I have grabbed a list of the new commands added to vCLI 4.1, these command will help narrow the gap that had existed between what you could run on the ESX console (COS) and what you could do via the vCLI with an ESXi host. Notice the part at the end where it lists some of the commands that cannot be executed against a vCenter server for a host in lock down mode.

• vicfg-hostops – Allows you to examine, stop, and reboot hosts and to instruct hosts to enter and exit maintenance mode.
• vicfg-authconfig – Allows you to add an ESX/ESXi host to an Active Directory domain, remove the host, and list Active Directory domain information.
• vicfg-ipsec – Supports IPsec setup.

vSphere CLI 4.1 also includes the following new functionality:

• The following options have been added to esxcli:
  • esxcli swiscsi session – Manage iSCSI sessions.
  • esxcli swiscsi nic – Manage iSCSI network interfaces.
  • esxcli swiscsi vmknic – List VMkernel network interfaces available for binding to particular iSCSI adapter.
  • esxcli swiscsi vmnic – List available uplink adapters for use with a specified iSCSI adapter.
  • esxcli vaai device – Display information about devices claimed by the VMware VAAI (vStorage APIs for Array Integration) Filter Plugin.
  • esxcli corestorage – List devices or plugins. Used in conjunction with hardware acceleration.
  • esxcli network – List active connections or list active ARP table entries.
  • esxcli vms – List and forcibly stop virtual machines that do not respond to normal stop operations.
• Some of the parity issues between vSphere CLI and the ESX service console have been resolved.
• You can now run vCLI commands using SSPI (--passthroughauth) against both vCenter Server and ESX/ESXi systems.
• Lockdown mode allows vSphere administrators to block direct access to ESXi systems. With lockdown mode enabled, all operations must go through a vCenter Server system. The following commands cannot run against vCenter Server systems and can therefore not be used in lockdown mode:
  • vicfg-snmp
  • vifs
  • vicfg-user
  • vicfg-cfgbackup
  • vihostupdate
  • vmkfstools
  • esxcli
  • vicfg-ipsec

If you want to run these commands against an ESXi system, turn off lockdown mode using the vSphere Client.

You can view the VMware vSphere Configuration files from a browser using a link formatted like the following. https://hostname/host From that link you will need to authenticate to your host and then will be able to view a list of files from the host. In the list of files presented with be configuration files and some logs.

There is another page viewable with a web browser that will show you log messages from your ESX or ESXi host. Use the following syntax for the link.  https://hostname/host/messages

The release also adds support for mixed chargeback models. VKernel Chargeback 2.0 now supports both allocated and actual resource consumption models. By reporting on both measures, infrastructure teams can chargeback for actual resource consumption, allocated resources, or simply show application teams the difference in real dollars between their allocated capacity and actual usage. This cost visibility is critical to capacity management, reducing VM spral and supporting private cloud initiatives.

There are a couple of different ways that you can enable AD integration ( vSphere client, vCLI, scripting or Host Profiles). In this post I will cover the method through vSphere client.

Step 1: Connect to your host directly with the vSphere client. You are also suppose to be able to do this same method when connecting to vCenter server, but I have heard mixed results. I will try once my console is updated to vCenter 4.1. You then need to click on the Configuration Tab. Then select the “Advanced Services” selection from the Software box on the lower left. Then you click on the “Properties” link that is shown in the picture below.

Step 2: You will be presented with a Directory Services Configuration window that is shown below. In the select “Service Type” drop down you will need to select “Active Directory”.  The in the Domain field you need to type in the name of your domain that you will be connecting to. Next step is to click the “Join Domain” button and you will be presented with an authentication window shown in the next step.

Step 3: In this part you need to enter in credentials that will allow you to connect and join the ESXi Host to the domain. You can enter your credentials in the format listed below (Domain\user) or use this format ( administrator@test.com). I had more luck using the second option.

Step 4: After successfully entering your logon ID your ESXi host is added to the Domain. You can see from the image below my host was added to the default computer container since I did not specify another OU for them to be placed into.

