1

Today i installed a new ESX 7.0 Hypervisor machine. My initial goal was to get some RAID status reporting.

I created a python script that i wantet to run from a crontab job. This due to the fact that my RAID controller (Supermicro 3108) has faulty drivers and all status on storage devices in monitoring just says unknown.

I was able to create and run my python script and add it to crontab.

/bin/kill $(cat /var/run/crond.pid)
/bin/echo '5 0 * * * /path/to/script > /full/path/to/logfile 2>&1' >> /var/spool/cron/crontabs/root
/bin/busybox crond

But when i wanted to make the crontab changes persistent over reboot, i now see that i cannot write to files in ESX 7.X.

/etc/rc.local - write to permissions denied.
chmod xxxx /etc/rc.local - Operation not permitted.

I believe this relates to: https://kb.vmware.com/s/article/78689

I am using my root user and ssh enabled to login.

Does anyone have any tips on how to regain permission on files in ESX 7.X?

Improve this question

3 Answers 3

Reset to default
3

As already stated by Chopper3, you really shouldn't, by design, run anything except ESXi on a vSphere host. And this new security measure is just in line with that, as locking down the filesystem gives tremendous security improvements.

Also, keep in mind that in a lot of larger environments ESXi might not even have persistent storage, as hosts are PXE booted over the network with ESXi and just keep what they need in RAM.

The way forward regarding this is to use PowerCLI as you've already identified.

Improve this answer
5

I agree with the other contributions about not doing anything "inside" ESXi, but manage it remotely with the supported tools like PowerCLI.

However, I also want to help you with your original question: Even in ESXi 7.0 some files can still be edited, e.g. /etc/rc.local.d/local.sh. This script will be executed by /etc/rc.local, so you can add your commands there.

You just need to be aware that this script will not be executed if you have UEFI Secure boot enabled on your host.

Improve this answer
1
  • Thanks for your time :) I believe that also /etc/rc.local.d/local.sh is governed by ESXs new file protection scheme. But I have gotten quite fond of PowerCLI, så that is the route I'm taking.
    – boomdrak
    Nov 19, 2020 at 7:31
3

ESXi never was and certainly isn't now a general purpose Linux that you should go hacking around in, unfortunately too many people chose to ignore this and gave themselves and VMware support issues - so they've closed the door on this, or at least tried to, no-doubt some smart-alec will work out some way of making their lives harder by cracking it but you should use the product as it's meant to be used.

Improve this answer
1
  • 1
    I agree in your assessments. The issue is that ESX 7 has rendered a lot og hardware drivers obsolete. I am pretty sure there are many other situations where custom configuration of serveres are in order. Im currently working on an approach where im trying to script with PowerCLI and run the scripts from a remote system in the same network. On a second note, VMware Support is a payed service, so it should be a good business model :)
    – boomdrak
    Nov 15, 2020 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .