ESX Active Directory Integration 1/2

Today let’s talk about the AD Integration with ESX 3.5
I believe most of you have to, at least once, to log in the ESX console for some troubleshooting, some third part app installation or maintenance, whatsoever.

You can do this with root account.
But you don’t want to share it’s password with dozens of administrators of your company. The auditors will be pulling their hairs off if you do that.

The best practice is to disable the remote access (SSH) for the root account.
Edit the /etc/ssh/sshd_config file
And change the PermitRootLogin from yes to no
Restart the sshd service

Now you should be safe ; )

But you still need the capability of login remotely, right ?!?

Here’s the thing:

- create a local account, with blank password, where the ID’s match the ID’s on your AD
run: useradd bob
there are a few options for group, comments, shell, etc.. (Check useradd man page for all options)

now that you have your accounts create locally you can set up LDAP redirection to your domain.

Run:
esxcfg-auth --enablead --addomain=example.com --addc=dc1.example.com

now you should be able to login through a SSH session with the ID and password from your AD domain.

Now you realized you cannot run the command which require admin privileges.
It’s time to tweak the /etc/sudoers file. Use VISUDO to do that.
if you have doubts, here’s the SUDO website about it.

Next post I will talk about the Active Directory integration with ESX 4.x