Solved

Vcenter login process

Posted on 2012-04-12
8
699 Views
Last Modified: 2012-04-12
When you access/login to Vcenter, do you enter login credentials? Or is it just based on your AD account.

Our management are concerned about unauthorised access to vcenter, and I guess theres always a potential someone could guess the password for an account that has permission in vcenter, but what would they "need" on their machine to access the system, i.e. if they dont have client software, they cant access the system? Or are there ways to access vcenter even without the software on your PC, i.e. if you guess an admina ccount that has access to vcenter, without the neccesary software, could you still access vcenter?
0
Comment
Question by:pma111
8 Comments
 

Accepted Solution

by:
2G33K4U earned 167 total points
ID: 37836485
If you have it pulling from AD to get accounts and they are lucky enough to guess the administrative credential info then...them accessing your VMserver is least of your concerns they can wipe everything out.  I use a separate logon for getting complete access to my VMServers that is not tied to AD. You make the accounts and dictate what the passwords are.   You have to log into it to get access to anything. Some one can't just walk into the actual server box and hop in. and if it makes them worry that much consider setting in CMOS to require a password from screen saver as well 2 layers of protection.

So to sum it all no matter what you do or choose they will still have to log and then the permission you have setup will dictate what they will/can do.

You decide what groups have access to what just because a domain admin logs in to it doesn't mean he/she can change anything unless they have been added to Local User Groups in VM

Image of VMware Local Users and Groups
The VM Settings are the deciding factor.  Hope this helps.
0
 
LVL 119

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE^2)
Andrew Hancock (VMware vExpert / EE MVE^2) earned 167 total points
ID: 37836818
The login credentials for vCenter Server depend on how vCenter Server has been integrated and setup.

Local Accounts on the Windows Server could be used or Active Directory accounts if integrated into Windows Active Directory.
0
 
LVL 3

Author Comment

by:pma111
ID: 37836889
Back to the threat scenario though. Would it be seen as a compensating control that (specific to gaining unauthorised access to vcenter) if someones compromised an admin account and want to get at vcenter, if they dont have whatever client neccesary to access vcenter, then wheres the risk, how (if at all) could they get access to vcenter. I guess I am after "paths" which could be used to get on vcenter to get my head around the risk.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 

Expert Comment

by:2G33K4U
ID: 37836911
Technically if they know the vmserver's IP address soon as they hit it. it will offer that person the chance to download the client. That is built in. The scenario you speak of is unavoidable any place anywhere with any server if a admin password is compromised they will get in Period. Shy of finger print keys.

try it yourself go to a machine without the VM client software and browse to your vmservers IP.

Soon as you think a admin password has been compromised even a slight possibility change passwords. better safe than sorry.
0
 
LVL 5

Assisted Solution

by:ianmellor
ianmellor earned 166 total points
ID: 37836931
Hi,

Your domain administrator account might not be a vCenter administrator, it all depends on how you have setup your infrastructure. You can always download a Thinapp version of the vSphere client and connect with it, if you are able to guess a username and password. Also remember that vCenter is a windows machine and you have to do security hardening on it as well.
If you are that worried about security then you have to look at two factor authentication or separate networks.

Hope this helps,
0
 

Expert Comment

by:2G33K4U
ID: 37836935
Also they could SSH into it with proper credentials. Anyway you can get in they can get into it if they have the credentials.
0
 
LVL 5

Expert Comment

by:ianmellor
ID: 37836940
Hi,

SSH should be disabled by default. You should not be using it for day to day administration.


Cheers,
0
 

Expert Comment

by:2G33K4U
ID: 37837470
Glad to have been of assistance and thank you for the points.
Have a great Day!
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Create your first Windows Virtual Machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, the Windows OS we will install is Windows Server 2016.
Ransomware is a malware that is again in the list of security  concerns. Not only for companies, but also for Government security and  even at personal use. IT departments should be aware and have the right  knowledge to how to fight it.
Teach the user how to use vSphere Update Manager to update the VMware Tools and virtual machine hardware version Open vSphere Client: Review manual processes for updating VMware Tools and virtual hardware versions: Create a new baseline group in vSp…
This video shows you how easy it is to boot from ISO images for virtual machines with the ISO images stored on a local datastore on the ESXi host.

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question