VMware ACE Use and care manual

ACE Management Server
Administrator’s Manual
VMware ACE 2.6
This document supports the version of each product listed and
supports all subsequent versions until the document is replaced
by a new edition. To check for more recent editions of this
document, see http://www.vmware.com/support/pubs.
EN-000169-00

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2VMware, Inc.
ACE Management Server Administrator’s Manual
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
[e-mail]
Copyright © 2007–2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and
intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks
and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3
Contents
AboutThisBook 7
1Introduction 9
FeaturesofACEManagementServer 9
SystemRequirements 10
RequiredHardware 10
SupportedOperatingSystems 10
SupportedExternalDatabases 10
SupportedProxies 11
RequiredWebBrowsers 11
Licensing 11
2PlanninganACEManagementServerDeployment 13
DeploymentComponents 13
HostSystemOptions 14
WindowsHosts 14
LinuxHosts 14
ServerApplianceOption 14
DatabaseOptions 15
ActiveDirectoryAuthenticationOptions 15
PerformingCapacityPlanning 15
DatabaseThroughputandScalability 16
LDAPThroughput 16
NetworkBandwidthandPolicyUpdateFrequency 16
ACEPolicyConfiguration 17
LoadBalancers 17
SecurityFeaturesandConsiderations 17
UsingSSLCertificatesandProtocol 18
AccessingACEManagementServerfromOutsidetheCorporateFirewall 19
DeploymentPlanningWorksheet 19
3InstallingandConfiguringACE Management Server 21
PreparingforInstallation 21
ConfigureTLSinYourBrowser 21
InstallingandUpgradingACEManagementServer 22
InstallanACEManagementServeronaWindowsHost 22
InstallACEManagementServeronaLinuxSystem 23
InstallanACEManagementServerAppliance 24
VerifyThattheApacheServiceIsStartedorRestarted 25
StartandConfigureACEManagementServer 26
LogIntoACEManagementServer 26

ACE Management Server Administrator’s Manual
4VMware, Inc.
4ConfigurationOptionsforACEManagementServer 29
PrerequisitesforConfiguringtheServer 29
CreateUsersandGroupsforIntegrationwithActiveDirectory 29
SetUpanExternalDatabase 30
CreatingaSystemDSNEntryforanExternalDatabase 31
IncreasetheNumberofDatabaseConnectionsAllowed 32
EnableDatabaseConnectionPoolingonLinux 33
SetUpaConnectionBetweentheServerApplianceandanExternalDatabase 33
PrepareCustomSecurityCertificates 33
ViewthePropertiesoftheSelf‐SignedCertificateFile 34
StartingACEManagementServerConfiguration 34
ViewingandChangingLicensingInformation 34
UsinganExternalDatabase 35
CreatingAccessControl 35
UploadingCustomSSLCertificates 36
LoggingEvents 37
ApplyingConfigurationSettings 37
5Load‐BalancingMultipleACEManagementServerInstances 39
TypicalSetupUsingLoad‐BalancedACEManagementServerInstances 40
InstalltheRequiredServicesforLoadBalancing 40
UsetheSameSSLCertificateonAllServers 41
CreateNewSSLCertificatesandKeysforEachServer 41
InstallingandConfiguringtheLoadBalancer 43
VerifyThatACEInstancesAreUsingtheLoadBalancer 43
6ManagingACEInstances 45
ViewingACEInstancesThattheServerManages 45
UsetheVMwareACEHelpDeskApplication 46
UsetheInstanceViewinWorkstation 46
SearchforanInstance 47
SortbyColumnHeadingandChangeColumnWidth 47
Show,Hide,andMoveColumnsintheInstanceView 48
CreateorDeleteCustomColumnsintheInstanceView 48
ViewInstanceDetails 48
Reactivate,Deactivate,orDeleteanACEInstance 49
PoliciesTab 49
ChangeaCopyProtectionID 49
ResettheAuthenticationPassword 50
AddInformationforCustomColumns 50
7TroubleshootingandMaintenance 51
TroubleshootingConfigurationProblems 51
ConnectionProblemsBetweenaLinuxACEInstanceandACEManagementServer 51
ChangethePortAssignmentforACEManagementServer 51
DeletetheServerConfigurationFileandSetaNewAdministratorPassword 52
RestoreaBackupCopyofanSSLCertificate 52
ConfiguringMultipleACEManagementServerInstancestoUseSSL 53
DatabaseBackup 53

VMware, Inc. 5
Contents
Appendix:DatabaseSchemaandAuditEventLogData 55
UsingDatabaseReportingTools 55
DatabaseSchema 55
QueryingtheAuditEventLogData 59
Glossary 63
Index 65

ACE Management Server Administrator’s Manual
6VMware, Inc.

