CONFIGURING UPDATE MANAGER DOWNLOAD SERVICE 6.7 ON CENTOS/RHEL 7 WITH SSL CERTIFICATES

Written by Written by Sam McGeown on 14/3/2019 · Read in about 4 min (725 words) Published under VMware and vSphere Tags:

Most vSphere admins are more than comfortable with using Update Manager to download patches and update their environment, but few that I talk to actually know a huge amount about the Update Mangaer Download Service (UMDS). UMDS is tool you can install to download patches (and third party VIBs - I’ll get to that) for Update Manager and it’s useful for environments that don’t have access to the internet, or air-gapped, and also for environments with multiple vCenter Servers where you don’t necessarily want to download the same patch on every server. You can control which patches you download (for example, limiting to ESXi 6.7+ only) and you can add third party Vendor repositories (e.g. Dell or HPE).

I’m going to install UMDS on a Linux VM, download the VMware, HPE and Dell patches and then publish those internally on an SSL secured site using NGINX. The high level process is:

Deploy the UMDS server

Install UMDS

Configure UMDS

Install NGINX

Configure vCenter

Deploy the UMDS server

I’ve deployed a CentOS7 VM from a template and added a big data drive for the UMDS data (this makes it easier to extend later if I need to). Check out the currently supported Linux operating systems for UMDS for 6.5 and 6.7.

Note: for vSphere 6.7u1, VMware dropped the requirement for a PostgreSQL database

Format the data drive and mount to /umds

Install PostgreSQL 9.4

1 yum install https://download.postgresql.org/pub/repos/yum/9.4/redhat/rhel-7-x86_64/pgdg-centos94-9.4-3.noarch.rpm 2 yum install postgresql94 postgresql94-server postgresql94-odbc 3 /usr/pgsql-9.4/bin/postgresql94-setup initdb 4 systemctl enable postgresql-9.4 5 systemctl start postgresql-9.4

Create a UMDS user and database

1 su - postgres 2 createdb <database_name>; 3 createuser -d -e -r <database_username>; -P 4 Pwd: <database_password>;

Edit /var/lib/pgsql/9.4/data/pg_hba.conf and change local, IPv4 and IPv6 to use md5 authentication (not ideal, but it works)

1 # TYPE DATABASE USER ADDRESS METHOD 2 # "local" is for Unix domain socket connections only 3 local all all md5 4 # IPv4 local connections: 5 host all all 127.0.0.1/32 md5 6 # IPv6 local connections: 7 host all all ::1/128 md5 8 # Allow replication connections from localhost, by a user with the 9 # replication privilege. 10 #local replication postgres peer 11 #host replication postgres 127.0.0.1/32 ident 12 #host replication postgres ::1/128 ident

Edit /etc/odbcinst.ini to use the ODBC driver

1 [PostgreSQL] 2 Description =PostgreSQL ODBC driver (Unicode version) 3 Driver64 =/usr/pgsql-9.4/lib/psqlodbcw.so 4 Setup64 =/usr/lib64/libodbcpsqlS.so 5 Debug = 0 6 CommLog = 1 7 UsageCount = 1

Create the ODBC DSN /etc/odbc.ini

1 [<dsn_name>] 2 Driver = PostgreSQL 3 DSN = <dsn_name> 4 ServerName = localhost 5 PortNumber = 5432 6 Server = localhost 7 Port = 5432 8 UserID = <database_username>; 9 User = <database_username>; 10 Database = <database_name>;

Validate the connection using isql -v UMDS_DSN <database_username> <database_password>;

Install UMDS

Next, mount the vCenter Server Appliance ISO file, copy the UMDS installer tar.gz file into the /umds folder and extract the installer. When this is complete there should be a vmware-umds-distrib folder.

1 mkdir /mnt/cdrom 2 mount /dev/cdrom /mnt/cdrom 3 cp /mnt/cdrom/umds/VMware-UMDS-6.7.0-8169861.tar.gz /umds/VMware-UMDS-6.7.0-8169861.tar.gz 4 cd /umds 5 tar xvzf VMware-UMDS-6.7.0-8169861.tar.gz 6 umount /mnt/cdrom

Run the UMDS installation script /umds/vmware-umds-distrib/vmware-install.pl

Accept the EULA

Enter the install location (/umds/vmware-umds)

Configure proxy (you can configure it later if required)

Enter the patch location (/umds/vmware-umds-patches)

Configure database connection using <dsn_name>, <database_username> and <database_password>

Configure UMDS

View the current configuration

1 /umds/vmware-umds/bin/vmware-umds -G

Disable older patches (I just want 6.7)

1 /umds/vmware-umds/bin/vmware-umds -S -d embeddedEsx-6.0.0 embeddedEsx-6.5.0 embeddedEsx-6.6.1 embeddedEsx-6.6.2 embeddedEsx-6.6.3

Add the Dell and HPE repositories

1 /umds/vmware-umds/bin/vmware-umds -S --add-url https://vmwaredepot.dell.com/index.xml --url-type HOST 2 /umds/vmware-umds/bin/vmware-umds -S --add-url https://vibsdepot.hpe.com/index.xml --url-type HOST

Fix the SSL errors (use the local lib curl binary)

1 mv /usr/local/vmware-umds/lib/libcurl.so.4 /usr/local/vmware-umds/lib/libcurl.so.4.backup 2 ln -s /usr/lib64/libcurl.so.4 /usr/local/vmware-umds/lib/libcurl.so.4

Download the updates

1 /umds/vmware-umds/bin/vmware-umds -D

Install NGINX

Install and start nginx

1 yum install epel-release 2 yum install nginx 3 sudo systemctl start nginx 4 sudo systemctl enable nginx

Configure the firewall for HTTPS

1 firewall-cmd --permanent --add-port=443/tcp 2 firewall-cmd --reload

Generate SSL certificates

1 mkdir /etc/nginx/ssl-certs/ 2 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl-certs/umds.key -out /etc/nginx/ssl-certs/umds.crt

Create an NGINX config file for UMDS - /etc/nginx/conf.d/umds.conf

1 server { 2 listen 443 ssl ; ssl on ; 3 ssl_certificate /etc/nginx/ssl-certs/umds.crt ; 4 ssl_trusted_certificate /etc/nginx/ssl-certs/umds.crt ; 5 ssl_certificate_key /etc/nginx/ssl-certs/umds.key ; 6 7 server_name umds.definit.local ; 8 root /umds/vmware-umds-patches ; 9 index index.html ; 10 location / { 11 autoindex on ; 12 try_files $uri $uri/ = 404 ; 13 } 14 }

Restart NGINX - systemctl restart nginx

Add the certificate to vCenter trust - log in to vCenter and navigate to Administration > Certificate Management

Log in as administrator@vsphere.local

Under Trusted Root Certificates click ADD and upload the generated umds.crt

Navigate to Update Manager > Settings > Patch Setup and click Change Download Source - enter the UMDS web server

Navigate to Patch Downloads > DOWNLOAD NOW

Share this post

Please enable JavaScript to view the comments powered by Disqus.