{"id":1151,"date":"2010-10-28T10:42:36","date_gmt":"2010-10-28T08:42:36","guid":{"rendered":"http:\/\/michauko.org\/blog\/?p=1151"},"modified":"2015-04-09T19:18:48","modified_gmt":"2015-04-09T18:18:48","slug":"vmesxi-4-0-acces-root-et-authentification-par-clef-ssh","status":"publish","type":"post","link":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/","title":{"rendered":"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH"},"content":{"rendered":"

EDIT avril 2015 : pour ESXi 5, 5.1 et 6.0, cf. dans les commentaires.<\/em><\/p>\n

Hello,<\/p>\n

Ce qui suit \u00e9tait valable jusqu’\u00e0 ESXi 4.0. Je n’ai pas regard\u00e9 en 4.1 pour l’instant. Vous me direz (ou moi plus tard).
\nCet article explique comment activer le serveur SSH sur un h\u00f4te VMWare ESXi 4.0 et comment mettre en place un \u00ab\u00a0authorized_keys\u00a0\u00bb durable (car le home du root saute \u00e0 chaque reboot). Je pr\u00e9sente aussi rapidement quelques trucs indispensables pour se promener dans l’h\u00f4te.
\nL’int\u00e9r\u00eat de la chose est de pouvoir lancer directement certaines commandes depuis un serveur ESXi via une session SSH et aussi, pour l’authentification par clef, de scripter certaines choses. Par exemple l’arr\u00eat \/ copie des fichiers vmdk \/ relance de serveurs pour automatiser des full backup offline.<\/p>\n

Let’s go!<\/p>\n

Activation du SSH<\/h1>\n

Ce n’est pas support\u00e9 par VMWare, mais \u00e7a existe quand m\u00eame. On se demande bien pourquoi \ud83d\ude42
\nSur la console de votre h\u00f4te, vous appuyez sur ALT-F1 pour passer sur une session console \u00ab\u00a0habituelle\u00a0\u00bb du monde Linux.
\nL\u00e0, en aveugle (pas d’\u00e9cho \u00e0 l’\u00e9cran), vous tapez \u00ab\u00a0unsupported\u00a0\u00bb, sans les guillemets bien s\u00fbr et validez par la touche \u00ab\u00a0Entr\u00e9e\u00a0\u00bb.
\nVous obtiendrez une demande de mot de passe, le pass de votre compte root.
\nCa y est, vous \u00eates connect\u00e9 \u00e0 la console.
\nVous pouvez alors aller \u00e9diter le fichier \/etc\/inetd.conf<\/code>, avec l’\u00e9diteur \u00ab\u00a0vi<\/code>\u00a0\u00bb et d\u00e9commenter la ligne SSH en IPv4.
\nEnsuite, soit vous red\u00e9marrez le serveur, soit vous red\u00e9marrez inetd<\/code>.
\nTestez votre connexion SSH depuis un autre ordi, histoire de valider.<\/p>\n

Et maintenant ?<\/h1>\n

Super, je peux faire du SSH sur le serveur, mais pour quoi faire ?
\nPersonnellement, il m’arrive de d\u00e9placer des machines virtuelles d’un serveur \u00e0 l’autre, dont les fichiers vmdk ne sont pas sur un SAN partag\u00e9. Plut\u00f4t que de super-gal\u00e9rer avec le \u00ab\u00a0vSphere Client\u00a0\u00bb -> \u00ab\u00a0Browse datastore\u00a0\u00bb -> etc, je pr\u00e9f\u00e8re faire faire quelques \u00ab\u00a0scp\u00a0\u00bb par exemple.
\nEt surtout, vous pouvez faire tout ce que permet \u00ab\u00a0vSphere Client\u00a0\u00bb mais en mode texte. Bref, parfois, c’est pratique.<\/p>\n

vim-cmd<\/h2>\n

L’outil essentiel est la command \u00ab\u00a0vim-cmd<\/code>\u00a0\u00bb (rien \u00e0 voir avec \u00ab\u00a0VIm\u00a0\u00bb), documentez-vous dessus.
\nCommencez par taper \u00ab\u00a0vim-cmd<\/code>\u00a0\u00bb tout seul, puis \u00ab\u00a0vim-cmd vmsvc\/<\/code>\u00a0\u00bb par exemple. Les noms de fonctions sont souvent \u00e9loquents.<\/p>\n

