Remote console access question

[danswartz]

Okay, here's a question for you all. My wife has a Windows XP VM on the 5.0 hypervisor. I have her old XP system now used only as a Remote Desktop frontend. Her old box was migrated to the VM using vmware converter. All was well. Her company has a security thing where she had to install PGP Desktop to encrypt the disk. That works just fine, except for this: if she reboots the VM (sometimes necessary if her company pushes a hotfix or somesuch), she cannot connect with Remote Desktop. I have to bring up the vsphere client, go to her console and have her enter the password to finish booting her VM. She is less than pleased with this, to say the least. This is happening very early, so VNC is not an option to get around this. There is a non-recommended way to do a one-time boot bypassing the encryption system, but that is not acceptable, since their security auditing software will complain. I know other setups like vmware workstation and such have ways of VNC connecting to the console for each VM - is there something like this for vsphere? I googled and found vmware-vmrc.exe but that is only in the 4.1 folder? My fallback is to show her how to connect via the vsphere client, but that is a last ditch Any thoughts/suggestions would be much appreciated

 

[CEpeep]

There's an option in the vSphere client to turn on VNC connections for individual guests. VNC access at this level gives you full console access from the moment the guest VM boots. It's not particularly secure on its own, but if you are using a VPN or something it should be fine.

 

[Gomjaba]

There's an option in the vSphere client to turn on VNC connections for individual guests. VNC access at this level gives you full console access from the moment the guest VM boots. It's not particularly secure on its own, but if you are using a VPN or something it should be fine.

Yepp.

Either edit the VMX or add them in the advanced settings (while powered off)

RemoteDisplay.vnc.enabled = "TRUE"
RemoteDisplay.vnc.password = "your_password"
RemoteDisplay.vnc.port = "5900"

 

[danswartz]

Ah, sweet! I'll give that a shot, thanks! Also, security (aside from her password) is not a major concern, since this is on our home LAN.

 

[Gomjaba]

Ah, sweet! I'll give that a shot, thanks! Also, security (aside from her password) is not a major concern, since this is on our home LAN.

Isn't it possible to remove PGP again considering it is now a VM and cannot easily be stolen (anymore) ?

 

[danswartz]

No, her company has security auditing software that checks for things like PGP being installed

 

[danswartz]

Grrr, so I found how to set the remote display stuff. Cannot connect. Seems to be due to the new esxi firewall. Google shows very little useful info on vsphere5 in this respect. Frankly, given my home LAN, I'd just as soon disable the firewall entirely, but there is no obvious way to do that (google returns literally hundreds of useless, out of date hits - sigh...) Still looking...

 

[CEpeep]

Grrr, so I found how to set the remote display stuff. Cannot connect. Seems to be due to the new esxi firewall. Google shows very little useful info on vsphere5 in this respect. Frankly, given my home LAN, I'd just as soon disable the firewall entirely, but there is no obvious way to do that (google returns literally hundreds of useless, out of date hits - sigh...) Still looking...

Hmm. In 4.1, the VNC connection is under the same networking restrictions as the ESXi host itself. The VNC server is a service of the host not the guest, so make sure you are connecting to the host's IP, not the guest's. It should work from any computer that has access to run the vSphere client.

I have not tried using direct VNC access in ESXi 5.0, so it is possible something has changed.

 

[danswartz]

I have done so. Apparently 5.0 now has a builtin firewall that blocks everything not enabled by default. Finding out how to change this is an exercise I am going through now.

 

[danswartz]

I am absolutely amazed at the number of posts I find various places with incorrect or out of date info. Example: I find someone who describes how to add a custom firewall rule - he cites a file that doesn't even exist on my system Another one gives an example, but when I do (I thought) exactly what he said, the new rule never shows up, nor do I get an error. There has got to be a way to just disable the damned thing (like in 4.1?), but damned if I can see how to do so

 

[danswartz]

Okay, apparently the path of least resistance is 'esxcli network firewall unload' and put that in /etc/rc.local?

 

[madrebel]

Did you check Host Configuration > Software > Security Profile from the vsphere client?

 

[danswartz]

Yes, there is nothing I can see there to disable the firewall entirely. Just checked (again). All I can see when I click on firewall properties is how to allow/disallow IP addresses for the firewall itself, or tweaking specific services. Am I missing something?

 

[madrebel]

idk if it can be completely disabled but you can likely allow your whole /24 home lan.

 

[danswartz]

It isn't the IP that is the issue, but access to the service. There are certain default services that you can tweak, but vnc is not on that list.

 

[madrebel]

ah, yeah, idk then. i still havent played with v5 yet. still waiting for my rep to get around to me with the new keys.

 

[Vader]

That's funny, one of the driving factors and actually a cost savings to migrating to VDI was PGP...lol. It doesn't make sense to PGP a desktop VM really. What's she going to steal, a dumb terminal or a laptop with no PI data?

 

[danswartz]

Sorry for the confusion. Her original corporate computer was getting old and slow, so I P2V'ed it to a VM and she is very happy about the increased performance. 2 weeks later she mentions 'oh yeah, we have this security compliance thing we have to do, and the software is nagging me about it...'