Quick tip: Setting up TrueSSO?

Quick tip: Setting up TrueSSO?

by | Mar 2, 2023

Are you setting up TrueSSO? Are you looking to use signed certificates to secure the communication between the Connection Server and the Enrollment Server?

Try to find the documentation on using signed certificates to secure that communication. I challenge you, you will not find it easily.

What and why?

You are allowing access to the Unified Access Gateway from the internet. You will want those services to have signed certificates to secure the communication, which will turn that icon in the Horizon client green. To enable end-to-end signed communication, you will need to make sure that you have certs all the way. In the end you are creating tunnels to backend services.

On top of that you want to add TrueSSO in the equation as you want a seamless sign-on experience. This means more certificates. You follow the guides (and all the blog posts that are built using this information), so you are almost there.

However, one step is exporting the ‘vdm.ec’ certificate from the Connection Server and import it on the Enrollment Server. That is exactly where the information is missing or at least hard to be found. None of them actually talk about CA signed certificates for this. You are doing this kind of effort to get all those components (Microsoft) CA signed. Don’t you think that you should use signed certificates here as well, if . I think so!

Where can I find the documentation

Here is the documentation on the VMware websites on setting up TrueSSO:

… and also some great blogs articles out there:

Search no more, you can find it here on the docs.vmware.com site, it is just in another section and a bit hard to find.

Photon OS 3.0 update the maximum failed OS login attempts

Photon OS 3.0 update the maximum failed OS login attempts

by | Feb 28, 2023

A client of mine was looking on how to update the maximum failed OS login attempts because they were having an issue with the monitoring solution locking the root user account on the VMware Unified Access Gateway 2212. This version of the UAG is based on photon OS 3.0.

He asked me to verify where to change the configuration to update the maximum failed OS login attempts. This is normally set at UAG deploy time and there is no option to change it afterwards easily.

Be aware that this is a rather unconventional change because these values shouldn’t be changed from the default, especially if you want to be compliant with CIS audits for example.

This is the default and also the line that you need to change

Open system-auth located in /etc/pam.d

  • deny=3

Change the deny=3 to the maximum value you want. If you change it to 0 (zero) it will never deny based on the maximum failed OS login attempts for all local users

  • even_deny_root

Leave it out if it shouldn’t deny the root user being locked out on the maximum failed OS login

  • unlock_time=86400

Default unlock time for all users

  • root_unlock_time=300

Unlock time for the root user account

Source: https://www.stigviewer.com/stig/vmware_vsphere_6.7_photon_os/2022-09-27/