Written by Sam McGeown on 14/3/2019 · Read in about 4 min (725 words)
Published under VMware and vSphere

Most vSphere admins are more than comfortable with using Update Manager to download patches and update their environment, but few that I talk to actually know a huge amount about the Update Mangaer Download Service (UMDS). UMDS is tool you can install to download patches (and third party VIBs - I’ll get to that) for Update Manager and it’s useful for environments that don’t have access to the internet, or air-gapped, and also for environments with multiple vCenter Servers where you don’t necessarily want to download the same patch on every server. You can control which patches you download (for example, limiting to ESXi 6.7+ only) and you can add third party Vendor repositories (e.g. Dell or HPE).

I’m going to install UMDS on a Linux VM, download the VMware, HPE and Dell patches and then publish those internally on an SSL secured site using NGINX. The high level process is:

  • Deploy the UMDS server
  • Install UMDS
  • Configure UMDS
  • Install NGINX
  • Configure vCenter

Deploy the UMDS server

I’ve deployed a CentOS7 VM from a template and added a big data drive for the UMDS data (this makes it easier to extend later if I need to). Check out the currently supported Linux operating systems for UMDS for 6.5 and 6.7.

Note: for vSphere 6.7u1, VMware dropped the requirement for a PostgreSQL database

  • Format the data drive and mount to /umds
  • Install PostgreSQL 9.4
1yum install
2yum install postgresql94 postgresql94-server postgresql94-odbc
3/usr/pgsql-9.4/bin/postgresql94-setup initdb
4systemctl enable postgresql-9.4
5systemctl start postgresql-9.4
  • Create a UMDS user and database
1su - postgres
2createdb <database_name>;
3createuser -d -e -r <database_username>; -P
4Pwd: <database_password>;
  • Edit /var/lib/pgsql/9.4/data/pg_hba.conf and change local, IPv4 and IPv6 to use md5 authentication (not ideal, but it works)
 1# TYPE  DATABASE        USER            ADDRESS                 METHOD
 2# "local" is for Unix domain socket connections only
 3local   all             all                                     md5
 4# IPv4 local connections:
 5host    all             all               md5
 6# IPv6 local connections:
 7host    all             all             ::1/128                 md5
 8# Allow replication connections from localhost, by a user with the
 9# replication privilege.
10#local   replication     postgres                                peer
11#host    replication     postgres            ident
12#host    replication     postgres        ::1/128                 ident
  • Edit /etc/odbcinst.ini to use the ODBC driver
2Description=PostgreSQL ODBC driver (Unicode version)
  • Create the ODBC DSN /etc/odbc.ini
 2Driver = PostgreSQL
 3DSN = <dsn_name>
 4ServerName = localhost
 5PortNumber = 5432
 6Server = localhost
 7Port = 5432
 8UserID = <database_username>;
 9User = <database_username>;
10Database = <database_name>;
  • Validate the connection using isql -v UMDS_DSN &lt;database_username&gt; <database_password>;

Install UMDS

Next, mount the vCenter Server Appliance ISO file, copy the UMDS installer tar.gz file into the /umds folder and extract the installer. When this is complete there should be a vmware-umds-distrib folder.

1mkdir /mnt/cdrom
2mount /dev/cdrom /mnt/cdrom
3cp /mnt/cdrom/umds/VMware-UMDS-6.7.0-8169861.tar.gz /umds/VMware-UMDS-6.7.0-8169861.tar.gz
4cd /umds
5tar xvzf VMware-UMDS-6.7.0-8169861.tar.gz
6umount /mnt/cdrom

Run the UMDS installation script /umds/vmware-umds-distrib/

  • Accept the EULA
  • Enter the install location (/umds/vmware-umds)
  • Configure proxy (you can configure it later if required)
  • Enter the patch location (/umds/vmware-umds-patches)
  • Configure database connection using <dsn_name>, <database_username> and <database_password>

Configure UMDS

  • View the current configuration
1/umds/vmware-umds/bin/vmware-umds -G
  • Disable older patches (I just want 6.7)
1/umds/vmware-umds/bin/vmware-umds -S -d embeddedEsx-6.0.0 embeddedEsx-6.5.0 embeddedEsx-6.6.1 embeddedEsx-6.6.2 embeddedEsx-6.6.3
  • Add the Dell and HPE repositories
1/umds/vmware-umds/bin/vmware-umds -S --add-url --url-type HOST
2/umds/vmware-umds/bin/vmware-umds -S --add-url --url-type HOST
  • Fix the SSL errors (use the local lib curl binary)
1mv /usr/local/vmware-umds/lib/ /usr/local/vmware-umds/lib/
2ln -s /usr/lib64/ /usr/local/vmware-umds/lib/
  • Download the updates
1/umds/vmware-umds/bin/vmware-umds -D

Install NGINX

  • Install and start nginx
1yum install epel-release
2yum install nginx
3sudo systemctl start nginx
4sudo systemctl enable nginx
  • Configure the firewall for HTTPS
1firewall-cmd --permanent --add-port=443/tcp
2firewall-cmd --reload
  • Generate SSL certificates
1mkdir /etc/nginx/ssl-certs/
2openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl-certs/umds.key -out /etc/nginx/ssl-certs/umds.crt

  • Create an NGINX config file for UMDS - /etc/nginx/conf.d/umds.conf
 1server {
 2    listen 443 ssl;ssl on;
 3    ssl_certificate /etc/nginx/ssl-certs/umds.crt;
 4    ssl_trusted_certificate /etc/nginx/ssl-certs/umds.crt;
 5    ssl_certificate_key /etc/nginx/ssl-certs/umds.key;
 7    server_name umds.definit.local;
 8    root /umds/vmware-umds-patches;
 9    index index.html;
10    location / {
11        autoindex on;
12        try_files $uri $uri/ =404;
13    }
  • Restart NGINX - systemctl restart nginx

Configure vCenter Update Manager

  • Add the certificate to vCenter trust - log in to vCenter and navigate to Administration > Certificate Management
  • Log in as [email protected]

  • Under Trusted Root Certificates click ADD and upload the generated umds.crt
  • Navigate to Update Manager > Settings > Patch Setup and click Change Download Source - enter the UMDS web server

  • Navigate to Patch Downloads > DOWNLOAD NOW
Share this post