|
VMware ESX Server 1.5
Features | Documentation | Knowledge Base | Discussion Forums This section contains the following: There are three key aspects to security with VMware ESX Server.
VMware ESX Server uses Pluggable Authentication Modules (PAM) for user authentication in the remote console and the VMware Management Interface. The default installation of ESX Server uses /etc/passwd authentication, just as Linux does, but it can easily be configured to use LDAP, NIS, Kerberos or another distributed authentication mechanism. The PAM configuration is in /etc/pam.d/vmware-authd.
Every time a connection is made to the server running VMware ESX Server, the inetd process runs an instance of the VMware authentication daemon Once a user is authenticated, vmware-authd accepts a path name to a virtual machine configuration file. Access to the configuration file is restricted in the following ways:
Note: If you have users with list access, but not read access, they may encounter errors in the VMware Management Interface. If a vmware process is not running for the configuration file you are trying to use, vmware-authd examines /etc/vmware/vm-list, the file where you register your virtual machines. If the configuration file is listed in vm-list, vmware-authd (not necessarily the user who is currently authenticated) starts VMware ESX Server as owner of this configuration file. Registered virtual machines (those listed in /etc/vmware/vm-list) also appear in the VMware Management Interface. The virtual machines you see on the Overview page must be listed in vm-list, and you must have read access to their configuration files. The vmware-authd process exits as soon as a connection to a vmware process is established. Each vmware process shuts down automatically after the last user disconnects. When you create a virtual machine with VMware ESX Server, its configuration file is registered with the following default permissions, based on the user accessing it:
The TCP/IP ports available for management access to your ESX Server machine vary, depending on the security settings you choose for the server. If you need to manage ESX Server machines from outside a firewall, you may need to reconfigure the firewall to allow access on the appropriate ports. The lists below show which ports are available when you use each of the standard security settings. The key ports for use of the VMware Management Interface and the remote console are the HTTP or HTTPS port and the port used by vmware-authd. Use of other ports is optional.
|
