:

http://blogs.vmware.com/rethinkit/2011/02/vcloud-connector-makes-hybrid-cloud-management-easy.html

and here’s the official press release:

http://www.vmware.com/company/news/releases/vcdc-feb2011.html

Available soon!





Disappearing datastores and SCSI reservation conflicts

18 11 2010

A customer support ticket I got today started out with perceived latency, ended up with a rescan of HBAs that dropped a datastore, & left me at my wit’s end.  After banging my head against the wall all day I finally broke down & called VMware  Support.  According to the tech,   using Microsoft Clustering can greatly increase the likelihood  of SCSI reservation conflicts  in an ESX cluster, which can result in the symptoms I was  seeing.  This is the only cluster we have where MSCS is even running.

Luckily for me, this is a well-known problem with a well-documented solution:

http://kb.vmware.com/kb/1002293

(this cluster consists of ESXi 4.0 U1 hosts)