Holodeck: Password Management

Module 3: Password Management

Overview

Passwords are initially set in a Cloud Foundation system as part of the bring-up procedure. Following bring up, admin staff will typically update these passwords using the password management functionality in VCF.  Passwords are also typically updated periodically or when certain events occur, such as when an administrator leaves your organization, reducing the likelihood of security vulnerabilities.

You can change or rotate passwords for the software components deployed by VMware Cloud Foundation. The process of password rotation generates randomized passwords for the selected accounts. You can change passwords for the following entities:

• ESXi
• vCenter Server
• NSX Manager
• NSX Edges
• vRealize Suite

 

This module will consist of the following exercises

1. Using Password Update
2. Using Password Rotate
3. Using the Password API

Exercise 1: Using Password Update

Password Update is used to set specific user defined passwords on accounts accessed directly by users.

[Step 1] Enable SSH on host esxi-1

1. Open a new tab in the Chrome browser (if necessary)
2. Click the Managed bookmarks folder in the bookmark bar then select Mgmt Domain – Mgmt vCenter
3. Click Launch vSphere Client if necessary
4. Login as user: administrator@vsphere.local with the password: VMware123!  
5. Click Login
6. On the Hosts and Clusters icon, select mgmt-datacenter01 -> mgmt-cluster-01-> esxi-1
7. Select Configure -> Services

1. Click the SSH radio button then START

2. Monitor progress in the task pane

 

[Step 2] Change password on host esxi-1

1. Click the SDDC Manager tab on the browser, or open a new tab
2. Click Security
3. Click Password Management
4. Select the check box next to root user for esxi-01
5. Click the three dots next to root, then choose UPDATE

6. Change the password to Cloud4321! Then click UPDATE

7. Monitor for completion in the task pane

8. Open a Putty window and ssh to esxi-1.vcf.sddc.lab

9. Click the Accept button to add the certificate to the cahe

10. Login as user root and password Cloud4321!

11. Successfully logging in validates the password change

Exercise 2: Using Password Rotate

Password rotation is typically used to update accounts used by SDDC Manager for automation operations. These are typically “service” type users

[Step 1] Login to SDDC Manager

1. Open a new tab in the Chrome browser (if necessary)
2. Click the Managed bookmarks folder in the bookmark bar then select SDDC Manager
3. Login as user: administrator@vsphere.local with the password: VMware123!  
4. Click Login

 

[Step 2] Rotate password

1. Select Security -> Passwords
2. Select svc-vcf-esxi-1
3. Click Rotate Now

4. Confirm by clicking Rotate. This will rotate the password to a randomly generated password that will be stored in the SDDC Manager database.

5. Monitor task in progress

 

 

Exercise 3: Password Lookup with SSH

[Step 1] Enable/Verify SSH on host esxi-1 (if necessary)

1. Open a new tab in the Chrome browser (if necessary)
2. Click the Managed bookmarks folder in the bookmark bar then select Mgmt Domain – Mgmt vCenter
3. Login as user: administrator@vsphere.local with the password: VMware123!  
4. Click Login
5. On the Hosts and Clusters view, select mgmt-datacenter01 -> mgmt-cluster-01-> esxi-1
6. Select Configure
7. Select System>Services
8. Verify SSH is running. If not, click the radio button for SSH and then Start

[Step 2] Lookup password for esxi-1

1. Open a PuTTY window
2. Connect to sddc-manager.vcf.sddc.lab (or 10.0.0.4)

3. Accept the Putty security warning
4. Login as user vcf password VMware123!

5. Enter the command lookup_passwords
6. Enter ESXi
7. Press Enter for page number to bypass
8. Press Enter for page size to accept default
9. Enter user name administrator@vsphere.local password  VMware123!

10. Results (scroll back up)

11. Notice the password you set earlier

Exercise 4: Password lookup using API

[Step 1] Login to SDDC Manager

1. Open a new tab in the Chrome browser (if necessary)
2. Click the Managed bookmarks folder in the bookmark bar then select SDDC Manager
3. Login as user: administrator@vsphere.local with the password: VMware123!  
4. Click Login

[Step 2] Lookup password

1. On the left navigation click Developer Center
2. Click API Explorer
3. Expand APIs for managing Credentials

4. Expand GET /v1/credentials
5. Type esxi-1.vcf.sddc.lab in the resourceName field
6. Scroll to bottom and hit EXECUTE

7. Click on PageOfCredentials
8. Click on the Credential (GUID) lines to expand the User and Service account information (The order of user and service credentials may vary, so open both)
9. User account example

10. Service account example