| NOTE:
Due to the delayed release of VMware's Virtual Infrastructure 3.0, the
RDP product development team did not have sufficient time to develop
full support for ESX 3.0.0 as a deployed OS. This document
provides a temporary workaround for deploying ESX 3.0 using RDP 3.00, until such
time as Altiris and HP provide official support for ESX 3.0 deployment
in a future release of Rapid Deployment Pack. I have tried to
keep as close as possible to the syntax and methods the product team are either
currently using for ESX 2.x deployments, or are likely to use in future
releases, but this method is still highly customized, and should only
be attempted by customers with a high level of comfort with Rapid
Deployment Pack. Some things you should be aware of:
|
|
WARNING! - WARNING! - WARNING! DO NOT connect, or leave connected, any SAN volumes to any server while being deployed or redeployed by Rapid Deployment Pack. Both the Linux and WinPE pre-boot environments will enumerate the SAN volumes ahead of any on-board drives, with the result that the default behavior of the Altiris RDeploy client to drop an image on the primary drive will result in the complete loss of the partition table and file system on the first SAN volume! The only way to avoid this is to know exactly how many SAN volumes will be presented to your target system, and to modify the Distribute Disk Image tasks to reference the correct logical drive number of the first locally-attched drive. Since this is impossible to predict, there is no way to provide a "fail-safe" configuration for the stock jobs included with RDP. So, make sure to un-zone or un-present any SAN volumes to any server you will deploy or redeploy with RDP. You have been warned. |
| NOTE: When editing text files that will be parsed by Linux-based scripting or deployment utilities like the installation programs for Linux and VMware ESX Server, the files must be saved with the correct UNIX-style text formatting style to prevent the parsing program from choking on extra escape characters present in MS-DOS-style text formatting. None of the editors included with Windows will properly save these files. Find a Windows text editor (no, not Word - think outside the box, will you?) that will understand and preserve UNIX text formatting. A good one (which I sometimes use to edit this HOWTO) is Notepad++, a free, open source editor with language syntax highlighting and many other nice features, available from http://notepad-plus.sourceforge.net. |
login as: root root@esxserver's password: Last login: Mon Aug 8 01:34:33 2005 [root@esxserver root]# cat /etc/shadow | grep root root:$1$9AhIo0QH$U4.lMEa4KBB/Q5kGXyV2F9:12884:0:99999:7:::The string of gibberish text between the first and second colon in the output from the /etc/shadow file (bold and highlighted in red in the example above) is the MD5 hash of the root user's password on the ESX server. Copy the string to the clipboard from your SSH session, and paste it into your config file (see below) to replace "password" in the rootpw directive line. To signify to anaconda that the string is the actual encrypted hash of the plaintext password, and not the plaintext itself, you will need to add "--iscrypted" to the line before the value, as illustrated in this example:
[root@esxserver root]#
rootpw --iscrypted $1$9AhIo0QH$U4.lMEa4KBB/Q5kGXyV2F9
NOTE:
The default security settings in ESX Server 3.0.0 will not allow the root user to log in via SSH.
There are two workarounds for this: The first, and most secure, is to create a normal user account
that can be used for the initial SSH access, and use "su" to
then gain root access once the session is established. The second, less secure, method is to
log in at a physical console (with an Alt-F1), and change the following line in the
/etc/ssh/sshd_config file to look like this:
PermitRootLogin yes |
