Changing Virtual Center Server Permissions

By default, when you create a Virtual Center Server installation or vCenter Server the administrators group of the PC you install on becomes the Administrators of the application. At my work the result of that is that the AD Domain administrator group is the administrors group.

But that doesn't have to be the case

The following is an extract from a VMware resource on Virtual Center Server permissions.

• VirtualCenter runs as a user that requires local administrator
privilege and must be installed by a local administrative user. However, to limit the scope of administrative access, avoid using the Windows Administrator user to operate VirtualCenter after you install it. Instead, use a dedicated VirtualCenter administrator account. To do so, take the following
steps:
1. Create an ordinary user account that will be used to manage VirtualCenter, for example, the VI Admin user. Make sure that this user does not belong to any local groups, such as Users or Administrators. This precaution ensures that any future role assignments involving a local group does not inadvertently affect this account.
2. In VirtualCenter, log on as the Windows Administrator, then grant the role of Administrator (that is, the global VirtualCenter administrator) to the newly created account on the top-level Hosts and Clusters folder.
3. Log out of VirtualCenter, then make sure you can log in to VirtualCenter as the new user and that this user is able to perform all tasks available to a VirtualCenter administrator.
4. Remove the permissions in VirtualCenter for the local Administrators group.
By configuring accounts in this way, you avoid automatically giving administrative access to domain administrators, who typically belong to the local Administrators group. You also provide a way of getting into VirtualCenter when the domain controller is down, because the local VirtualCenter administrator account does not require remote authentication.


There certainly can be a benefit to adding in some local users to the administrator's group on the Virtual Center Server. Which is what we had originally done. If something happens to the AD, you will still be able to access the VMware environment. Although hopefully, some thought will be being given to recovering AD. That account was then automatically inherited as an Administrator. However, it is just as easy to create another group within the domain and then provide that account with the permission of Administrator from the top level down - ensuring that that permission propagates down to child nodes.

This post needs some screen shots, but otherwise that's that.

Webmin Usage

I almost called this post "Deskilling in IT #2", but I've changed my mind. My previous blog about deskilling dealt more about my change in attitude to the way to build and deploy customised server. With this blog it is really the manner in which the web interface is an enabler of complex server configuration without knowledge of the underlying command line options.

To set the scene, I had an rPath Mediawiki appliance which was configured to provide 4 separate wikis. The conary package management system had stopped working some time ago.- possibly something I did - and every now and again was filling up the / partition (the only partition). I couldn't add SNMP to it - well not easily. So remote management was fraught!

To resolve the issues, I built a new CentOS Linux v5.4 server with Apache and MySQL installed; configured SNMP so it could be added into our Zenoss monitoring system; copied the last night's mysqldump backup files across to the new server; copied the webpages across; copied the appropriate .conf files to /etc/httpd/conf.d/; installed webmin.
Through webmin, I then:

• created new databases for each of the wikis;
• added the individual database users for the wikis;
• added the database access rules for each of the database users
• loaded the tables and data from the previous nights backup
• started the Apache service

All that took only a few minutes. And it was up and working.
Obviously starting the Apache service was simply a "service httpd start" with possibly a "chkconfig httpd on" beforehand.
The database actions are not beyond my wit to discover, either by reading the documentation on the MySQL website or indeed in terms of going through the source code for webmin and the mysql module. But with webmin, I did not have to either look them up online or in my notebook.

Perhaps, the only thing that seemed to be harder to configure through webmin is the iptables based Firewall. I much preferred to just edit the /etc/sysconfig/iptables file and enter service iptables restart. Myabe that is because generally, the edits I make are pretty simple involving only copy and pastes of lines and then just changing the port number.

Webmin makes it easier to administer many parts of *nix systems if you already know what you are doing. If you do not know what you are doing, it is just as difficult as previously.

I like webmin's facility to create links from one webmin installation to one or more other installations. My zenoss server is also a ssh jump server to other *nix systems, particularly those in the local DMZ. Making it also a console for the webmin consoles is just a logicial next step. Although to increase security even further, I'm considering tunnelling the access to the webmin port 10000 though SSH.

Wah!!

Not "Working At Home!" - I've lost a Memory stick. One that looks like:  Amazon's instant order update has just let me know I bought it back in August, 2008. Quite a nice new feature I haven't noticed before.

And I cannot even remember what is on the damn thing. Eugh! Whatever was on there was probably my only copy! Aarrgghh! I'm just hoping it wasn't really important. Which has really started to get me worried.

