VMware Cloud Community
bdpEMC-spam
Contributor
Contributor

Using a password manager with vSphere

I posted this over on the EMC forum as well, but thought I would share it here:

Our lab environment has multiple vSphere and vCenter deployments, all seemingly built by different people at different times with different usernames and different passwords.  Since these are in a lab environment, AD is not really an option.  Rather than use a large supply of sticky notes, I decided to try to use technology to make things "better" and to share what I've created so far.

I decided (after some searching of various reviews) to use KeePass 2.x for my testing, but you may find similar functionality in other password managers.

Solution #1:

KeePass offers the option to pass a username and password to another window by launching the target application (vSphere client), then switching to KeePass and selecting the entry in KeePass and selecting Auto-Type(Ctrl-V) - but you will need to first select/enter the correct server IP/name in vSphere client.

I wanted to make it more automated and also pass the IP/hostname of the server.

Solution #2:

You can create a customized "Auto-Type" macro on a per-entry or per-group basis.  It may be easier to place your vSphere entries in a group of their own and then edit the Auto-Type macro for the whole group.  The following will SHIFT-TAB(+{TAB}) back to the IP/name field, insert the URL field, then TAB to username and password fields when you do the Auto-Type.

Custom keystroke sequence: +{TAB}{URL}{TAB}{UserName}{TAB}{Password}{ENTER}

This allowed me to not have to manually update the server field in vSphere, but I still had to launch vSphere first.

Solution #3:

KeePass allows you to create custom URLs, e.g. "ssh://", "ftp://", "chrome://", etc...  This allows you launch any application with whatever command line you want.  I decided to use this feature to create a "vsphere://" URL for launching vSphere from inside KeePass.  Some searching found the correct command line options to pass server/username/password on the command line to VpxClient.exe (-s SERVER -u USER -p PASS)

The process to create the custom URL type inside KeePass 2.x is:

Tools -> Options -> Integration -> "URL Scheme Overrides"

"Add"

Scheme -> vsphere

URL Override -> cmd://"C:\Program Files\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe" -s {URL:RMVSCM}" -u {USERNAME} -p {PASSWORD}

Note: Since the URL field will now contain "vsphere://", we need to remove it before passing it to VpxClient.  This is what "{URL:RMVSCM}" does.

I can now create an entry and set the username/password as expected and set the URL field to something like: "vsphere://10.10.10.10"

Now when I click on the URL field of a vsphere entry, it will launch the vSphere client and login automatically.

This does have the minor(?) concern of having the address, username and password visible in the process listing on your windows box.  If you are the only user on your machine this may be acceptable.  If you are concerned that some other user or application's log file may capture a list of running processes that could contain your username/password, then you may want to try the next option, or stick with solution #2.

Solution #4:

The command line of VpxClient remains visible in the process listing until you exit out of vSphere.  One way to minimize the exposure is by using a program like KeeRun(included with KeeForm)  This will launch another program, wait for it to launch and then populate the user/password fields and then exit.  The username/password are still visible in the process listing, but only as long as KeeRun is still running.  This should only be for the 5 seconds or so to get to the login dialog on vSphere.

To use KeeRun, copy the KeeRun.exe file into the KeePass directory (likely "C:\Program Files\KeePass Password Safe 2").

Then add or modify the new "vsphere://" URL scheme created in Solution #3:

Tools -> Options -> Integration -> "URL Scheme Overrides"

"Add" or "Edit" the Custom Override "vsphere" scheme at the bottom of the list

Scheme -> vsphere

URL Override ->

cmd://"{APPDIR}\KeeRun.exe" "C:\Program Files\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe -s {URL:RMVSCM}" "VMware vSphere Client" {USERNAME} {PASSWORD} "{_USERNAME_}{TAB}{_PASSWORD_}{ENTER}" "{URL:RMVSCM}"

The options to KeeRun will start VpxClient and specify the server.  It will then wait until an application window with the title of "VMware vSphere Client" to be visible.  It will also check to make sure that window contains the server IP/name by checking for visible text that matches the 6th (optional) parameter to KeeRun - "{URL:RMVSCM}".  Once it finds the correct window dialog, it will send the username & password and then KeeRun will exit.

Hopefully this was helpful to someone.

Brian

0 Kudos
2 Replies
kgottleib
Enthusiast
Enthusiast

Brian- cool post -

I have a need to simultaneously log into the guest OS of about 50 + systems with a single user account, so that the user account is sitting at the desktop when I open the VM's remote console.  The functionality is an option in the VMware guest customization wizard when deploying a new VM from template, that being to log on as admin x # of times.  the problem I am facing is that I do not want to modify the registry of the systems because they are live production systems at customer sites, not lab systems.

The history behind this need is  simple, we run scripts, and we verify these scripted changes with other scripts, but the occasional 1 off has bitten us in the but at a few customer sites so management has mandated that each and every system be logged into manually to verify the changes were made properly.  I want to speed this process up for the field engineers.

Any thoughts?   

0 Kudos
huntman
Contributor
Contributor

I know this is an old post but I had to create an account and share my experience.

I chose Option 3 and had to alter the URL Override in the new scheme a bit from what the original post said.  My path to VpxClient.exe was different from the original poster's and I also had to put double quotes around each argument that was passed to it for it to work.  So the final URL Override became...

cmd://"C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe" -s "{URL:RMVSCM}" -u "{USERNAME}" -p "{PASSWORD}"

0 Kudos