This is the first article in a series of vSphere Security articles that I have planned. The majority of this article is based on vSphere/ESXi 5.1, though I will include any 5.5 information that I find relevant.
I think lockdown mode is a feature that is rarely understood, and even more rarely used. Researching this article I’ve already encountered several different definitions that weren’t quite right. As far as I can see there are no differences between lockdown more in 5.5 and 5.1.
The vSphere Security guide says (emphasis mine):
To increase the security of your ESXi hosts, you can put them in lockdown mode. In lockdown mode, all
operations must be performed through vCenter Server. Only the vpxuser user has authentication
permissions, no other users can perform operations against the host directly.
In short, lockdown mode means you can ONLY manage the host via vCenter. The only exception is via the DCUI.
John Troyer (@jtroyer) asked a question on Twitter last night about a CloudCred prize of $1000-2000:
@jtroyer a nice lab setup!
— Sam McGeown (@sammcgeown) September 19, 2013
@jtroyer I guess a couple of hosts, storage and a switch, wouldn't get HCL certified for that but I'm sure it's doable!
— Sam McGeown (@sammcgeown) September 19, 2013
South West VMware User Group: The Facts, The Figures, And The Events
The South West VMware User Group launches in the UK, bringing the best of VMware and the user community to The West, South West and South Wales.
The leadership team is pleased to announce the South West VMware User Group (VMUG). Meeting in Bristol at the crossroads to the South West, The West Country, South Wales and the Midlands, meetings will begin early in 2014, to bring together virtualization customers, end users and enthusiasts in an informal social setting for discussion, learning and engagement.
We are on Twitter, so please engage with us @SWVMUG or #SWVMUG. We also have a local presence on VMUG.com, where we will post meeting details and where you can register for a free account to sign-up for our up-coming meetings.
For our first meeting, we have some grand plans to open with a bang!
- Mystery guest ‘VMware Rockstar’ keynote speaker.
- Prizes and giveaways.
- VMware session.
- Sponsor session.
- Community homelab session.
- Local vBeers afterwards.
Regular announcements and updates will be posted on our Twitter account: @SWVMUG.
We are already planning our first meeting, but in the meantime we plan an online webinar on Tuesday 29th October with a VMworld highlight wrap-up, plus interviews about the forth-coming UKVMUG and an overview of plans for the first South West VMUG meeting. To view the webinar live (or play back the recording), checkout this link on Google Hangouts:
South West VMUG Webinar event at Google Hangouts: http://goo.gl/SrQqTd
Can’t wait till 2014 for our first meeting? Why not come to the national UKVMUG where all the members of the SWVMUG leadership team will be available to discuss the new group, what we have to offer, and how SWVMUG can enhance your VM experience. Look out for us in special RED t-shirts!
Can’t even wait till October? Join us for a Bristol vBeers! For details, follow @SWVMUG, the committee members or check http://www.vbeers.org for scheduling. We look forward to meeting you!
Who Are SWVMUG?
The Leadership Team of the new SWVMUG comprises:
- Jeremy Bowman (vSpecialist.co.uk, @jeremyjbowman)
- Simon Eady (definit.co.uk, @simoneady)
- Michael Poore (vSpecialist.co.uk, @mpoore)
- Barry Coombs (virtualisedreality.com, @virtualisedreal)
With vSphere 5.5 being announced at VMworld San Francisco I was very eager to see what was new and after devouring all of the great blog posts out there of the guys in attendance I wanted to summarize in my own way the aspects I think are great!
- VMDK 2TB limitation removed! (also virtual mode RDMs)
This has to be one of the best pieces of news as it has been in the rear trying to accommodate really large VMs (changes affect both VMFS and NFS)
IMPORTANT - You need to be running ESXi 5.5
You cannot grow the VMDK "hot" the VMDK must be offline. Also you must use the web client to make the changes beyond 2TB ( you will get a funky error message if you try with the .NET client)
- vSphere Flash Read Cache
I have been keeping an eye (where possible) since I heard it announced way back as vFlash by Cormac hogan at a VMUG meeting last year, so I was chuffed to bits to see it made the cut in 5.5 (From what I have read though thus far it is not as straight forward to deploy and use as PernixData's excellent product which I have had the pleasure in looking at and testing.)
- vSphere maximums
While the days of needing to know the maximums for the exams have pretty much gone, VMware are still eager to impress and with HyperV hot on it's tail VMware have certainly upped the ante..