What is even more embarrassing is that I was reading this article a few days ago and was feeling very smug about myself. D'Oh!

As a replacement I'm getting one of these: A Hypertec 16GB Slimline Hyperdrive Storage 256 bit AES Encrypted. It is a compromise between having a convenient mobile storage solution and security. Although maybe I'm making a mistake going for an even larger size than the one I lost.

Of course, what I would really like is one of these: Ironkey 4GB Personal Edition with 1 Year Internet Protection. I'm quietly drooling just thinking about it. Sad, huh! Although the Secure-USB site looks like a better place to buy it.

That said, I'm planning on completely changing how I use these memory sticks. As you'll see on another posting, I'm updating my home storage and intend to religiously follow a procedure of backing up the memory stick to that storage every day that I load something onto this new memory stick.

One of the other secure memory sticks that I looked at before deciding on the Hypertec product claimed to have software that would update/replicate the information on the stick automatically. Because of poor reviews for that line of memory sticks I chose not to purchase one of those, but I hope to emulate that functionality using a version of rsync for windows or a variant therof. There is also a shareway program I heard about via the MajorGeeks website called Oops!Backup which sounds really interesting. If I cannot home-brew the functionality I want. I'll look at that program.

Yesterday's UserFriendly

I know the current set of cartoons on Userfriendly are repeats - it says so in the top right corner afterall. But Yesterday's cartoon was so funny.

At least, it was funny to this old UNIX user/manager/<wannabe hacker>.

Smart Pen de-box

My Livescribe 4GB Pulse Smartpen arrived yesterday! WooHoo!

The smart pen is as chunky as I expected, but at least in the short term not uncomfortably so. I had also ordered the Livescribe ANA-00004 Lined Black 1-2 Journal - 2 Pack, but they are only A5 size. I had expected them to be A4 size, but on reflection I think I might prefer them the smaller size.

Upon opening the box, it contains the smart pen, the cradle and its USB connection, headphones with built-in microphones and a carry-pouch which is shaped a little like a cigar container.

Hidden under the combined headphones/microphones is a surprisingly short and narrow refill for the pen. Given that your written notes should essentially be bookmarks to specific points in the audio recording that small size might not be so much of an issue. Here's hoping anyway.

The package also included a notepad, which is useful as a starting point and and a couple of thin manuals to describe the usage. There really is no need for any more.

So far, it's all looking good.

vReference Card

The excellent VMReferemce Card site has been updated for v4 and now has the URL: www.vreference.com.

As well as an updated VMware reference card there is also a reference card showing all the ports used by various VMware services, which has been called the firewall card.

I am especially pleased to see the firewall diagram. The firewalls are controlled by a separate team at my company and they are not always the most flexible of guys. Haha. Every change to the firewall has to be raised on a form, signed off by Directors and/or VPs, and faxed through to the corporate HQ, where it is saved in a DB. All that before they do anything. Occasionally they'll actually help out testing what is actually needed, but generally they are a PITA.

Most of the ports are indeed documented within Manuals. However, certainly with the Vi3 documentation, I was disappointed by the quality of that documentation. Ports would be listed at required with the inference it was only one way and solely one of TCP or UDP. Unfortunately, some experimentation demonstrated that that might not actually be the case. A port needed to be open in both directions, TCP in one direction and UDP in the reverse!

Anyway having all that information so clearly documented here will be a great help going forward.

That's that!

Livescribe Pulse Smart Pen

So the company I work for is being taken over. I have the prospect of lots of really interesting meetings with HR and representatives of the company buying us.

I was wondering how I was going to record them as accurately as possible. Whether to use a personal dictaphone or similar. However, I've decided to get one of these: a Livescribe 4GB Titanium Pulse Smartpen (APA-00004).

There are plenty of video clips showing how they are used. And I must say they seem pretty useful. My only slight reservation is the size/diameter of the pen, but I'm sure I'll get used to it. After all the idea is to write only bullet points that can be used as bookmarks for the recording.

The Company President uses one of these. He told the Senior Director of IT who sits locally to me, who now also has one. One of my colleagues bought one the other day. And I have ordered one today.

There is a slightly cheaper option with only 2GB - Livescribe 2GB Pulse Smartpen (APA-00002)- of memory as opposed to the 4GB option above and plenty of different stationery and pen refills options.

The full range can be seen at the manufacturer's website: www/livescribe.com.

And that's that.