Step 5: Now that your VMware host was added to the domain you can now add users or groups to the Permissions tab. You can see below once on the Permissions area you right click and select “Add Permission”

Step 6: In this step the Assign Permissions window has opened and you need to select the Administrator role from the section pointed out in the image below. Then click the Add button on the left side to pick your User or Group from the Active Directory connection.

Step 7: You first must select your Domain from the domain drop down list at the top of the window shown below.

Step 8: Once you have select the Domain that you integrated with you will be presented with a list of Users and Groups. You should select your User/Group and press the Add button and then click OK.

Step 9:  Now that you have added your Domain account or group you will see it in the lists of users as shown below.

Step 10: Once you have completed the steps above you will now be able to close your vSphere Client connection and connect back using your newly configured Active Directory Integration. Again you have two ways to enter your Domain credentials ( Domain\user or user@domain.com)

Step 11: Once your have logged in with your domain credentials you will be able to see in the lower right corner of the vSphere Client that you have authenticated with a Domain account.

Step 12:  Now the next step was to see which ways I could all use the new AD integration. From the picture below you can see that I was able to use the Domain logon to authenticate to ESXi 4.1 TSM (Tech Support Mode) from the console and from a remote SSH connection. I was able to use my id in the format shown below to authenticate but did not have any luck use the Domain\user format for these type of logons. This have have just been something in my lab so your mileage may vary.

Step 13: Lastly I wanted to see if I could authenticate to the DCUI ( Direct Console User Interface) of ESXi 4.1 using a Domain account. I was not able to have any success logging into the DCUI with the AD account using either format listed earlier. Which is kind of weird since I was able to use the AD logon for the TSM login form the console. If you had different results form this leave me a comment with what you did different I would love to hear.

Lastly I will be trying some of the others methods that I listed at the beginning for setting up the AD integration when I have some time. I will be sure to link them to this article. If you are curious you can see a very simplified version of this in the VMware KB article.

]]> http://www.virtualizetips.com/2010/07/configure-vmware-esxi-4-1-for-active-directory-integration/feed/ 0 http://www.virtualizetips.com/2010/07/there-is-a-password-authentication-bug-in-vmware-vsphere-esxi-4-1/ http://www.virtualizetips.com/2010/07/there-is-a-password-authentication-bug-in-vmware-vsphere-esxi-4-1/#comments Fri, 16 Jul 2010 02:12:08 +0000 Brian http://www.virtualizetips.com/?p=400 While doing my usual surfing in the VMware forums I came across a thread about a password issue with ESXi 4.1. The issue seems to be that the latest version of ESXi only looks at the first 8 digits of your password. So as long as you type in the first 8 digits of your password correct the rest does not matter. I was able to recreate this in my home lab using a 10 digit password.

So to make it crystal clear when I installed ESXi 4.1 with Build # 260247 I entered a 10 digit password for “root”. After the install and a reboot I was able to login using my password as expected. I then enabled TSM mode for local and SSH access. I was then able to log on using local or SSH as the method using my exact password, just the first 8 digits or the 8digits plus anything else after. I even tried entering the first 8 digits and several digits of random characters afterward and it still accepts the password.

I will post a follow up to this post once something is released from VMware regarding this password issue. Until then you can follow along with the thread over on the VMware forums if you wish.

Update July 19th, 2010

VMware released a KB article today that basically explains the issue but does not really offer a fix. It really looks like there will not be a fix and we will just be limited to 8 character passwords. VMware KB Article.

Currently only the operating systems listed below are the only 64 bit options support by the new vCenter 4.1 server.

Something new with this release is the vCenter Server Data Migration Tool. This new tool will help to migrate some of your data and settings over to a new server depending on what your configuration was. There are some very rigid rules on what it will and wont move across. The list below is the only options that it will migrate. Judging from that list every production setup I’ve ever seen is going to require the usual manual steps to be done. Since I don’t think anyone out there is using SQL express as their DB in anything other than maybe a small lab environment. Your gonna need to configure 64 bit DSN’s for your vCenter and Update Manger Databases on the new server yourself.