#ESX 3.0.0 Kickstart File # Installation Method # This follows the syntax from the existing ESX 2.5.3 kickstart file in RDP # The SQL query in the % symbols will evaluate to the RDP server's IP address during Altiris token replacement url --url ftp://anonymous:rdp@%#*"select tcp_addr from aclient_prop where computer_id=0"%/dslib/osdist/vmesx300 # root password # either Encrypted (use "mkpasswd -H md5" on a Linux system, # or pull from an existing ESX server's /etc/shadow file between colons) - # The MD5-encrypted string below is for "password": #rootpw --iscrypted $1$MRMN1nFH$PAHncVeTgCrI0GXVUdBiJ0 # or Plaintext: rootpw password # Authentication config # Turns on shadow suite and uses long encrypted passwords auth --enableshadow --enablemd5 # BootLoader ( ESX uses 'grub' ) # Runs from within the master boot record of the boot drive bootloader --location=mbr # Timezone # See /usr/share/zoneinfo for complete list # Common US timezone names can be used, e.g.: # US/Hawaii, US/Alaska, US/Pacific, US/Mountain, US/Central, US/Eastern # Special US timezones for US/Arizona, US/East-Indiana, US/Indiana-Starke, US/Michigan # Always use the "--utc" option, so the hardware clock uses UTC, preventing double-shifts for DST timezone --utc US/Pacific # X windowing System - not used in ESX skipx # Install or Upgrade install # Text Mode setup wizard text # Network install type # Create a default network for Virtual Machines # This will use hijacked Netware configuration fields populated for the host in the Altiris database to provide a static address # The DNS hostname is provided via token replacement of the SQL query network --bootproto static --ip=%NWSERVER% --gateway=%NWTREE% --netmask=%NWCONTEXT% --nameserver=--hostname %#*"select replace([name],' ','') from computer where computer_id={ID}"% --addvmportgroup=1 --vlanid=0 # Language lang en_US # Language Support langsupport --default en_US # Keyboard layout keyboard us # Mouse mouse none # Reboot after install ? reboot # Firewall settings firewall --disabled # Clear partitions clearpart --all --initlabel --drives=%hddevice% # Partitioning # Warning, the order of these lines determines placement on the disk! # Based on best practice recommendations # %hddevice% will be defined by the lib\bin32\linux\vmesx.sh script prior to file placement # 100MiB boot partition first part /boot --size 100 --fstype ext3 --ondisk %hddevice% # Root filesystem partition - default is ~5GiB, can be made larger if desired part / --size 5000 --fstype ext3 --ondisk %hddevice% # Swap partition (~2x Service Console RAM allocation, Linux kernel maximum of 2048MiB) part swap --size 1024 --fstype swap --ondisk %hddevice% # System log partition - always break out. part /var/log --size 2000 --fstype ext3 --ondisk %hddevice% # /tmp partition - always break out. part /tmp --size 2000 --fstype ext3 --ondisk %hddevice% # Local VMFS partition (not used much in shared SAN environments) # First argument must be "None" or install will halt # Minimum size for a VMFS3 volume is 1200MiB # This only creates the partition, you must create the filesystem later part None --size 10000 --grow --fstype vmfs3 --ondisk %hddevice% # vmkernel core dump partition - must be 100MiB # First argument must be "None" or install will halt # Must keep this as the last line in partitioning section, to place at the end of the disk part None --size 100 --fstype vmkcore --ondisk %hddevice% # VMware-specific licensing commands # must accept EULA, or install will halt vmaccepteula # Using served licenses from VI3 License Server vmlicense --mode=server --server=27000@192.168.1.30 --edition=esxFull --features=vsmp,backup %packages @base %post # Download the altiris agent binaries during post # FTP server evaluates to RDP server's IP address during token replacement ftpip=%#*"select tcp_addr from aclient_prop where computer_id=0"% # Transfer Altiris Linux agent, adlagent mkdir /tmp/altiris cd /tmp/altiris # Perform ftp transfer ftp -n <<EOF2 open $ftpip user anonymous rdp cd /dslib/osoem/altiris binary prompt # Download x86 adlagent mget altiris*.i386.bin # Download custom adlagent config if it exists mget adlagent.conf.custom exit EOF2 # create script to install adlagent (called by rc.local) cat > /tmp/altiris/hpinstall.sh <<\EOF1 #!/bin/bash # Script to install adlagent. Is called from rc.local. export AltirisConfDir=/opt/altiris/deployment/adlagent/conf cd /tmp/altiris chmod +x altiris-adlagent*.bin ./altiris-adlagent*.i386.bin 1>>/root/install.rdp.log 2>>/root/install.rdp.log # Install adlagent custom configuration if [ -e adlagent.conf.custom ]; then mv $AltirisConfDir/adlagent.conf $AltirisConfDir/adlagent.conf.bak cp -f adlagent.conf.custom $AltirisConfDir/adlagent.conf fi mv -f /etc/rc.d/rc.local.sav /etc/rc.d/rc.local /etc/init.d/adlagent restart EOF1 # make hpinstall.sh executable chmod +x /tmp/altiris/hpinstall.sh ##################################################### ### Create script to configure ESX at first boot ### ##################################################### cat > /tmp/esxcfg.sh <<\EOF3 #!