DefinIT Because if IT were easy, everyone would do it…

12Sep/14Off

vCAC 6.0/6.1 build out to distributed model: Deploy the Identity Appliance

Posted by Sam McGeown

SSO is a fundamental requirement when deploying vCAC, whether for a distributed or simple installation. This walk through goes through the deployment and configuration of the vCAC Identity Appliance, which provides a stand alone SSO instance for vCAC.

Some of the posts in this series are completed with vCAC 6.0.1, others will be with 6.1. Where there are differences I will aim to point them out!

Deploying the OVF

Deploying the OVF is very simple, just run through the wizard:

image image

image image

image image

image image

The appliance will perform a reverse lookup to get it's hostname - if you have pre-staged a DNS A and PTR record, and have a reservation set for the VM. If you statically assign an IP address, make sure you use the FQDN in the hostname field - not doing so will cause issues with the self-signed certificates and also when you join the Active Directory domain.

11Sep/14Off

Configuring a remote access SSL VPN with VMware NSX

Posted by Sam McGeown

The NSX Edge Gateway comes pre-armed with the ability to provide an SSL VPN for remote access into your network. This isn't a new feature (SSL VPN was available in vCloud Networking and Security), but it's worth a run through. I'm configuring remote access to my Lab, since it's often useful to access it when on a client site, but traditional VPN connections are often blocked on corporate networks where HTTPS isn't.

30Aug/14Off

Fixing a couple of search/inventory service related errors with vCenter appliance 5.5 update 1c

Posted by Simon Eady

VMware.jpg

So recently I came across an error in the vSphere windows "fat client" when trying to use the search field.

login_to_query

 

 

 

 

 

So a quick look at the VMware knowledge base brought up the following article

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2063020

So I went ahead and followed the KB artricle and then tried to search again.. the following error was generated.

unable_to_connect_to

 

 

 

 

 

Also while logging into the vSphere web client the following error appears.

client_not_authen

 

 

 

 

I had access to the SSO components etc.. but vCenter and related objects were null, now I have seen this issue before when the in use domain account has not been added to the vCenter as an admin so I re-logged with the [email protected] account (which had no errors when logging in) and browsed through to the vCenter server permissions tab and I could see all of the appropriate accounts listed with the correct permissions.

23Jul/14Off

Installing SRM VNXe SRA – Failed to load SRA, ‘queryInfo’ didn’t return a response

Posted by Sam McGeown

Quick post to cover a fix for installing the VNXe SRA when you encounter the below error:

Failed to load SRA from 'C:/Program Files/VMware/VMware vCenter Site Recovery Manager/storage/sra/EMC VNXe SRA'. SRA command 'queryInfo' didn't return a response.

The components installed (in this order) are:

  1. vSphere 5.5
  2. SRM 5.5
  3. UNISphere CLI 1.5.4.1.0027-1
  4. VNXe SRA 5.0.0

The root cause is that the system locale is EN-GB rather than EN-US, however even changing the locale does not resolve the issue. The Java installation will still try and load an en_GB module and fail. The solution is as follows:

Edit “<SRM Install>\storage\sra\EMC VNXe SRA\command.pl” in notepad and replace:

system("jre/bin/java -jar EmcVNXeSra.jar");

with

system("jre/bin/java -Duser.country=US -Duser.language=en -jar EmcVNXeSra.jar");

Rescan the SRAs within SRM to load the VNXe adapter details.

23Jul/14Off

Configuring vCenter Orchestrator (vCO) with PowerShell over HTTPS with Kerberos Authentication

Posted by Sam McGeown

vCenter Orchestrator (vCO)As a PowerShell fan I find using the vCO PowerShell plugin makes my life a whole lot easier. What isn't easy however, is  the configuration of vCO and a PowerShell jump host. Having done it a few times, this is my method for ensuring a secure working connection using HTTPS and Kerberos.

Configure the Orchestrator Appliance

Since we’re planning on using Kerberos authentication, we’d better ensure that the time is correct AND syncs to the same source as the domain.

image

In order to configure Kerberos on the Orchestrator appliance you need to SSH in to the box and log in using your root credentials.

