VI3 IC REV B - 07 Access Control

VM Access Control
Module 7
VMware Infrastructure 3: Install and Configure – Rev B

Copyright © 2006 VMware, Inc. All rights reserved. 7-1
You are here
Virtual Infrastructure Virtual Machines Operations

Virtual Infrastructure Overview VM Creation and Data Protection
ESX Server Installation Management
ESX Server Installation VM Creation & Management VM Resource Monitoring
Networking Resource Pools

Networking VM Access Control Data & Availability Protection
Storage
Storage VM Resource Management Troubleshooting Tips
ESX ServerInstallation
VirtualCenter Installation

Importance and module objectives
• Importance
• When there are multiple users accessing the virtual infrastructure, it
is a good idea to give each user only the necessary permissions,
nothing more. VirtualCenter permissions allow quite a bit of
flexibility in these assignments.
• Objectives for the learner
• Create VirtualCenter permissions
• Create ESX Server permissions
• Manage access to VMs using Web Access

Module lessons
• Lesson 1: VMware Infrastructure User Access

• Lesson 2: Accessing VMs using Web Access

Lesson 1:
VMware Infrastructure
User Access

Lesson topics
• Security model
• VirtualCenter permissions
• ESX Server permissions

Security model overview
User Role Privileges
Permission

Types of users
VirtualCenter users and groups are those

from the VC server’s domain
ESX Server users and groups are those

defined in its service console
No attempt is made to reconcile these users and groups

Privileges
• A privilege allows a
user to perform a pre-
defined task.
• Privileges are grouped
into categories and
subcategories
• A collection of privileges
is a role.
• A role can be
propagated downwards,
to its child objects

Roles
ESX Server and VirtualCenter come with their own set of default
roles
Roles
Default No Access
ESX Server user Read-Only
and group roles
Administrator
Default
VirtualCenter user
Virtual Machine Administrator and group roles
Datacenter Administrator
Virtual Machine Power User
Virtual Machine User
Resource Pool Administrator
Create your own
roles for either
ESX Server or
Night-shift Operator
VirtualCenter Backup Administrator
users and groups

Permission
• A user/role pairing assigned to a VMware Infrastructure
inventory object
• Can be optionally propagated downwards through the inventory
Greg – Datacenter Administrator
Susan – Resource Pool Administrator
Carla – Virtual Machine Power User

VirtualCenter security model
Active Directory VirtualCenter
user role privileges

permission

Default permissions for VirtualCenter
• Local Administrators group is assigned the Administrator
role at the topmost level in the inventory

ESX Server security model
Service console ESX Server
user role privileges

permission

Default permissions for ESX Server
• Service console users, vpxuser and root, are assigned the
Administrator role at the ESX Server level

Labs for lesson 1
1. Accessing Virtual Machines in VirtualCenter

• In this lab, you will perform the following tasks:
• Create a VirtualCenter permission using an existing role
• Create a VirtualCenter permission using a custom role
2. Accessing Virtual Machines on the ESX Server

• In this lab, you will perform the following task:
• Create an ESX Server permission using an existing role

Lesson summary
• A VirtualCenter user is a Windows user, either local or

domain-based
• An ESX Server user is a Linux user, defined in the
service console
• A permission is a role assigned to a user/group and is
applied to an object in the inventory

Lesson 2:
Accessing VMs
Using Web Access

Lesson topics
• Logging into Web Access

• Web Access functionality

What is Web Access?
• A browser-based application that focuses on managing
VMs on ESX Server and VirtualCenter deployments
• Benefits:
• Administrators can provide end users access to VMs
• Users do not need to install the VI client onto their desktop
• Client devices allow users to use their local floppy and CD/DVD
• Eliminates the need to access these drives on the ESX Server host
Web
Access
Web Access
(Apache Tomcat Service)
Web
Access installed here

Log into Web Access

Log into Web Access (2)
• If logging into VirtualCenter, enter a VirtualCenter user

account and password
• If logging into an ESX Server directly, enter an ESX
Server user account and password

Web Access tasks
View a VM’s console
View VMs and

their details
Perform power
operations and
other VM tasks

Generate remote console URL
• Way to provide access to a

VM through a URL
• Useful for including in an e-
mail message

Activity
• Using Web Access

• Take a few minutes to explore the Web Access interface:
• Log into Web Access on the VirtualCenter Server and perform a few
tasks on your virtual machines
• Log into Web Access on the ESX Server and perform a few tasks on your
virtual machines

Module summary
• A permission is a pairing of a user and a role

• A role is a set of pre-defined privileges
• VirtualCenter users are different from ESX Server users
• Web Access is used to manage VMs, not ESX Server
hosts

Questions?


VI3 IC REV B - 07 Access Control

Enviado por

Dados do documento

Descrição original:

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

VI3 IC REV B - 07 Access Control

Enviado por

Direitos autorais:

Formatos disponíveis

VM Access Control

VMware Infrastructure 3: Install and Configure – Rev B

Virtual Infrastructure Virtual Machines Operations

Networking Resource Pools

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

• Lesson 1: VMware Infrastructure User Access

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

User Role Privileges

VMware Infrastructure 3: Install and Configure – Rev B

VirtualCenter users and groups are those

ESX Server users and groups are those

No attempt is made to reconcile these users and groups

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

Greg – Datacenter Administrator

Susan – Resource Pool Administrator

Carla – Virtual Machine Power User

VMware Infrastructure 3: Install and Configure – Rev B

Active Directory VirtualCenter

user role privileges

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

Service console ESX Server

user role privileges

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

1. Accessing Virtual Machines in VirtualCenter

2. Accessing Virtual Machines on the ESX Server

VMware Infrastructure 3: Install and Configure – Rev B

• A VirtualCenter user is a Windows user, either local or

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

• Logging into Web Access

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

• If logging into VirtualCenter, enter a VirtualCenter user

VMware Infrastructure 3: Install and Configure – Rev B

View a VM’s console

View VMs and

VMware Infrastructure 3: Install and Configure – Rev B

• Way to provide access to a

VMware Infrastructure 3: Install and Configure – Rev B

• Using Web Access

VMware Infrastructure 3: Install and Configure – Rev B

• A permission is a pairing of a user and a role

VMware Infrastructure 3: Install and Configure – Rev B

VMware Infrastructure 3: Install and Configure – Rev B

Você também pode gostar