Apparently its not a re-branding of VSA (which was not particularly popular) VSAN is a new way to make use of HOST mounted storage whether it be SSDs or HDDs and create a data store accross 8 Hosts (8 hosts being the present maximum)
This solution is quite appealing for some of what I do on a day to day basis, but I have yet to see how VMware will license it or which suite (if any it will fall into)
If you want a really great overview of all the new features and changes I would recommend reading the following blog post at WahlNetwork
Also VMware have the following PDF
After my previous post about studying and the exam experience of the VCAP5-DCA exam (and 3 weeks of waking up to check my phone for the email all night) I am pleased to say that I received my Exam Score last week and it was a pass! I was really pleased to see that I passed with a very decent margin too, which was great! The rushed nature of the exam and long wait for the results leaves you going over the exam in your head convincing yourself how badly you’ve done, so it came as a huge relief and surprise.
Next up, VCAP5-DCD – possibly even at VMworld Barcelona given that there is 75% off exams for attendees taking them on-site.
DefinIT @ VMworld Barcelona
I’m also very excited to say that fellow DefinIT blogger Simon (@simoneady) and myself will be heading off to Barcelona in October to our very first VMworld conference. Regular readers may have seen Simon won a V.I.P Tweet competition earlier this year, which was fantastic. I threw my name in the ring for a vExpert Blogger pass and was slightly stunned and very pleased when I received an email saying I’d been selected to go. For both Simon and myself VMworld has been something we have both wanted to attend but never really had the opportunity before, so we’re really looking forward to it!
There’s not a lot more to say than the title of this post – if you create a new Virtual Switch using PowerCLI without specifying the NumPorts parameter, it defaults to 64 ports. This strikes me as odd when the default for a standard switch is 120.
You can see in the screenshot below that when I create a Virtual Switch without the parameter, it creates it with 64 ports. Once you minus the 8 reserved for physical NIC ports (uplinks), CDP traffic, and network discovery it leaves you with 56 ports available for VMs.
Obviously this isn’t something that everyone will run into, 56 VMs on a host is a high consolidation ratio! But it caught us out this week with Virtual Machines and some weird network problems! Since changing a vSwitch’s number of ports requires a reboot I’ll be migrating these to a Distributed Switch (which I should have done a while ago anyway!) which will fix the problem with zero further downtime.
Just a quick note to say that I made it in to a recent book release as a contributor and naturally I am delighted and proud!
You can find out more here - vSphere Design Pocketbook
One of the many perks of being a vExpert is the cool vexpert.me URL shortener provided by Darren Woollard (@dawoo). There are several ways for vExperts to use it once they’ve signed up – there’s a PowerShell script by Jonathan Medd (@jonathanmedd) and Maish Saidel-Keesing (@maishsk) and now even a GUI interface based on the PowerShell.
One thing I wanted to do was to automate the short links for my WordPress installation, so before attempting to write a plugin myself I had a quick search for YOURLS, the software Darren uses to create access. I found “YOURLS Link Creator” by Andrew Norcross which did exactly that.
You’d be surprised how many times I see datastore that’s just been un-presented from hosts rather than decommissioned correctly – in one notable case I saw a distributed switch crippled for a whole cluster because the datastore in question was being used to store the VDS configuration.
This is the process that I follow to ensure datastores are decommissioned without any issues – they need to comply with these requirements
- No virtual machine resides on the datastore
- The datastore is not part of a Datastore Cluster
- The datastore is not managed by storage DRS
- Storage I/O control is disabled for this datastore
- The datastore is not used for vSphere HA heartbeat
I started the TrainSignal VMware vSphere Optimize and Scale (VCAP5-DCA) Training course as part of my preparation for taking the exam which I took at the beginning of this week - I'm still waiting to hear the results. One thing I found when I started preparing is that there is an overwhelming volume of information - the Exam Blueprint is a great place to start as that lays out what will be tested. There are 9 sections and 27 objectives laid out, with knowledge, skills and abilities and tools required for each objective. The volume can be overwhelming, even if you already know most of it!
I found the VMware vSphere Optimize and Scale (VCAP5-DCA) course provided me with a framework on which to hang these topics - it covers pretty much every objective in the blueprint directly and allows you to get a picture of what you already know and are confident on and areas where you need to really focus on learning. Once I identified areas to study I used a number of really helpful resources as well as the VMware documentation to boost my knowledge on those topics. Quite often I re-watched the relevant topic in the TrainSignal course, but most important of all is getting into the lab.