VMware, Inc. 7
Thismanual,theVMwareACEManagementServerAdministrator’sManual,providesinformationabout
installingandusingtheVMware®ACEManagementServer,whichenablesyoutomanageACEinstancesin
realtime.UsingACEManagementServerisoptional,butdoingsoprovidesthefollowingbenefits:
ManageactivationofACEpackages.
Manageauthenticationofthoseactivatedpackages.
DynamicallydeliverpolicyupdatestomanagedACEinstances.
DynamicallydeliverinstancecustomizationdataformanagedACEinstanceswithWindowsguest
operatingsystems.
Intended Audience
Thisbookisintendedforanyonewhoneedstoinstall,upgrade,oruseACEManagementServertomanage
ACEinstances.ACEManagementServerisintendedforACEadministratorswhomustmaintainandupdate
ACEpoliciesusedonvirtualmachinesdeployedthroughoutanenterprise.
Document Feedback
VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour
feedbackto:
[email protected]
Technical Support and Education Resources
Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion
ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.
Online and Telephone Support
Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and
registeryourproducts,gotohttp://www.vmware.com/support.
Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon
priority1issues.Gotohttp://www.vmware.com/support/phone_support.html.
Support Offerings
TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto
http://www.vmware.com/support/services.
About This Book

ACE Management Server Administrator’s Manual
8VMware, Inc.
VMware Professional Services
VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials
designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive
online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides
offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout
educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 9
1
TheVMwareACEManagementServerenablesyoutomanageVMwareACEinstances,todynamically
publishpolicychangesforthoseinstances,andtotestanddeploypackagesmoreeasily.
Thischapterincludesthefollowingtopics:
“FeaturesofACEManagementServer”onpage 9
“SystemRequirements”onpage 10
Features of ACE Management Server
ACEManagementServeroffersscalabilityandreliability:
Youcanincreasecapacitybyaddingnetworkresourcessuchasloadbalancersandextraserverhardware.
Fortestingenvironments,thedefaultembeddedbackingstoreprovidesasimpleandefficientdatabase
solution.ToscaleACEManagementServerforproductiondeployments,youcanconfigureandusean
externalrelationaldatabasemanagementsystem(RDBMS).
InWindows,multithreadedprocesseshandleserverrequests.InLinux,multipleprocesseshandleserver
requests.Ifoneprocessfails,anothertakesover.
ACEManagementServeroffersActiveDirectoryintegration:
YoucanuseActiveDirectorytoauthenticateusersofACEinstances.
YoudonotneedaschemachangeforyourexistingActiveDirectory.
LDAPisusedtoaccessActiveDirectory.
InformationaboutWindowsdomainuseraccountstatesisprovidedinclearandusefulmessages.
Reasonsforloginfailuresarepresentedas“lockedout”or“passwordexpired.”
ACEManagementServeractsasanActiveDirectorypasswordchangeproxy.
YoucanusetheinstancecustomizationfeatureinACEwithyourownestablishednamingconventionsto
associateuserswithmachines.
Securityfeaturesincludethefollowing:
EncryptedcommunicationsbetweenserverandclientstraveloverHTTPStraffic.
Passwordsarestoredsecurelyinhashedforminthebackingstore.
FlexibledatabaseoptionsallowuseofanembeddeddatabaseorexternalRDBMStostoreACEinstance
dataandpolicies.
Introduction 1

ACE Management Server Administrator’s Manual
10 VMware, Inc.
ACEManagementServeriseasytoinstallandconfigure.Clienttrafficcanbeproxiedbyeasilyavailable
products.Theserveruseseasilyavailablesoftwarecomponents:
ApacheWebserver2.0
ThedefaultSQLitedatabasestore
Theserversetupusesindustry‐standardprotocols:
HTTPSandLDAP
XML‐RPCformessageencapsulation
ACEManagementServeroffersextensibilityandavailability:
YoucancreateandusemorethanoneACEManagementServer.Whenyouusemorethanoneserver,you
cansettheserversupsothattheysharethesamedatabaseforloadbalancingorincreasedfaulttolerance.
AWindowsACEManagementServercanbeonthesamesystemasWorkstation.
YoucandesignateasingleACEManagementServername,suchas
https://ace.policyserver.company.com,anduseDNSlookuptotranslatethehostnametoan
address.TheaddressiscachedifaDNSserverisnotavailable.Additionally,youcanusedifferentACE
ManagementServerinstancesifuserstravelbetweenofficesindifferentgeographiclocations.
System Requirements
ThefollowingsectionsdescribetheACEManagementServersystemrequirements.
Required Hardware
Aminimumofan800MHz‐compatiblex86andx86‐64architectureprocessor
Compatibleprocessorsinclude:
Celeron,PentiumII,PentiumIII,Pentium4,PentiumM(includingcomputerswithCentrinomobile
technology),Xeon(includingPrestonia),AMD,Athlon,Athlon MP,AthlonXP,Duron,Opteron,AMD64
Opteron,andAthlon64
ExperimentalsupportforIntelIA‐32eCPU
40MBoffreespaceisrequiredforbasicinstallation.VMwarerecommendsatleast10GBoffreediskspace.
An8‐bitdisplayadapterisrequired.
Forlocalareanetworking,anyEthernetcontrollerthattheoperatingsystemsupportsissufficient.
Supported Operating Systems
FollowingarethesupportedoperatingsystemsforACEManagementServer:
WindowsServer2003WebEditionSP1andSP2,WindowsServer2003StandardEditionSP1andSP2,
WindowsServer2003EnterpriseEditionSP1andSP2(includes64‐bitandR2editions)
WindowsXPProfessional(includes64‐biteditions)
Windows2000ServerServicePack4andWindows2000AdvancedServerServicePack 4
RedHatEnterpriseLinuxAdvancedServer4.0withUpdate 4.
SUSELinuxEnterpriseServer9ServicePack3
NOTEYourservernamemustbeeitherthemachinenameinEnglishortheIP address.International
charactersarenotsupported.