You can use the vCenter Data Migration Tool to automatically migrate the following to a new server:

• vCenter Server Software and its configuration
• vCenter Update Manager Software and its configuration
• VMware Orchestrator Software and its configuration
• The default SQL Express 2005 database that comes installed with vCenter Server.

To see the full details from VMware on this process refer to this article.

1. At the DCUI of the ESXi host, press F2 and provide credentials when prompted.
2. Scroll to Troubleshooting Options, and press Enter.
3. If you want to enable local TSM, select Local Tech Support and press Enter once. This allows users to login on the virtual console of the ESXi host.

   If you want to enable remote TSM, select Remote Tech Support (SSH) and press Enter once. This allows users to login via SSH on the virtual console of the ESXi host.

4. Optionally, if you want to configure the timeout for TSM:
5. 1. Select Modify Tech Support timeout and press Enter.
   2. Enter the desired timeout value in minutes and press Enter.
6. Press Esc three times to return to the main DCUI screen.

1. Select the host and click the Configuration tab.
2. Click Security profile > Properties.
3. Click Local Tech Support or Remote Tech Support (SSH) and click Options.
4. Choose the desired startup policy and click Start, then click OK.
5. Verify that the daemon selected in step 3 shows as running in the Services Properties window.

1. Select the host and click the Configuration tab.
2. Click Advanced Settings.
3. Change the UserVars.TSMTimeOut field to the desired value in minutes.
4. Click OK.

1. At the main DCUI screen, press ALT+F1 simultaneously. This opens a virtual console window to the host.
2. Provide credentials when prompted.

   Note: When typing the password, characters are not displayed on the console.

1. Open an SSH client.
2. Specify the IP address or domain name of the ESX host.

   Notes:

3. • Directions may vary depending on what SSH client you are using. For more information, consult vendor documentation and support.
   • By default, SSH works on TCP port 22.
4. Provide credentials when prompted.

• Scripted Install for ESXi. Scripted installation of ESXi to local and remote disks allows rapid deployment of ESXi to many machines. You can start the scripted installation with a CD-ROM drive or over the network by using PXE booting. You cannot use scripted installation to install ESXi to a USB device.
• vSphere Client Removal from ESX/ESXi Builds. For ESX and ESXi, the vSphere Client is available for download from the VMware Web site. It is no longer packaged with builds of ESX and ESXi. After installing ESX and ESXi, users are directed to the download page on the VMware Web site to get the compatible vSphere Client for that release. The vSphere Client is still packaged with builds of vCenter Server.

• Boot from SAN. vSphere 4.1 enables ESXi boot from SAN (BFN). iSCSI, FCoE, and Fibre Channel boot are supported. Refer to the Hardware Compatibility Guide for the latest list of NICs and Converged Adapters that are supported with iSCSI boot.
• Hardware Acceleration with vStorage APIs for Array Integration (VAAI). ESX can offload specific storage operations to compliant storage hardware. With storage hardware assistance, ESX performs these operations faster and consumes less CPU, memory, and storage fabric bandwidth.
• Storage Performance Statistics. vSphere 4.1 offers enhanced visibility into storage throughput and latency of hosts and virtual machines, and aids in troubleshooting storage performance issues. NFS statistics are now available in vCenter Server performance charts, as well as esxtop. New VMDK and datastore statistics are included. All statistics are available through the vSphere SDK.
• Storage I/O Control. This feature provides quality-of-service capabilities for storage I/O in the form of I/O shares and limits that are enforced across all virtual machines accessing a datastore, regardless of which host they are running on. Using Storage I/O Control, vSphere administrators can ensure that the most important virtual machines get adequate I/O resources even in times of congestion.
• Network I/O Control. Traffic-management controls allow flexible partitioning of physical NIC bandwidth between different traffic types, including virtual machine, vMotion, FT, and IP storage traffic (vNetwork Distributed Switch only).
• Lockdown Mode Enhancements. VMware ESXi 4.1 lockdown mode allows the administrator to tightly restrict access to the ESXi Direct Console User Interface (DCUI) and Tech Support Mode (TSM). When lockdown mode is enabled, DCUI access is restricted to the root user, while access to Tech Support Mode is completely disabled for all users. With lockdown mode enabled, access to the host for management or monitoring using CIM is possible only through vCenter Server. Direct access to the host using the vSphere Client is not permitted.
• Improved Support for Handling Recalled Patches in vCenter Update Manager. Update Manager 4.1 immediately sends critical notifications about recalled ESX and related patches. In addition, Update Manager prevents you from installing a recalled patch that you might have already downloaded. This feature also helps you identify hosts where recalled patches might already be installed.
• ESX/ESXi Active Directory Integration. Integration with Microsoft Active Directory allows seamless user authentication for ESX/ESXi. You can maintain users and groups in Active Directory for centralized user management and you can assign privileges to users or groups on ESX/ESXi hosts. In vSphere 4.1, integration with Active Directory allows you to roll out permission rules to hosts by using Host Profiles.
• Memory Compression. Compressed memory is a new level of the memory hierarchy, between RAM and disk. Slower than memory, but much faster than disk, compressed memory improves the performance of virtual machines when memory is under contention, because less virtual memory is swapped to disk.

