How to disable/secure the Managed Object Browser (...

DDQ · ‎10-19-2010

Is it possible to disable/secure the MOB or it's service endpoint (or detect whether it is enabled/disabled) from the VI SDK?

Or does anyone know whether the ServiceInstance.RetrieveInternalContent method and InternalServiceInstanceContent type are being considered for inclusion in the VI SDK?

There are some clues about this in forum page http://communities.vmware.com/docs/DOC-11864 that refer to the undocumented (and browsable) Internal Service Instance Content accessible via:

https://YOUR_HOST_HERE/mob/?moid=ServiceInstance&method=retrieveInternalContent

but I have not been able to find any discussion of future public implementation for this currently unsupported content.

lamw · ‎10-20-2010

Access to the MOB is governed in the same way as logging into the ESX(i) or vCenter host and what you can actually do. The lowest level of access would be just a read-only account in which you may view the data but can not perform any operations. Take a look at this blog article on disable certain webServices - http://technodrone.blogspot.com/2010/01/disabling-services-in-esxi.html, I also wrote an article using a 3rd method at the bottom of the blog post. I would recommend you contact VMware support before making this change

=========================================================================

William Lam

VMware vExpert 2009,2010

VMware VCP3,4

VMware VCAP4-DCA

VMware scripts and resources at:

Twitter: @lamw

Getting Started with the vMA (tips/tricks)

Getting Started with the vSphere SDK for Perl

VMware Code Central - Scripts/Sample code for Developers and Administrators

VMware Developer Community

If you find this information useful, please award points for "correct" or "helpful".

DDQ · ‎10-20-2010

Thanks for your reply. The link you provided referred back to the link I referenced in the original post. The info you provided on that page regarding an unsupported internal service content interface drove me to post on this forum.

I am looking for a (supported) way to interrogate the web service info purely by VI SDK (vijava) method calls. I don't even need to change anything... simply want to detect whether the MOB is configured, e.g., proxy.xml is set up correctly, service is running, etc. Detecting a running service may be attainable already, it's just the proxy.xml config that does not appear to be viewable from the VI SDK.

Thanks again.

lamw · ‎10-21-2010

Yea controlling the endpoint services are all hidden APIs methods, you'll either need to update your client WSDL manually and this will be unsupported OR going into the host to update the proxy.xml