VMware VS4-ENT-PL-A - vSphere Enterprise Plus, Руководство по установке

Страница: 263 / 276

Enable Lockdown Mode Using the Direct Console
To increase the security of your ESXi hosts, you can put them in lockdown mode.
When you enable lockdown mode, no users other than
vpxuser
have authentication permissions, nor can
they perform operations against the host directly. Lockdown mode forces all operations to be performed
through vCenter Server.
When a host is in lockdown mode, you cannot run vSphere CLI commands from an administration server,
from a script, or from vMA against the host. External software or management tools might not be able to
retrieve or modify information from the ESXi host.
N
OTE
Users with the DCUI Access privilege are authorized to log in to the Direct Console User Interface
(DCUI) when lockdown mode is enabled. When you disable lockdown mode using the DCUI, all users with
the DCUI Access privilege are granted the Administrator role on the host. You grant the DCUI Access
privilege in Advanced Settings.
Enabling or disabling lockdown mode affects which types of users are authorized to access host services,
but it does not affect the availability of those services. In other words, if the ESXi Shell, SSH, or Direct
Console User Interface (DCUI) services are enabled, they will continue to run whether or not the host is in
lockdown mode.
You can enable lockdown mode using the Add Host wizard to add a host to vCenter Server, using the
vSphere Web Client to manage a host, or using the direct console user interface.
N
OTE
If you enable or disable lockdown mode using the Direct Console User Interface (DCUI), permissions
for users and groups on the host are discarded. To preserve these permissions, you must enable and disable
lockdown mode using the vSphere Web Client connected to vCenter Server.
Lockdown mode is available only on ESXi hosts that you add to vCenter Server.
See the vSphere Security documentation for more information about lockdown mode.
Procedure
1 In the direct console, select Configure Lockdown Mode and press Enter.
2 Press the spacebar to select Enable Lockdown Mode and press Enter.
3 Press Enter.
The host is in lockdown mode.
Enable Lockdown Mode Using the vSphere Web Client
Enable lockdown mode to require that all configuration changes go through vCenter Server. You can also
enable or disable lockdown mode through the Direct Console User Interface (DCUI).
Procedure
1 Browse to the host in the vSphere Web Client inventory.
2 Click the Manage tab and click Settings.
3 Under System, select Security Profile.
4 In the Lockdown Mode panel, click Edit.
5 Select Enable Lockdown Mode.
6 Click OK.
Chapter 8 Setting Up ESXi
VMware, Inc. 263