What is the best way to lock down an ESXi Local User?

I have created a VM that I only want certain users to be able to access. This is for an ESXi server not connected to our Domain or to a vCenter server. So it is only a local user. The VM in question is running in a DMZ so RDP, VNC, etc are out. I want them to access it via vSpheres Console. I have been able to restrict the user so that they can see no host information, and the only thing they can really do is open the console via right click. But they can still see a LOT of information about the VM that I would prefer they not have access to. The only permissions assigned to this roll is the following:

All Priveleges --> Virtual Machine --> Interaction --> Console Interaction

Pretty much all options are greyed out or completely missing. It's just that they can still see the Summary Tab, Resource Allocation, etc. Is there any way to limit it to only the console tab? Or even better, any way to connect a user directly to a VM Console? My boss mentioned that he thought there might be a way to do this via vSphere Remote Command Line. Any ideas?
CCB-TechAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
have a look at my solution here

http://www.experts-exchange.com/Software/Virtualization/Q_26804260.html

if you require further assitance please post back
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
also try this

Firsly install the vSphere Client

and then

vmware-vmrc -h esx002 "[vmfs_lun1] BARBUS9/BARBUS9.vmx"

esx002 - ESX server name can be an IP address
[datastore name] - mine is vmfs_lun1

there is a space after ] before the folder name of the VM and VM.vmx

this will give you direct console access to the virtual machine.


0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
You will be prompted to enter username and password for the ESX host server, so you'll need to add these to the users.

But you'll then have a direct console access.

 Console via vmware-vmrc only
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

CCB-TechAuthor Commented:
Sweet! I most certainly will be trying this tomorrow. I'll get back to you then!
0
CCB-TechAuthor Commented:
Okay, I got this working just fine with the root login. However, I am now trying to connect via this method but I'm getting a permission denyed error. I have Console access enabled, what else needs to be enabled?
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
do you mean you are logging in with another user and it fails?
0
CCB-TechAuthor Commented:
Yes, I'm trying to log on as the user I had restricted. I can connect to the console by logging on normally to vSphere Client. But not via this way.
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
I believe the users will need elevated root permissions to connect to console using vmware-vmrc.
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
what if you grant Administrator role to the user for the Virtual Machine they need to connect to?
0
CCB-TechAuthor Commented:
Woot! I found the answer. This is the link:

http://communities.vmware.com/message/1465136;jsessionid=BABB964ACFEB9B5C49468A693D377369

This is excellent though, because now the user doesn't see anything unncessary inside of vSphere client. It just goes straight to the Console. Is there any way to install just the viewer program and not all of the vSphere Client?
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
vmware-vmrc is part of the vSphere client, so not on it's own, but just remove the shortcuts and the main vSphere *.exe. If you are concerned the indididual may run it. Or publish as an application under Thin Client that is what we do for Sub-Contractors.
0
CCB-TechAuthor Commented:
Okay, that's not a problem at all. Truthfully I wasn't real concerned, but it is best to keep things as lean as possible. Thanks for all your help on this!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.