Pau Lo
asked on
disconnect drives vmware compliance checker
can I ask if the vsphere compliance checker gives you a big red cross against "disconnect devices", does that mean there is an actual USB drive plugged into the USB port, or just that the USB port is "live"? same for floppy, cd, etc, does it just mean the drives are live, and could be used, or that there is some actual media sat in the ports/drives.?
What does the prevent unauthorised removal, modifacation and connection of devices actually "do" ?
What does the prevent unauthorised removal, modifacation and connection of devices actually "do" ?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
It's not that straight forward, if you are concerned about USB access, you would have to physically remove/disable the USB on the server.
ASKER
My question is more , if you can break into the server room, plug in a USB drive into a hosts USB port, so what? How can you get data off that host if you dont have any sort of logical/login access on the host.
1. You can power off and on the server.
2. Boot the server using a Linux CDROM or Linux Live USB flash drive
3. Mount the USB storage disk, and copy off the virtual machine disk.
simple, if you have physical access to a server, you can do a lot.....
easy, 5 mins.
Therefore physical security is very important.
2. Boot the server using a Linux CDROM or Linux Live USB flash drive
3. Mount the USB storage disk, and copy off the virtual machine disk.
simple, if you have physical access to a server, you can do a lot.....
easy, 5 mins.
Therefore physical security is very important.
ASKER
is there any risk though if the VM is on the SAN not local drive on that host?
If the ESXi Host server has access to the SAN, the datastore could be accessed via ESXi and the VM copied to USB.
ASKER
But then surely you need some sort of logon to access esxi - i.e. plug in the USB, power off the server, power it back on again - I assume you cant just have free access to the VM's on the SAN used by that host at this stage, without logging into esxi?. Or once you power up your server can you access the VM's without any sort of authentication.
ASKER
At what stage can the hosts communicate to the VM's on the SAN? I.e. I assume the boot CD trick wont get you access to the VM's on the SAN until the esxi has loaded?
You can easily change the password for an ESXi installation. Once the password has been changed, you can boot the server, login to the console, and access the datastore.
If ESXi is connected to a SAN at this time, you can copy the virtual machine disks.
If ESXi is connected to a SAN at this time, you can copy the virtual machine disks.
ASKER
>You can easily change the password for an ESXi installation -
As in with physical access to the host you can change the password? Can you elaborate on this?
As in with physical access to the host you can change the password? Can you elaborate on this?
Yes, BOOT from CDROM/USB and change the password.
it's documented here:-
http://www.vm-help.com/esx/esx3i/Reset_root_password.php
it's documented here:-
http://www.vm-help.com/esx/esx3i/Reset_root_password.php
ASKER