2.7
Table Of Contents
- ACE Management Server Administrator’s Manual
- Contents
- About This Book
- Introduction
- Planning an ACE Management Server Deployment
- Installing and Configuring ACE Management Server
- Configuration Options for ACE Management Server
- Prerequisites for Configuring the Server
- Starting ACE Management Server Configuration
- Viewing and Changing Licensing Information
- Using an External Database
- Creating Access Control
- Uploading Custom SSL Certificates
- Logging Events
- Applying Configuration Settings
- Load-Balancing Multiple ACE Management Server Instances
- Typical Setup Using Load-Balanced ACE Management Server Instances
- Install the Required Services for Load Balancing
- Use the Same SSL Certificate on All Servers
- Create New SSL Certificates and Keys for Each Server
- Installing and Configuring the Load Balancer
- Verify That ACE Instances Are Using the Load Balancer
- Managing ACE Instances
- Viewing ACE Instances That the Server Manages
- Search for an Instance
- Sort by Column Heading and Change Column Width
- Show, Hide, and Move Columns in the Instance View
- Create or Delete Custom Columns in the Instance View
- View Instance Details
- Reactivate, Deactivate, or Delete an ACE Instance
- Change a Copy Protection ID
- Reset the Authentication Password
- Add Information for Custom Columns
- Troubleshooting and Maintenance
- Appendix: Database Schema and Audit Event Log Data
- Glossary
- Index
VMware, Inc. 35
Chapter 4 Configuration Options for ACE Management Server
Bydefault,duringACEManagementServerinstallation,thefollowingtwofilesarecreated:
server.key–ThisRSA1024‐bitkeyistheprivatekey.
server.crt–Thisself‐signedcertificateisvalidfor10yearsfromthedateandtimeatwhichtheserveris
installed.Itssignatureisverifiedbythepublickey,whichisembeddedinthecertificate.Thecertificate
fileisencodedinPEMformat.
WhenyourunanACEinstance,
theVMwarePlayerapplicationusesthecompletecertificationchainthatis
includedinitspackage,notonthehost,toverifyconnectionsmadetoACEManagementServer.Therefore,
theuseofself‐signedcertificatesisadequateformostsecurityneeds.Formoreinformationabouthow
VMwareACEusessecuritycertificates,see
“UsingSSLCertificatesandProtocol”onpage 16.
WhenyouclickUploadcertificates,asummarypagedisplaysthefilesandlocationsyouspecifyonthistab.
Notethelocationofanybackupfiles.Youmightneedtousethebackupifyoufindthatthenewfileisinvalid
whenyou
clickApply.See“RestoreaBackupCopyofanSSLCertificate”onpage 50.
AfteryouuploadcustomSSLcertificates,youmustupdateanyexistingACE‐enabledvirtualmachinestouse
anewcertificateandkeyfile.Todoso,useWorkstationtocreateanupdatepackage.Whenyoudeploythe
newpackage,ACEinstancesreceivethenewcertificatefileandcertificatechain.
Logging Events
Theservercollectslogentriesforeventsthatchangethedatabase.OntheLoggingtab,youcansetthelogging
levelsandsetanoptionforpurginglogentries.
ACEManagementServerusesthefollowingloggingcategories:
ACEAdministration–Logseventsforinstancecreation,update,anddestruction.
PackageAdministration–Logseventsforpackagecreation,update,instancecustomization,andpackage
removal.
PolicyAdministration–Logseventsforpolicy‐setupdateandpublish,useraccesscontrolchanges,and
instancepasswordssetbyanACEadministrator.
InstanceAdministration–LogsACEinstancelife‐cycleevents,suchascreation,copying,revocation,
reenablement,anddeletion.Alsologsinstancepasswordchangebyauseroranadministrator,changes
inexpirationforeachinstance,changesofinstanceguestorhostoperatingsysteminformation,and
settinginstancecustomfields.Thedebuglevel
canbeusedtologthemostubiquitoustrafficsuchas
policyupdaterequestsfromactiveinstances.Failedinstanceverificationsareloggedonlyatthedebug
level.
Authentication–Logseventsforeveryauthenticationrequest,suchasadministrationorhelpdesk
authenticationattempts(atthenormallevel),instanceauthentication(attheinformationallevel),and
remoteLDAPpasswordchange.Setloggingforthiscategorytothelowestlevelthatispracticalforyou.
Thiscategorycangeneratealarge
volumeofentries.
Foreachcategory,youcanchooseoneofthefollowinglogginglevels:
None–Nologentryismadeforthisevent.
Critical–Anexampleofacriticallogeventisonethatremovesallpackages,instances,andpolicies
associatedwithanACE‐enabledvirtualmachine.
Normal–Thislevelofdetailissufficienttoanswermostqueries.
Informative–Entriesfornondestructiveeventsthathavelimitedeffect.
Debug–Entriesforeveryclientaccessoftheserver.Itprovidesmorerecordsofcertaineventtypes,
creatingalargenumberloggingentriescomparedtootherloglevels.Itlogsallinformationaltransactions,
suchasinstancestatusandsoon.