You can see the full feature list on the VMware page, the list is pretty long.

For this I was testing things for my home lab and created this on my laptop just using Workstation 7.0. I created two virtual machines, one for the EDA appliance and one blank that will get ESX 4.0 installed from the Deployment script.

Step 1: Download the EDA appliance http://www.vmware.com/appliances/directory/va/89313/download

Step 2: Import the EDA virtual appliance into VMware workstation.

Step 3: After the input I had to add in a CD-Rom to the VM and attached the vSphere .iso file to the CD drive.

Step 4: You can then start up the EDA appliance and choose Reconfigure.

Step 5: Fill out your network information on the screen shown below. Then press enter or click on OK.

Step 6: You can now log into the configuration web page for the EDA appliance. In my configuration it was http://192.168.1.19
The default login for the page is root  -  root. You will be presented with several sections that will allow you to configure options for the install. I will briefly cover these parts as I did not change much on them for this test. The Post installation commands section allows you to script any custom changes or adds that you want to make for your install. The General settings section is used for basic network and disk settings for each install, this section is pretty easy to understand.

Step 7: Now you are ready to prepare the Host specific details. Refer to the image below as I describe the steps. You can either modify the sample host that is loaded by default. By clicking on the host name or selecting “new host” you will get a screen like the 2nd picture below. This will allow you to specify host name and IP addresses needed for your base install. Once created if you click on the “ks” link for the hostname you will see what the kick start file contains for commands.

Step 8: Now you will need to setup the options for the DHCP server. Upon clicking on the “configure DHCP server” link from the top menu you will be presented with the following configuration file. I highlighted a few of the important lines that I changed to work for my setup. You will need to make sure all of the normal DHCP options are set in this file.

Step 9: Now you will need to “import PXE files” so that you can boot the server that you will be installing ESX onto. You need to make sure that the ESX CD or .iso file is mounted to your EDA appliance. If the ESX disc or file is properly mounted you will see the confirmation in the top right just like the image below. Then you select the “Import PXE bootfiles” from the menu and you will see a screen like the second image below.

Step 10:  If you are using a physical server to install onto you can start now and have the machine PXE boot.
If you are going to use a virtual machine you need to create a VM with the proper OS select, disk size, memory and number of Nic’s that you wish to use. Once this is done you will see a screen like the one below you start the install. I trust that you know what settings need to be used for installing ESX into VMware workstation, if not there are plenty of good guides for it. If you are using Workstation 7.x the process is now built in and very easy to select from the OS choices.

Note: If you created multiple host install names you will get presented with the options and can type the name of the one you wish to install. I circled in red above as an example.

A few things to keep in mind for now. That SIOC is enabled per datastore, does not have a reservation limit at this time, only enforces limits when a threshold is reached and can enforce limits for IOPS when specified at the VM level.  Thanks to Duncan for these details.

In the images below you can get an idea of how Storage IO Control is working along with Shares applied to Virtual Machines to stop any VM from hogging all of the IO.

www.youtube.com/watch?v=5GN5f1u7pcc