New Security Patches for ESX

VMware updated Security Advisory VMSA-2009-0004.1 and released 4 new patches:

VMware ESX 3.5, Patch ESX350-200904402-SG: Updates ESX Scripts  <- This one also corrects the need to rescan storage twice with Qlogic HBA’s!
VMware ESX 3.5, Patch ESX350-200904406-SG: Updates vim-common, vim-minimal RPMs
VMware ESX 3.5, Patch ESX350-200904407-SG: Security Update to BIND
VMware ESX 3.5, Patch ESX350-200904408-SG: Security Update to the openssl Package

The KB articles referenced above state that none of these updates require VM or Host shutdown. The updated advisory includes references to ESX 3.0.3, 3.0.2 and 2.5, but no new patches have been released for these versions since April, 10, 2009.

You can subscribe to VMware Security announcments here: http://lists.vmware.com/mailman/listinfo/security-announce

VCP on vSphere 4

VMware has announced the requirements and scheduled availability of the VCP on vSphere 4 certification.

From VMware’s Certification site:
There are four possible paths to acheive VCP on vSphere™ 4

  1. If you are NEW to VMware
    • Attend the VMware vSphere™ 4: Install, Configure, Manage course (first courses available in late June 2009) OR attend the VMware vSphere 4: Fast Track (available in Q3)
    • Take and pass the VCP on vSphere™ 4 exam
  2. If you are currently a VCP on VMware Infrastructure 3
    • Take and pass the VCP on vSphere™ 4 exam. This option will only be available until December 31, 2009. Beginning in 2010, VCPs on VI3 must attend the VMware vSphere 4: What’s New class in order to upgrade.
  3. If you are currently a VCP on ESX 2.x
    • Take and pass the VCP on VMware Infrastructure 3 exam
    • Take and pass the VCP on vSphere™ 4 Exam. This option will only be available until December 31, 2009. Beginning in 2010, VCPs on VI3 must attend the VMware vSphere™ 4: What’s New class in order to upgrade.
  4. If you are not a VCP on VI3, but have attended one of the prerequisite classes (Install & Configure; Deploy Secure & Analyze; or Fast Track).
    • Take and pass the VCP on VMware Infrastructure 3 exam OR attend the VMware vSphere™ 4: What’s New course.
    • Take and pass the VCP on vSphere™ 4 Exam.

Paths to VCP on vSphere 4

Troubleshooting…

Today at a client site, vCenter stopped responding. In the course of troubleshooting, I discovered that the C: drive of the SQL server housing the vCenter database had 1.59MB free. That was alleviated by cleaning up a 526MB system state backup from late 2007. Next, I found that the SQL DBA’s had set the SQL login for the vCenter db to expire.  The VMware admins confirmed that they had requested a login with no account expiration and that the request had been approved through change control before the account was created. Of course, this is not the default setting, so care must be taken to confirm the config.

At the same site we also discovered that the VLAN tags for a single VLAN were left off of 22 physical ports… Simple typo in the console “1-2” rather than “1-24” that was showing up as intermittent inability for VM’s to get ip addresses via DHCP.  Based on good documentation of the vSwitch configs and a good diagram and documentation of connections from the ESX hosts to the physical switch, we convinced the network admin to check and correct the switch config.

Thankfully, both errors were remedied quickly, but both could have been avoided with careful checking and better feedback. Virtualization crosses many disciplines and I routinely encounter resistance from the various admin groups at client sites who have become isolated from each other. At this site, the admin groups are starting to loosen up and cooperate better, and incidents like today’s are helping them to appreciate the need for coordination rather than insulation.

Hello world!

Welcome to my blog. I have maintained a website for years in support of my endeavors as an IT trainer and consultant. Recently, I have been encouraged to provide a single site for links and information that I refer to my students during class. So, here goes. Please be patient as this site will evolve as I get time.

Dennis