How to add users to fastpass users?

[cougar694u]

We deployed 8 ESXi servers in our lab environment and have the vMA up and running. Everything's running good, have VMs going, HA/DRS, etc.

The problem I'm having is I don't like to hand out a single user/pass to the team. On our ESX 3.5 environment, we used esxcfg-auth for AD authentication and made them a part of sudoers. Since there's no esxcfg-auth in the vMA, I manually created users and added them to the sudoers.

That all seems fine, I can sudo vifp addservers, and even used bulkAddServers.pl and a vifp listservers works fine. However, when I run vifpinit, I get error: not running as fastpass user.

How can I add users to fastpass? If I log in as vi-admin, vifpinit works just fine, but I don't want to hand out a generic user/pass to the environment admins.

[lamw]

The check is actually done in the actual execution of vifpinit at: /opt/vmware/vima/bin/vifpinit and I would highly recommend NOT modifying the logic since vi-admin account is used to manage ESX(i) and vCenter systems. You should only be handing out access to VI Admins and in the case of vMA, only vi-admin account should be used.

I agree that using just one account for multiple individuals is hard to track down, but that's where the use of 'sudo' should be used, that way you have everything logged in syslog. You can create individual accounts and then allow only these user's to sudo over to 'vi-admin' to perform operations against your hosts.

=========================================================================

William Lam

VMware vExpert 2009

VMware ESX/ESXi scripts and resources at:

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Comuunity

Twitter: @lamw

If you find this information useful, please award points for "correct" or "helpful".

[cougar694u]

Having a shared account to manage something as crucial as ESX/i should be a big no no.

As far as only handing it out to those who manage the infrustructer, I'm on an eight (8) person team, and delegate certain tasks to single members of other teams and would much like to have the auditability to keep track of who did what, not just that vi-admin logged in and did something.

Don't you agree?

[lamw]

I agree, but afaik, that is how vMA is currently setup. Again, you can create individual accounts and sudo over to vi-admin. If you're really interested in remediating the issue you're facing, I suggest contacting VMware support. Again, the check is done within vifpinit script which is just a shell script but I don't know if it breaks other things if you try to override it, I'm sure its possible but you'll need to get VMware involved. I know one thing on their to do list for vMA is to eventually get AD integration and hopefully (UNIX LDAP/etc) so you don't rely on this single account.

I'm just letting you know what I've seen so far and totally agree we should not use just one account since it's hard to audit on exactly who did what. Hope that helps

=========================================================================

William Lam

VMware vExpert 2009

VMware ESX/ESXi scripts and resources at:

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Comuunity

Twitter: @lamw

If you find this information useful, please award points for "correct" or "helpful".

[cougar694u]

I followed your advice for the su - vi-admin. It's better than anyone using vi-admin freely. I also blocked vi-admin from being able to ssh into the vMA, although I'm not sure what sort of issues that may cause (none, thus far).

I looked through vifpinit and couldn't really find the logic (i'm not extremely familiar with bash scripts), so I left that aspect alone.