This was a recent question that was asked internally about the minimum privileges required to query VIBs on an ESXi host. The request was for a custom script that was developed for compliance check and the customer was looking to create a custom vSphere role to minimize the privileges needed to perform the task. Since I did not know the answer, it was off to the lab for some testing. Through the process of elimination, it turns out the only privilege that is required for querying VIBs on an ESXi host is Global.Settings.
In the example above, I created a custom vCenter Server Role called VIBQuery and enabled the Global.Settings privilege and assigned the role to a user. The custom role can be created on both a vCenter Server as well as directly on an ESXi host. By using vCenter Server, one can benefit from centralize management of user access to all ESXi hosts in the environment.
To confirm that our user assigned to the new role can query VIBs on an ESXi host, we will run the following ESXCLI command:
1
esxcli--server[VC-SERVER]--vihost[ESXi-SERVER]--username[USER]software vib list
We can also confirm that we can do the same directly on the ESXi host by running the following ESXCLI command:
1
esxcli--server[ESXi-SERVER]--username[USER]software vib list
When granting access to your vSphere infrastructure, you should always use good security practices by leveraging RBAC model (Role-Base Access Control) and restrict the amount permission a user has access to.
UPDATE: In addition to using ESXCLI, there are two additional options to query installed VIBs on an ESXi host as noted by the comment below by Mike.
Get notification of new blog postings and more by following lamw on Twitter: @lamw
In the example above, I created a custom vCenter Server Role called VIBQuery and enabled the Global.Settings privilege and assigned the role to a user. The custom role can be created on both a vCenter Server as well as directly on an ESXi host. By using vCenter Server, one can benefit from centralize management of user access to all ESXi hosts in the environment.
To confirm that our user assigned to the new role can query VIBs on an ESXi host, we will run the following ESXCLI command:
We can also confirm that we can do the same directly on the ESXi host by running the following ESXCLI command:
When granting access to your vSphere infrastructure, you should always use good security practices by leveraging RBAC model (Role-Base Access Control) and restrict the amount permission a user has access to.