Create a new krb5.conf file under /usr/java/jre-vmware/lib/security/ using the following command:

vi /usr/java/jre-vmware/lib/security/krb5.conf

Enter the following, substituting your domain details, and the local domain controller for “kdc =”. Case is important here, so use caps where I have:

[libdefaults] 
        default_realm = DEFINIT.LOCAL 
[realms] 
        DEFINIT.LOCAL = { 
                kdc = dc-01.definit.local 
                default_domain = definit.local 
        } 
[domain_realms] 
        .definit.local=DEFINIT.LOCAL 
        definit.local=DEFINIT.LOCAL 
[logging] 
        kdc = FILE:/var/log/krb5/krb5kdc.log 
        admin_server = FILE:/var/log/krb5/kadmind.log 
        default = SYSLOG:NOTICE:DAEMON

Configure the PowerShell host

I’m configuring to use HTTPS with Kerberos authentication, so the first thing I need is a certificate with the Server Authentication (1.3.6.1.5.5.7.3.1) key usage. If you’re running a Microsoft PKI, the default Computer certificate template is perfect for this.

Open MMC and add the Certificates snap in for the Computer account, find your certificate and double-click to open. Select the Details tab and scroll to the bottom – copy the thumbprint value to use in the below command.

image

Enable WinRM with the following command:

winrm quickconfig

Increase the amount of memory allowed to be allocated to each executing PowerShell:

winrm set winrm/config/winrs @{MaxMemoryPerShellMB="2048"}

Create an HTTPS listener using the thumbprint and the following command:

winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="host_name";CertificateThumbprint="certificate_thumbprint"}

 

 

image

Finally, enable Kerberos authentication:

winrm set winrm/config/service/auth @{Kerberos="true"}

The PowerShell host is now listening on port HTTPS 5986 authenticated by Kerberos!

Test the WinRM connection

Using another computer on the same domain, run the following command to execute NSLookup on the PowerShell host:

winrs –r:https://mgmt-01.definit.local:5986 nslookup google.com

image

Adding a PowerShell host

The final step is to add a PowerShell host to Orchestrator. Open (or install first and then open) the Orchestrator client and connect to your vCO appliance. Make sure you’re connecting using your domain account (i.e. you need to pass your domain identity to the vCO appliance to use for authentication to the PowerShell host).

Specify a name for the PowerShell host (the hostname of the server is fine), the FQDN (best to use FQDN with Kerberos) and the port that we created the listener on – 5986 by default.

image

Select WinRM as the host type, HTTPS and do not accept all certificates, finally select Kerberos authentication.

image

Select “Session per user” to configure the remote host to use the workflow user’s identity. You can enter credentials for a shared session, but this could pose security risks if running as an elevated user.

image

Finish the wizard and wait until the workflow completes:

image

Now we have a PowerShell host added to vCO, we can run a PowerShell script against it over HTTPS and authenticated with Kerberos.

Running a Hello World PowerShell script in vCO

Firstly, lets create “Say-HelloWorld.ps1” script and save it in c:\SCRIPTS on the PowerShell host.

return “Hello World”

Next switch back to the Orchestrator client and select “Design” mode. Create a new folder to contain your workflows (mine is called “DefinIT”) and then create a new workflow (“Test-PowerShell-Hello-World”).

Select the “Workflow” tab and then expand “All Workflows” > Library > PowerShell, then drag the “Invoke an external script” onto the workflow editor:

image

Click on the “Setup” button:

image

Select the value radio button for the “host” binding and then click to select the PowerShell host from the inventory. Select value for the “externalScript” binding and enter the path to the hello world script we created earlier. Select script for the arguments, as we don’t have any. Leave the output binding as is.

image

Now we can run the workflow and select the “Logs” tab to see the output – you can see the “Hello World” that we returned is echoed in the logs.

image

Hopefully this has been a helpful kick-starter into using vCO PowerShell over HTTPS with Kerberos Authentication

Page 1 of 4512345...102030...Last »