/bin/sh # Configure ESX Server # Create new vmfs3 volume on designated partition # First, determine the partition number (assumes SmartArray) export VMFS_PARTITION=`fdisk -l /dev/cciss/c0d0 | grep fb | sed -e "s/\/dev\/cciss\/c0d0p\(.\).*/\1/"` # Now we make a VMFS3 volume on that partition vmkfstools -C vmfs3 -S localvmfs vmhba0:0:0:$VMFS_PARTITION ### Firewall configuration # We need to enable adlagent port and file transfer port # You need to set a static port ("4321" in this example) for file transfer in the deployment # console under Tools->Options->Global esxcfg-firewall --openPort 402,tcp,out,adlagent esxcfg-firewall --openPort 4321,tcp,out,adlagentFileTransfer ### Configuration Examples # Uncomment and/or modify the example lines below to use in your configuration # Setup your VMkernel and Virtual Machine networking: # EXAMPLE: Add VMotion portgroup esxcfg-vswitch --add-pg=VMotion vSwitch0 # EXAMPLE: Make VMotion portgroup part of VMKernel stack # Remember to enable VMotion on this interface using the VI Client! # IP address can be obtained from the Windows licensing user field during token replacement #esxcfg-vmknic --add --ip %#!computer@lic_os_user% --netmask 255.255.255.0 VMotion # EXAMPLE: Setup the VMkernel IP Stack default gateway # GW address can be obtained from the Windows licensing organization field during token replacement #esxcfg-route %#!computer@lic_os_org% # EXAMPLE: Create production vSwitch using remaining physical NICs and default portgroup(s) #esxcfg-vswitch --add prodSwitch #export VMNICS=`esxcfg-nics --list | sed -e '1d' -e '/vmnic0/d' | awk '{print $1}'` #for i in $VMNICS; do esxcfg-vswitch --link=$i prodSwitch; done #esxcfg-vswitch --add-pg=defaultProd prodSwitch # or #esxcfg-vswitch --vlan=1 -p defaultProd prodSwitch # EXAMPLE: Create private vSwitch and default portgroup #esxcfg-vswitch --add privateSwitch #esxcfg-vswitch --add-pg=defaultPrivate privateSwitch # or #esxcfg-vswitch --vlan=11 -p defaultPrivate privateSwitch # SSH Access: # EXAMPLE: Create additional user account for SSH access # The encrypted password is 'password' useradd -p '$1$MLsmTO/Q$A8QI139I.QqRVVjXPYfDU1' -c "Guest Account" guest # EXAMPLE: Enable root login via SSH # WARNING: This is not the most secure course of action! #sed -e 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_config > /etc/ssh/sshd_config.new #mv -f /etc/ssh/sshd_config.new /etc/ssh/sshd_config #/etc/init.d/ sshd restart EOF3 # make configuration script executable chmod +x /tmp/esxcfg.sh ##################################################### # save a copy of rc.local cp /etc/rc.d/rc.local /etc/rc.d/rc.local.sav # add hpinstall.sh and esxcfg.sh to rc.local cat >> /etc/rc.d/rc.local <<EOF cd /tmp /tmp/esxcfg.sh cd /tmp/altiris /tmp/altiris/hpinstall.sh EOF
| A note about Altiris token replacement Altiris eXpress Deployment Server has the ability to search through text files and replace custom tokens with information from its database. By specifying the tokens listed above, we can have the deployment server pre-populate the kickstart file with the appropriate values from the database for that target server. The reason I am using the NetWare- and Windows licensing- specific tokens instead of the default IP configuration tokens is that when the target system is brought up in DOS/Linux/WinPE prior to OS deployment, these fields are often overwritten with the current values obtained from the Bootworks client, e.g., a DHCP-assigned address, while the NetWare-specific tokens are normally applied to Windows hosts after the OS is installed. Since the Altiris client cannot tweak NetWare or Windows Licensing settings on a Linux or ESX host, we can safely hijack these fields in the database for our own purposes, and they will remain in the database after deployment. |
