New Network port diagram for VMware vSphere 5.x

VMware released a new version of the network diagram, depicting ports in use for vSphere 5.x

You can download this diagram here, and here.

Network port diagram for vSphere 5

Changing password complexity ESX(i) 4

Some have noticed that the password requirements for ESXi 4.0 logins have become more stringent. In some cases, it may be desirable to edit those settings to make the password standards for ESXi 4.0 either stronger or weaker. Password requirements for ESXi are controlled by the file /etc/pam.d/common-password. Changes to this file will take effect immediately and will not require a reboot. The sticky bit for the file is enabled, so changes will be backed up into the system configuration backup file for the host. As this is not a supported changed, caution is advised and a system backup is recommended before making changes.

By default the common-password file will contain the following text and it is the min option (min=a1,a2,a3,a4,a5) that will control password complexity.

#%PAM-1.0
password requisite /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6
password sufficient /lib/security/$ISA/pam_unix.so use_authtok md5 shadow
password required /lib/security/$ISA/pam_deny.so

a1 is the password length for passwords that contain one character class. The character classes are lower case characters, upper cases characters, digits and other characters. a2 is the password length for passwords that contain 2 character classes. a3 is used for password phrases. a4 and a5 is the password length required when using 3 or 4 character classes. It should be noted that the first and last character of the password will not count towards the character class count. So the password of ‘Password’ will only have 1 character class, while the password of ‘PassWord’ will have 2.

Note: the values for a1 to a5 must be equal or smaller than the prior value, so min=8,7,7,6,5 will be valid, but min=7,8,9,8,7 will not be. If min=7,8,9,8,7 were used, the error ‘User name or password has an invalid format’ would be generated even if you used a single class password will a length of 7 or more characters.

Sample changes to password complexity

1) To reduce the minimum password length to 6 characters, set min=6,6,6,6,6. As noted above, the values used for a1 to a5 must not be larger than the prior value.

2) To disable the use of one or two class passwords, set min=disabled,disabled,8,8,6. Note that this setting, password of ‘Password1’ would not be valid as the character class count would only be one. A password of ‘pAssw0rd’ would have a class count of 3 and thus be acceptable with a length of 8.

3) To turn off the enforcing of strong passwords, use the enforce option. Valid values for the option are none, users and everyone. So if the common-password file is changed to the below, then a single character password will be allowed regardless of the settings for the min option.

#%PAM-1.0
password requisite /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6 enforce=none
password sufficient /lib/security/$ISA/pam_unix.so use_authtok md5 shadow
password required /lib/security/$ISA/pam_deny.so

Source: vm-help.com

ESXi 4 Enable SSH

ESXi 40 does ship with the ability to run SSH, but this is disabled by default (and is not supported). If you just need to access the console of ESXi, then you only need to perform steps 1 – 3.

1) At the console of the ESXi host, press ALT-F1 to access the console window.
2) Enter unsupported in the console and then press Enter. You will not see the text you type in.
3) If you typed in unsupported correctly, you will see the Tech Support Mode warning and a password prompt. Enter the password for the root login.
4) You should then see the prompt of ~ #. Edit the file inetd.conf (enter the command vi /etc/inetd.conf).
5) Find the lines that begins with #ssh and remove the #. Then save the file. If you’re new to using vi, then move the cursor down to #ssh line and then press the Insert key. Move the cursor over one space and then hit backspace to delete the #. Then press ESC and type in :wq to save the file and exit vi. If you make a mistake, you can press the ESC key and then type it :q! to quit vi without saving the file. Note: there are two lines for SSH with ESXi 4.0 now – one for regular IP and the other for IPv6. You should the line appropriate to the protocol you’ll use to access your host.
6) Once you’ve closed the vi editor, you can either restart the host or restart the inetd process. To restart inetd run ps | grep inetd to determine the process ID for the inetd process. The output of the command will be something like 1299 1299 busybox inetd, and the process ID is 1299. Then run kill -HUP
(kill -HUP 1299 in this example) and you’ll then be able to access the host via SSH.

Tip – with some applications like WinSCP, the default encryption cipher used is AES. If you change that to Blowfish you will likely see significantly faster transfers.

Changing the port for SSH

To change the port for SSH, edit the file /etc/services and change the SSH port listed in the file. Save the file and repeat step 6 above.

Enable Telnet

The steps are the same as with SSH, but you’ll remove the # from the 2 telnet entries in /etc/inetd.conf. Enabling telnet is not recommended if security is a concern.

You can also download an oem.tgz file which will enable SSH (and FTP). Copy the file to a datastore with the VI client and then to bootbank with the command cp /vmfs/volumes//oem.tgz /bootbank/oem.tgz and then reboot.

Enable SSH access for a non-root account

Use the following process to enable SSH access for a non-root account
1) Access SSH or the console with a root account.
2) Create a new account with the command useradd -M -d/ . This will set the home directory to / instead of requiring a /home directory.
3) Use the command passwd to set the password for your new login.
4) Edit the passwd file with vi /etc/passwd. For the entry for your new account, change the /bin/sh part to /bin/ash. Save the file and exit. See the example for the test1 user below.

root:x:0:0:Administrator:/:/bin/ash
nobody:x:99:99:Nobody:/:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/:/sbin/nologin
dcui:x:100:100:DCUI User:/:/sbin/nologin
daemon:x:2:2:daemon:/:/sbin/nologin
vimuser:x:12:20:vimuser:/sbin:/sbin/nologin
test1:x:500:500:Linux User,,,:/:/bin/ash

You should now be able to connect with SSH using this new account.

Disable SSH access for the root account

If you have created non-root accounts for SSH access you can also disable root access via SSH. Edit the /etc/inetd.conf file using the initial process on this page and add the option -w after the -i option. The line in inetd.conf will appear similar to the below.

ssh stream tcp nowait root /sbin/dropbearmulti dropbear ++min=0,swap,group=shell -i -w -K60

One you have made the change, save the file and run the kill -HUP command to restart the inetd process. You will now be able to login with a non-root account, but will get access denied if you use a root account. Once you have established a SSH session with your non-root account you can issue the command su – to switch to the root account.

Source : vm-help.com

Unable to Mount ISOs to VMs after vSphere 4.1 Upgrade

Some people are experiencing issues mounting ISO files to VMs after performing a vSphere 4.0 to 4.1 upgrade.  Symptom includes receiving the error message “The remote device on VMNAME connected to PathToISOFile is disconnected.”  after attempting to mount an ISO file from within the vSphere client.  This issue appears to be a client incompatibility issue related to co-existance of vSphere Client 4.0 and 4.1 on the same machine.  To resolve the issue:

  1. Uninstall vSphere Client 4.0
  2. Uninstall vSphere Host Update Utility 4.0 (if it is installed)
  3. Uninstall vSphere Client 4.1.
  4. Reinstall vSphere Client 4.1.
  5. Attempt to reconnect an ISO file to a VM using the vSphere Client.

I was experiencing this same issue and following the above steps cleared it up.  Hope this helps other people out there.

Source : Jargon Technology

Installing VMWare Tools in SLES CLI

In the VMWare Infrastructure Client select VM -> Install/Upgrade VMware Tools

In the CLI type the following

mkdir /media/cdrom
mount /dev/cdrom /media/cdrom
rpm -Uhv /media/cdrom/VMwareTools-3.5.0-{version}.i386.rpm
SuSEconfig
vmware-config-tools.pl ( If you’re getting gcc error’s check this post )
/etc/init.d/network stop
rmmod pcnet32
rmmod vmxnet
depmod -ae
modprobe vmxnet
/etc/init.d/network start

Done