Today let’s talk about the AD Integration with ESX 3.5
I believe most of you have to, at least once, to log in the ESX console for some troubleshooting, some third part app installation or maintenance, whatsoever.
You can do this with root account.
But you don’t want to share it’s password with dozens of administrators of your company. The auditors will be pulling their hairs off if you do that.
The best practice is to disable the remote access (SSH) for the root account.
Edit the /etc/ssh/sshd_config file
And change the PermitRootLogin from yes to no
Restart the sshd service
Now you should be safe ; )
But you still need the capability of login remotely, right ?!?
Here’s the thing:
- create a local account, with blank password, where the ID’s match the ID’s on your AD
run: useradd bob
there are a few options for group, comments, shell, etc.. (Check useradd man page for all options)
now that you have your accounts create locally you can set up LDAP redirection to your domain.
Run:
esxcfg-auth --enablead --addomain=example.com --addc=dc1.example.com
now you should be able to login through a SSH session with the ID and password from your AD domain.
Now you realized you cannot run the command which require admin privileges.
It’s time to tweak the /etc/sudoers file. Use VISUDO to do that.
if you have doubts, here’s the SUDO website about it.
Next post I will talk about the Active Directory integration with ESX 4.x
Who am I

- Eduardo Meirelles da Rocha
- I’m an IT specialist with over 15 years of experience, working from IT infrastructure to management products, troubleshooting and project management skills from medium to large environments. Nowadays I'm working for VMware as a Consulting Architect, helping customers to embrace the Cloud Era and make them successfully on their journey. Despite the fact I'm a VMware employee these postings reflect my own opinion and do not represents VMware's position, strategies or opinions. Reach me at @dumeirell
Most Viewed Posts
-
vRealize Automation 7.1 brings several new features and functionalities, while the community is covering the fanciest...
-
For the past few days my vRealize Automation Cloud has been broken, mainly because there was an error with my Cloud Proxy preventing it to...
-
I have to admit since I started playing with PowerCLI I’ve been enjoying it more and more. A few weeks ago I needed to delete 50 VMs from t...
-
If you just install VMware Converter and start running it with it’s default configuration, I’m sure you will be successfully. But, the...
-
Have you tried to set up or change a root's password for an ESXi host and got the following error message: Weak...
-
Day two of a VMware NSX implementation and I was surrounded by angry network guys asking me: “ What have you done ? ” As scare as...
-
During the past few weeks, my NSX partner in crime, the Sr. Consultant Anderson Duboc and I have been working on a NSX Reference Poster...
-
Do you know the LUNs on your environment might have different versions ? Yeah, that’s true!! To check tha LUN version, on the configuratio...
-
I've been playing with Tanzu Kubernetes Cluster (TKC) on vSphere with Tanzu since vSphere 7.0 GA, recently, to be honest, have bee...
-
While working with one of my customers to deploy a new automation platform ( vRealize Automation ), which will provide and manage multi-clo...
No comments:
Post a Comment