One great thing about running an ESX server is managing it through VIC or the included web client. The great thing about VIC and the web client is you can create users and roles and delegate administrative task to other people.
By default, the users you create are users on the ESX server. You can integrate these users with Active Directory eliminating the need to manage multiple passwords for the same user.
In this scenario we want to create on user, vmglobal, that can reset any VM on one ESX host. If you wanted, you could create multiple users that had access to only specific VMs. For now, vmglobal is all we need so that anyone can reset their VM.
Step 1 - SSH into the ESX console. Verify the date and time are accurate within 5 minutes of your DC. You can do this by running:
date
If you need to set up a time server on the ESX host you can point it to your DC or an external time server.
This can be done via the CLI or directly from the VIC. If you connect to the ESX host with VIC and go to the Configuration tab of the ESX host and choose Time Configuration you can setup and verify the time server. You will also want to make sure NTP is allowed through the firewall which can be done on the Configuration tab under Security Profile.
Step 2 - enable and configure Active Directory integration
Run the following to configure Active Directory integration:
esxcfg-auth –-enablead –-addomain=yourdomain.com –-addc=yourdc
For addc you can put the IP of your DC
Step 3 - configure the firewall to allow Active Directory integration
Run the following to configure the firewall:
esxcfg-firewall -openport 88,tcp,out,KerberosClient
esxcfg-firewall -openPort 464,tcp,out,KerberosPasswordChange
esxcfg-firewall -openport 749,tcp,out,KerberosAdm
You can verify the open ports you have by running
esxcfg-firewall -q
Step 3 - Restart the firewall
service firewall restart
Step 4 - Creating the user
Some see this next step as an inconvenience. You are not automatically able to log in at this point. For one, you still need to assign a role to your domain user. And two, you have to create a user on the ESX host with the same name as your domain user. Seems a little redundant. In my opinion it would be great if at this point you were able to query your domain for the users. I’m looking into this now. Until then:
useradd domainuser
You don’t need to create a password as it will integrate with AD and retrieve the password. Now you just need to assign permissions to this user. Hopefully updates to come.
.jpg "happyjack-vedauwoo0708 (14).jpg")
.JPG "tour_de_co_0908 (69).JPG")