Vous pourrez par exemple :<\/p>\n

    \n
  • \nobtenir la liste des VM : vim-cmd vmsvc\/getallvms\n<\/li>\n
  • \nobtenir l’\u00e9tat d’une VM : vim-cmd vmsvc\/power.getstate <ID>\n<\/li>\n
  • \nen arr\u00eater proprement une (pas \u00ab\u00a0\u00e9lectriquement\u00a0\u00bb) : vim-cmd vmsvc\/power.off <ID>\n<\/li>\n
  • \nen rallumer une : vim-cmd vmsvc\/power.on <ID>\n<\/li>\n<\/ul>\n

    etc…<\/p>\n

    Stockage des machines virtuelles<\/h2>\n

    Dans \/vmfs\/volumes\/<\/code>, vous trouverez les noms de code de vos \u00ab\u00a0datastores\u00a0\u00bb et des liens symboliques pointant vers ces noms pourris, histoire de s’y retrouver. Ces liens sont les noms que vous avez affect\u00e9 via \u00ab\u00a0vSphere Client\u00a0\u00bb.
    \nDe l\u00e0, vous allez vite retrouver vos fichiers vmdk & co.<\/p>\n

    authorized_keys<\/h1>\n

    Si vous avez besoin de stocker dans le home du root (qui est \u00ab\u00a0\/\u00a0\u00bb et non un habituel \u00ab\u00a0\/root\u00a0\u00bb) un fichier \u00ab\u00a0~\/.ssh\/authorized_keys\u00a0\u00bb, sachez qu’il saute \u00e0 chaque reboot.
    \nCe que j’ai fait pour contrer cel\u00e0, c’est d’ajouter au script \u00ab\u00a0\/etc\/rc.local\u00a0\u00bb la recopie de ce fichier stock\u00e9 au pr\u00e9alable dans un \u00ab\u00a0datastore\u00a0\u00bb local.
    \nCa donne :<\/p>\n

