Vcenter login process

When you access/login to Vcenter, do you enter login credentials? Or is it just based on your AD account.

Our management are concerned about unauthorised access to vcenter, and I guess theres always a potential someone could guess the password for an account that has permission in vcenter, but what would they "need" on their machine to access the system, i.e. if they dont have client software, they cant access the system? Or are there ways to access vcenter even without the software on your PC, i.e. if you guess an admina ccount that has access to vcenter, without the neccesary software, could you still access vcenter?
LVL 3
pma111Asked:
Who is Participating?
 
2G33K4UCommented:
If you have it pulling from AD to get accounts and they are lucky enough to guess the administrative credential info then...them accessing your VMserver is least of your concerns they can wipe everything out.  I use a separate logon for getting complete access to my VMServers that is not tied to AD. You make the accounts and dictate what the passwords are.   You have to log into it to get access to anything. Some one can't just walk into the actual server box and hop in. and if it makes them worry that much consider setting in CMOS to require a password from screen saver as well 2 layers of protection.

So to sum it all no matter what you do or choose they will still have to log and then the permission you have setup will dictate what they will/can do.

You decide what groups have access to what just because a domain admin logs in to it doesn't mean he/she can change anything unless they have been added to Local User Groups in VM

Image of VMware Local Users and Groups
The VM Settings are the deciding factor.  Hope this helps.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
The login credentials for vCenter Server depend on how vCenter Server has been integrated and setup.

Local Accounts on the Windows Server could be used or Active Directory accounts if integrated into Windows Active Directory.
0
 
pma111Author Commented:
Back to the threat scenario though. Would it be seen as a compensating control that (specific to gaining unauthorised access to vcenter) if someones compromised an admin account and want to get at vcenter, if they dont have whatever client neccesary to access vcenter, then wheres the risk, how (if at all) could they get access to vcenter. I guess I am after "paths" which could be used to get on vcenter to get my head around the risk.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
2G33K4UCommented:
Technically if they know the vmserver's IP address soon as they hit it. it will offer that person the chance to download the client. That is built in. The scenario you speak of is unavoidable any place anywhere with any server if a admin password is compromised they will get in Period. Shy of finger print keys.

try it yourself go to a machine without the VM client software and browse to your vmservers IP.

Soon as you think a admin password has been compromised even a slight possibility change passwords. better safe than sorry.
0
 
ianmellorCommented:
Hi,

Your domain administrator account might not be a vCenter administrator, it all depends on how you have setup your infrastructure. You can always download a Thinapp version of the vSphere client and connect with it, if you are able to guess a username and password. Also remember that vCenter is a windows machine and you have to do security hardening on it as well.
If you are that worried about security then you have to look at two factor authentication or separate networks.

Hope this helps,
0
 
2G33K4UCommented:
Also they could SSH into it with proper credentials. Anyway you can get in they can get into it if they have the credentials.
0
 
ianmellorCommented:
Hi,

SSH should be disabled by default. You should not be using it for day to day administration.


Cheers,
0
 
2G33K4UCommented:
Glad to have been of assistance and thank you for the points.
Have a great Day!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.