Why?

• PCI Compliance requires multi-factor authentication for remote access to your cardholder data environment.  It’s also a good security practice if you use remote access.
• RSA SecurID is the most widely used form of multi-factor authentication, but there are certainly other options (Note: View only supports integration with RSA or RADIUS at this time).
• Users do not have to carry around a physical RSA keyfob.
• Users do not have to pull up the RSA app on their mobile device and remember the 8-digit token then fly over to the vmware view app and type in that code all within the 60- (or 30-) second window.  That’s a little much for some folks to handle.

Prerequisites:

• RSA Server 7.1 SP4 (This is what I tested against)
• View 5.1 with RSA enabled
• VMware View iPad App
• Access to your RSA server’s admin page or be able to get the specific type of token from your RSA administrator in your organization.

One point of clarification:

 What is the difference between PIN, tokencode and PASSCODE?

The terminology can be very confusing. With two-factor authentication there are two components that a user needs in order to authenticate. The two factors are “something the user has – RSA Token which displays a tokencode” and “something the user knows – PIN”.  The PASSCODE is a combination of the user’s PIN followed by the tokencode. For example, if your PIN is abc1234 and the current tokencode is 987654, your PASSCODE is abc1234987654.

There are several broad steps in the beginning and I will be focusing this post on the last few steps — but — I have included all of the steps to make sure you’re doing everything that needs to be done with info on how to do it.

1. Setup VMware View 5.1, a security server, and a connection server.  You should be able to access your view environment from outside your corporate network.

2. Setup RSA Server 7.1 SP4.  Or have your RSA admin upgrade you to this version. Make sure this is integrated into your Active Directory environment to sync up beautifully with View. *Tip: Make sure your RSA server’s computer name is all lowercase and never ever change the name.  Strange things happen if you do. *

Here are some other things you have to do but I will not be providing detailed instructions in this post:

Setup your internal view connection server (paired with security server) as an “authentication agent” in RSA.

Download the SDCONF.REC file from your RSA server.

Configure your View Connection Server to force RSA authentication before Active Directory authentication.  Once you’re ready to force users to use RSA (After training, and token setup, of course), you need to follow the instructions from the VMware View documentation, found here.

3. Install the iPhone software token device type.   Go here and download the documentation and device definition file.  You or your RSA admin will need to install the iPhone device type into the RSA console.

4. Assign a software token to a user.  Instructions are on page 39 of the admin guide, “Provisioning File-Based Tokens”.

5. Edit the user’s token issue the token.

• Go to Authentication > SecurID Tokens > Manage Existing.
• Find the new user’s token, press the down arrow beside it and press edit.
• Start and follow the steps beginning on page 40 of the admin guide, “Provisioning File-Based Tokens”.

Some settings of note (the instructions refer you back to Steps 1-4 of thee previous section, so check these settings):

• Pages 35-36 – If you want to restrict delivery of the token to ONE Device, then follow those instructions to retrieve the info from the user’s RSA app, replace the GUID serial number field, then issue the token.  BE WARNED:  This will BIND your token to that device.  If a user changes devices, then you will need to issue a new token.  This is also a 1-to-1 bind.  This means one software token license equals one device token.  In my use case, I am NOT binding tokens to devices and the user can use the same token in their View iPad app, on their iPad RSA app, and on their iPhone/Droid RSA app.
• Press “Save and Distribute Token.”
• Choose Distribution Method: “Issue Token File SDTID”.
• Page 37 – follow the suggestions in the graphic for “software token settings.”
• Turn back to page 40, picking up at step 3.  Give your token a password (required to install the token on their device – a 4 digit pin is ok, for example 5672).
• Press Next to issue the token file and download the zip file. Extract it and get ready to use.

5. Setup the Token Converter tool. Download the software token converter tool from RSA’s website here.  Setup a converter folder on your computer and put the “TokenConverter.exe” and “sdti2tsf.dll” files in this folder (like C:\Temp).  Drop all of the downloaded and extracted SDTID files (from step 4) into the folder as well.  You can identify them by the file name  … should be “username_0000135562626.sdtid” (where the numbers are the token ID.

