Solved

Vcenter login process

Posted on 2012-04-12
8
698 Views
Last Modified: 2012-04-12
When you access/login to Vcenter, do you enter login credentials? Or is it just based on your AD account.

Our management are concerned about unauthorised access to vcenter, and I guess theres always a potential someone could guess the password for an account that has permission in vcenter, but what would they "need" on their machine to access the system, i.e. if they dont have client software, they cant access the system? Or are there ways to access vcenter even without the software on your PC, i.e. if you guess an admina ccount that has access to vcenter, without the neccesary software, could you still access vcenter?
0
Comment
Question by:pma111
8 Comments
 

Accepted Solution

by:
2G33K4U earned 167 total points
ID: 37836485
If you have it pulling from AD to get accounts and they are lucky enough to guess the administrative credential info then...them accessing your VMserver is least of your concerns they can wipe everything out.  I use a separate logon for getting complete access to my VMServers that is not tied to AD. You make the accounts and dictate what the passwords are.   You have to log into it to get access to anything. Some one can't just walk into the actual server box and hop in. and if it makes them worry that much consider setting in CMOS to require a password from screen saver as well 2 layers of protection.

So to sum it all no matter what you do or choose they will still have to log and then the permission you have setup will dictate what they will/can do.

You decide what groups have access to what just because a domain admin logs in to it doesn't mean he/she can change anything unless they have been added to Local User Groups in VM

Image of VMware Local Users and Groups
The VM Settings are the deciding factor.  Hope this helps.
0
 
LVL 119

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE^2)
Andrew Hancock (VMware vExpert / EE MVE^2) earned 167 total points
ID: 37836818
The login credentials for vCenter Server depend on how vCenter Server has been integrated and setup.

Local Accounts on the Windows Server could be used or Active Directory accounts if integrated into Windows Active Directory.
0
 
LVL 3

Author Comment

by:pma111
ID: 37836889
Back to the threat scenario though. Would it be seen as a compensating control that (specific to gaining unauthorised access to vcenter) if someones compromised an admin account and want to get at vcenter, if they dont have whatever client neccesary to access vcenter, then wheres the risk, how (if at all) could they get access to vcenter. I guess I am after "paths" which could be used to get on vcenter to get my head around the risk.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Expert Comment

by:2G33K4U
ID: 37836911
Technically if they know the vmserver's IP address soon as they hit it. it will offer that person the chance to download the client. That is built in. The scenario you speak of is unavoidable any place anywhere with any server if a admin password is compromised they will get in Period. Shy of finger print keys.

try it yourself go to a machine without the VM client software and browse to your vmservers IP.

Soon as you think a admin password has been compromised even a slight possibility change passwords. better safe than sorry.
0
 
LVL 5

Assisted Solution

by:ianmellor
ianmellor earned 166 total points
ID: 37836931
Hi,

Your domain administrator account might not be a vCenter administrator, it all depends on how you have setup your infrastructure. You can always download a Thinapp version of the vSphere client and connect with it, if you are able to guess a username and password. Also remember that vCenter is a windows machine and you have to do security hardening on it as well.
If you are that worried about security then you have to look at two factor authentication or separate networks.

Hope this helps,
0
 

Expert Comment

by:2G33K4U
ID: 37836935
Also they could SSH into it with proper credentials. Anyway you can get in they can get into it if they have the credentials.
0
 
LVL 5

Expert Comment

by:ianmellor
ID: 37836940
Hi,

SSH should be disabled by default. You should not be using it for day to day administration.


Cheers,
0
 

Expert Comment

by:2G33K4U
ID: 37837470
Glad to have been of assistance and thank you for the points.
Have a great Day!
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
Teach the user how to edit .vmx files to add advanced configuration options Open vSphere Web Client: Edit Settings for a VM: Choose VM Options -> Advanced: Add Configuration Parameters:
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question