# Create Boot Environment # replacetokens .\lib\osconfig\vmesx300\default.cfg .\lib\osconfig\vmesx300\%ID%.cfg export dist=vmesx300 export unattendfile=%ID%.cfg /mnt/ds/lib/bin32/linux/vmesx.sh
# Create Boot Environment # replacetokens .\lib\osconfig\vmesx300\default.cfg .\lib\osconfig\vmesx300\%ID%.cfg export dist=vmesx300 export unattendfile=%ID%.cfg /mnt/ds/lib/bin32/linux/vmesx.sh
<?xml version="1.0" encoding="UTF-8"?>
<system-management-homepage>
<admin-group></admin-group>
<!-- semicolon-delimited list of add'l admin groups, e.g. wheel;admins -->
<operator-group></operator-group>
<!-- same as above -->
<user-group></user-group>
<!-- same as above -->
<allow-default-os-admin>true</allow-default-os-admin>
<anonymous-access>false</anonymous-access>
<localaccess-enabled>false</localaccess-enabled>
<localaccess-type>Anonymous</localaccess-type>
<!-- Anonymous or Administrator -->
<trustmode>TrustByCert</trustmode>
<!-- Can also be TrustByName or TrustAll, default is TrustByCert -->
<xenamelist></xenamelist>
<!-- hostnames of CIM7 / HPSIM mgmt servers needed only for TrustByName -->
<ip-binding>false</ip-binding>
<ip-binding-list></ip-binding-list>
<!-- semicolon-delimited address/mask value list,
e.g. 10.1.1.1/255.0.0.0;192.168.1.1/255.255.255.0 -->
<ip-restricted-logins>false</ip-restricted-logins>
<ip-restricted-include></ip-restricted-include>
<!-- semicolon-delimited list of addresses or ranges,
e.g. 10.1.1.2;10.1.1.3;192.168.1.2-192.168.1.254 -->
<ip-restricted-exclude></ip-restricted-exclude>
<!-- same as above -->
</system-management-homepage>
# Populate HPSIM Trust Certificate and SSH Key cd /opt/altiris/deployment/adlagent/tmp/lsp mkdir -p /opt/hp/hpsmh/certs cp *.pem /opt/hp/hpsmh/certs/ chown -R 79:79 /opt/hp/hpsmh/ mkdir -p /root/.ssh/ cp authorized_keys2 /root/.ssh/ chmod 700 /root/.ssh/
# Populate HPSIM Trust Certificate and SSH Key cd /opt/altiris/deployment/adlagent/tmp/lsp mkdir -p /opt/hp/hpsmh/certs cp *.pem /opt/hp/hpsmh/certs/ chown -R 79:79 /opt/hp/hpsmh/ mkdir -p /root/.ssh/ cp authorized_keys2 /root/.ssh/ chmod 700 /root/.ssh/
#Install iLO Configuration Utility cd /opt/altiris/deployment/adlagent/tmp/lsp rpm -Uvh --nopre hponcfg-*.rpm >/root/hponcfg_install.log 2>/root/hponcfg_install.log
#Upgrade iLO Firmware 1.84 cd /opt/altiris/deployment/adlagent/tmp/lsp chmod +x CP*.scexe ./CP006488.scexe -s -f >/root/iLOfirmware.log 2>/root/iLOfirmware.log sleep 60s
#Configure iLO cd /opt/altiris/deployment/adlagent/tmp/lsp hponcfg -f iLOconfig.xml -m 1.80 -l /root/iLOconfig.log -v
|
WARNING! - WARNING! - WARNING! DO NOT connect, or leave connected, any SAN volumes to any server while being deployed or redeployed by Rapid Deployment Pack. Both the Linux and WinPE pre-boot environments will enumerate the SAN volumes ahead of any on-board drives, with the result that the default behavior of the Altiris RDeploy client to drop an image on the primary drive will result in the complete loss of the partition table and file system on the first SAN volume! The only way to avoid this is to know exactly how many SAN volumes will be presented to your target system, and to modify the Distribute Disk Image tasks to reference the correct logical drive number of the first locally-attched drive. Since this is impossible to predict, there is no way to provide a "fail-safe" configuration for the stock jobs included with RDP. So, make sure to un-zone or un-present any SAN volumes to any server you will deploy or redeploy with RDP. You have been warned. |
|
WARNING! - WARNING! - WARNING! DO NOT connect, or leave connected, any SAN volumes to any server while being deployed or redeployed by Rapid Deployment Pack. Both the Linux and WinPE pre-boot environments will enumerate the SAN volumes ahead of any on-board drives, with the result that the default behavior of the Altiris RDeploy client to drop an image on the primary drive will result in the complete loss of the partition table and file system on the first SAN volume! The only way to avoid this is to know exactly how many SAN volumes will be presented to your target system, and to modify the Distribute Disk Image tasks to reference the correct logical drive number of the first locally-attched drive. Since this is impossible to predict, there is no way to provide a "fail-safe" configuration for the stock jobs included with RDP. So, make sure to un-zone or un-present any SAN volumes to any server you will deploy or redeploy with RDP. You have been warned. |