6. Convert the SDTID files into the iPhone software token format.

• With your token converter files and the .SDTID files in one directory, open up a command prompt and navigate to that directory.
• The command to execute is below.  The NAMEtokenfile.txt is the output file (Name it whatever you like).  The output file consists of the “url” that you will send to each user via email, so you probably want to make the file name user specific as to not get confused.  The underlined portion is that specific SDTID file you want to convert.  5672 is the example password on the token that you or your admin put on the token file.
  • TokenConverter.exe username_0000135562626.sdtid -p 5672 -mobile -o NAMEtokenfile.txt

(Click to enlarge the graphic)

7. Send the token code to your user(s).  Open up your NAMEtokenfile.txt file(s) and copy the “url” out of the file and e-mail that to your user(s).  The URL is going to look something like this (I’ve changed the numbers so you can’t steal my token):  com.rsa.securid://ctf?ctfData=202222222222222222222222222222222222222222222222222222222222222222722

8. Users should setup their RSA Accounts on your network.  You can make the RSA Server public through your DMZ but that’s really not necessary for this purpose.  But you can.  In the same e-mail, direct your users to the link below.  They should click that link.  Login with their WINDOWS active directory username and password.  Then they will setup their PIN code and security questions.

https://rsaauthmgr.yourlocal.domain:7004/console-selfservice/SelfService.do

9. Install the token into the RSA app on your iPhone/iPad.

• Users should have the iPhone/iPad apps installed on their devices already (from the iTunes App store).
• Then they should open up their e-mail and click on the link you just sent them.
• This will open up the app and ask for the password (5672 in my example).
• It might also ask for the PIN code that they setup in the step above.

10. Install the token into your VMware View Client iPad app on your iPhone/iPad only after your connection server is RSA enabled. 

*Note: Remember that if in step 5, you chose to bind the token to a specific device, that you must use one token per app.  You cannot use the token for both #9 and #10.*

• Users should already have the VMware View iPad app installed, available for free from the iTunes App store.
• Copy the URL from the email (The whole text) to the iPad/iPhone clipboard.
• Open the View Client app.
• Go into your view connection server – click “external token”
• Token Description: call it whatever you want (plain text)
• URL: paste the complete URL from the e-mail (output of the NAMEtokenfile.txt)
• Password: if you put a password on the token (which you should have), then type that in (my example was 5672).

Your login screen on your iPad now looks like this (click to enlarge):

And if you press “token code available..” you get the next screen where you can actually authenticate using an external token (if someone else needs to login with their credentials on your iPad/iPhone) (click to enlarge):

So once you have everything setup, you/your user clicks the View connection server in the app.  They enter their windows username and their RSA PIN (since the token is stored), then press done.  (it authenticates to RSA).  Then you/your user logs in with the windows username and password.

And BAM – your user’s lives are easier while at the same time securing your critical data and being PCI Compliant!

Shoot me a note if you have any questions on twitter or send me an email to phillip(at)phillipreynolds(dot)com.

———————————————-

Phillip Reynolds is a guest blogger for eGroup and you can find more of his posts here.  You can also keep up with him on Twitter @philvirtual.

The post Integrating RSA SecurID with VMware View iPad Client – eGroup appeared first on eGroup.

Computerized physician order entry (CPOE) is part of Beaufort Memorial Hospital drive toward Meaningful Use of certified Electronic Health Records (EHR) technology, as defined by the American Recovery and Reinvestment Act of 2009. BMH’s CIO, Ed Ricks, worked with eGroup to realize his ultimate vision to drive user engagement—to make BMH’s electronic systems easier, faster and more portable for clinicians.

Imprivata recently produced this excellent video highlighting the VMware View implementation in conjunction with Imprivata’s Single Sign-On and zero clients. Check it out: Beaufort Memorial Hospital enhances care delivery.

You can also download the Beaufort Memorial Hospital case study.

The post Video: Beaufort Memorial Hospital’s CPOE Implementation appeared first on eGroup.

• Install the View Agent LAST after you setup your vm, install applications, do windows updates, and get the VM the way you want it.
• If you are running Windows Updates on your View desktop, you should make it a habit to reinstall the View Agent each time — you never know what the updates might have screwed up.  And NEVER have Windows Updates set to automatic on View!
• Need to clone your parent VM for some reason?  Uninstall the View Agent before making the clone.
• If you’re uninstalling the View Agent, check the registry after you reboot to make sure it is completely gone before you reinstall the View Agent:  HKLM\Software\VMware Inc.  You should not have a View Composer or VMware VDM folder anymore. *BE CAREFUL!*

**These are just my own personal suggestions.  Be very careful and make sure you have backups before editing the registry!  YMMV (Your mileage may vary!)**

Stay tuned to more posts in this series about VMware View 5.1 “Lessons Learned” by following along with the tag: VMware View 5.1

Phillip Reynolds is a guest blogger.  You can also follow him on twitter: @philvirtual

The post View 5.1 Tips: View Agent appeared first on eGroup.

According to VMware, “This issue occurs due to the way the VMXNET 3 adapter is added. The Windows 7 guest operating system identifies the adapter as a new device and does not properly install the driver during the cloning process.”

#Fail

There is a special patch available for download directly from Microsoft and the full links to the information are available on this VMware KB article from April 25, 2012: http://kb.vmware.com/kb/2007319

Stay tuned to more posts in this series about VMware View 5.1 “Lessons Learned” by following along with the tag: VMware View 5.1

Phillip Reynolds is a guest blogger.  You can also follow him on twitter: @philvirtual

The post View 5.1 Tips: VMXNET3 bug appeared first on eGroup.