    ~ # tail \/etc\/rc.local\r\n         if [ -f $filename ] && [ -x $filename ]; then\r\n            log \"running $filename\"\r\n            $filename\r\n         fi\r\n      done\r\nfi\r\n\r\nmkdir \/.ssh\r\ncd \/vmfs\/volumes\/DataStoreLocal\/pour_reboot\/.ssh\/\r\ncp authorized_keys \/.ssh\/<\/strong><\/pre>\n
    J’avais d’abord cr\u00e9\u00e9 ce fameux \u00ab\u00a0pour_reboot\u00a0\u00bb + le r\u00e9pertoire \u00ab\u00a0.ssh\/\u00a0\u00bb + le fichier \u00ab\u00a0authorized_keys\u00a0\u00bb dans le datastore qui va bien (ce n’est pas son nom d’origine, c’est plut\u00f4t \u00ab\u00a0datastore1\u00a0\u00bb sur une machine fra\u00eechement install\u00e9e).<\/p>\n
    Et voil\u00e0, avec un acc\u00e8s SSH, un h\u00f4te ESXi ressemble quand m\u00eame plus \u00e0 quelque chose, non ? \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
    EDIT avril 2015 : pour ESXi 5, 5.1 et 6.0, cf. dans les commentaires. Hello, Ce qui suit \u00e9tait valable jusqu’\u00e0 ESXi 4.0. Je n’ai pas regard\u00e9 en 4.1 pour l’instant. Vous me direz (ou …<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[391,82],"tags":[459,457,146,458,456],"class_list":["post-1151","post","type-post","status-publish","format-standard","hentry","category-autres-outils","category-pl","tag-datastore","tag-esxi","tag-ssh","tag-unsupported","tag-vmware"],"yoast_head":"\nVMESXi 4.0, acc\u00e8s root et authentification par clef SSH - Le blog de Michauko<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH - Le blog de Michauko\" \/>\n<meta property=\"og:description\" content=\"EDIT avril 2015 : pour ESXi 5, 5.1 et 6.0, cf. dans les commentaires. Hello, Ce qui suit \u00e9tait valable jusqu’\u00e0 ESXi 4.0. Je n’ai pas regard\u00e9 en 4.1 pour l’instant. Vous me direz (ou …\" \/>\n<meta property=\"og:url\" content=\"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/\" \/>\n<meta property=\"og:site_name\" content=\"Le blog de Michauko\" \/>\n<meta property=\"article:published_time\" content=\"2010-10-28T08:42:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2015-04-09T18:18:48+00:00\" \/>\n<meta name=\"author\" content=\"michauko\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"michauko\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/\"},\"author\":{\"name\":\"michauko\",\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/#\\\/schema\\\/person\\\/0cd9f3d9ce4dccc05df81a5b27051ea9\"},\"headline\":\"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH\",\"datePublished\":\"2010-10-28T08:42:36+00:00\",\"dateModified\":\"2015-04-09T18:18:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/\"},\"wordCount\":609,\"commentCount\":6,\"keywords\":[\"datastore\",\"ESXi\",\"ssh\",\"unsupported\",\"VMWare\"],\"articleSection\":[\"autres outils\",\"planet-libre.org\"],\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/\",\"url\":\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/\",\"name\":\"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH - Le blog de Michauko\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/#website\"},\"datePublished\":\"2010-10-28T08:42:36+00:00\",\"dateModified\":\"2015-04-09T18:18:48+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/#\\\/schema\\\/person\\\/0cd9f3d9ce4dccc05df81a5b27051ea9\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/michauko.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/michauko.org\\\/blog\\\/\",\"name\":\"Le blog de Michauko\",\"description\":\"Si tu ne comprends pas le titre de l'article, passe ton chemin\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/michauko.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/michauko.org\\\/blog\\\/#\\\/schema\\\/person\\\/0cd9f3d9ce4dccc05df81a5b27051ea9\",\"name\":\"michauko\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5c3a8969c185fd0eef3893a15408f3ef1b36a6681a066b1eb32045643c30ba65?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5c3a8969c185fd0eef3893a15408f3ef1b36a6681a066b1eb32045643c30ba65?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5c3a8969c185fd0eef3893a15408f3ef1b36a6681a066b1eb32045643c30ba65?s=96&d=mm&r=g\",\"caption\":\"michauko\"},\"sameAs\":[\"http:\\\/\\\/michauko.org\\\/\"],\"url\":\"https:\\\/\\\/michauko.org\\\/blog\\\/author\\\/randomized2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH - Le blog de Michauko","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/","og_locale":"fr_FR","og_type":"article","og_title":"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH - Le blog de Michauko","og_description":"EDIT avril 2015 : pour ESXi 5, 5.1 et 6.0, cf. dans les commentaires. Hello, Ce qui suit \u00e9tait valable jusqu’\u00e0 ESXi 4.0. Je n’ai pas regard\u00e9 en 4.1 pour l’instant. Vous me direz (ou …","og_url":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/","og_site_name":"Le blog de Michauko","article_published_time":"2010-10-28T08:42:36+00:00","article_modified_time":"2015-04-09T18:18:48+00:00","author":"michauko","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"michauko","Dur\u00e9e de lecture estim\u00e9e":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/#article","isPartOf":{"@id":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/"},"author":{"name":"michauko","@id":"https:\/\/michauko.org\/blog\/#\/schema\/person\/0cd9f3d9ce4dccc05df81a5b27051ea9"},"headline":"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH","datePublished":"2010-10-28T08:42:36+00:00","dateModified":"2015-04-09T18:18:48+00:00","mainEntityOfPage":{"@id":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/"},"wordCount":609,"commentCount":6,"keywords":["datastore","ESXi","ssh","unsupported","VMWare"],"articleSection":["autres outils","planet-libre.org"],"inLanguage":"fr-FR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/","url":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/","name":"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH - Le blog de Michauko","isPartOf":{"@id":"https:\/\/michauko.org\/blog\/#website"},"datePublished":"2010-10-28T08:42:36+00:00","dateModified":"2015-04-09T18:18:48+00:00","author":{"@id":"https:\/\/michauko.org\/blog\/#\/schema\/person\/0cd9f3d9ce4dccc05df81a5b27051ea9"},"breadcrumb":{"@id":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/michauko.org\/blog\/vmesxi-4-0-acces-root-et-authentification-par-clef-ssh-1151\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/michauko.org\/blog\/"},{"@type":"ListItem","position":2,"name":"VMESXi 4.0, acc\u00e8s root et authentification par clef SSH"}]},{"@type":"WebSite","@id":"https:\/\/michauko.org\/blog\/#website","url":"https:\/\/michauko.org\/blog\/","name":"Le blog de Michauko","description":"Si tu ne comprends pas le titre de l'article, passe ton chemin","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/michauko.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/michauko.org\/blog\/#\/schema\/person\/0cd9f3d9ce4dccc05df81a5b27051ea9","name":"michauko","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/5c3a8969c185fd0eef3893a15408f3ef1b36a6681a066b1eb32045643c30ba65?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5c3a8969c185fd0eef3893a15408f3ef1b36a6681a066b1eb32045643c30ba65?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5c3a8969c185fd0eef3893a15408f3ef1b36a6681a066b1eb32045643c30ba65?s=96&d=mm&r=g","caption":"michauko"},"sameAs":["http:\/\/michauko.org\/"],"url":"https:\/\/michauko.org\/blog\/author\/randomized2\/"}]}},"_links":{"self":[{"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/posts\/1151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/comments?post=1151"}],"version-history":[{"count":7,"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/posts\/1151\/revisions"}],"predecessor-version":[{"id":1677,"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/posts\/1151\/revisions\/1677"}],"wp:attachment":[{"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/media?parent=1151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/categories?post=1151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michauko.org\/blog\/wp-json\/wp\/v2\/tags?post=1151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}