May 23: Best Practices for Virtualizing Oracle Database and Applications

Virtualization can improve IT efficiency, flexibility and availability, transforming service delivery while reducing costs. The inclusion of business-critical applications (BCA) such as Oracle Database and applications can deliver the most significant value to your business. However, many companies are cautious about including Oracle software in their virtualization roadmap because they lack specific in-house expertise to virtualize the infrastructure for Oracle or because of the perception of risk associated with these projects.

May 24: Introduction to Virtual Desktop Infrastructure with VMware View

Although the capital expenditures for traditional computers have decreased over time, the operational costs of managing these desktops have increased significantly because of the escalating complexity of tasks, labor costs and security concerns. End users are also tied to a single piece of hardware to access all their data and applications, which limits mobility and causes frustration. Learn how virtual desktops using VMware View™ can meet these challenges by providing end-user freedom while maintaining IT control.

May 30: Best Practices for Virtualizing Microsoft Exchange

Virtualization can improve IT efficiency, flexibility and availability, transforming service delivery while reducing costs. The inclusion of business-critical applications (BCA) such as Microsoft Exchange can deliver the most significant value to your business. However, many companies are cautious about including Microsoft Exchange in their virtualization roadmap because they lack specific in-house expertise to virtualize the infrastructure for Microsoft Exchange or because of the perception of risk associated with these projects.

May 31: Technical Deep Dive: Capacity Management with VMware vCenter Operations Management Suite 5.0

VMware has introduced new capabilities to allow VMware vSphere® administrators to proactively manage virtual infrastructure resources. When you right-size and optimize your infrastructure capacity you can increase virtual machine density and consolidation ratios by up to 30 percent, defer hardware and software purchases, and plan for upcoming virtualization projects more easily.

Learn from technical experts how you can take advantage of these new capacity management capabilities to ensure best performance and quality of service in a more cost-effective manner.

The post eGROUP TEAMS UP WITH VMWARE TO PRESENT AN INFORMATION-PACKED MAY WEBINAR SERIES appeared first on eGroup.

Cloud Infrastructure and Management Promotions

NEW – 50% off vCenter Operations Management Advanced Edition

• May 1, 2012 – September 15, 2012
• Save 50% when you purchase vCenter Operations Management Advanced Edition.  Do you need high performance and resource efficiency in your vSphere environments?  Purchase now and save more than $1,500.

NEW – 25 Free Training Credits with vCenter Operations Management Enterprise Edition

• May 1, 2012 – September 15, 2012
• Receive 25 education credits ($2500 value) with a purchase of vCenter Operations Management Enterprise Edition licenses.  Limit one per customer.

Free Training with vSphere Acceleration Kit with Management

• February 1, 2012 – June 15, 2012
• Free Instructor-Led Training ($3,500 value) with Purchase of Any vSphere Acceleration Kit with Management!

vSphere Essentials to Essentials Plus with VSA Upgrade

• February 1, 2012 – June 15, 2012
• Upgrade to VMware vSphere Essentials Plus with vSphere Storage Appliance for 35% off list price and save more than $2,700.

vSphere Essentials Plus to Enterprise Acceleration Kit Upgrade

• February 1, 2012 – June 15, 2012
• Upgrade to VMware vSphere Enterprise Acceleration Kit for 30% off List Price and save more than $4,500.

Business Continuity/Disaster Recovery for Small Sites and Large Sites

• February 1, 2012 – June 15, 2012
• Small Sites – Receive 40% off a 75-VM pack of SRM Standard and vCOps Enterprise for customers with up to 75 VMs
• Large Sites – Receive 75 VMware Training Credits with every 75-VM pack of the Business Production Bundle Purchased.

Cloud Application Platform Promotions

Hyperic to vFabric Application Performance Manager

• February 1, 2012 – June 15, 2012
• For a limited time,if you own vFabric Hyperic with a valid SnS contract can upgrade their web infrastructure monitoring solution to include the critical real-time perspective on application performance to better manage SLAs and user experience for applications running in the cloud delivered by vFabric Application Performance Manager

Desktop and End User Computing Promotions

Free 50-user license for Horizon Application Manager

• February 23, 2011 – June 15, 2012
• Purchase vSphere Essentials Plus or higher edition and receive a 50-user license for Horizon Application Manager 1.5 plus one year of Basic Support and Subscription (SnS) at no additional charge.

VMware View 500 Pack & 250 Pack Promotions

• February 1, 2012 – June 15, 2012
• Get 25% off the license list price for a 500 pack View Premier or 18% off the license list price for a 250 pack View Premier.

If you would like to take advantage of any of these promotions, please e-mail insidesales@egroup-us.com or contact us at1-877-eGROUP-1.

The post NEW VMWARE PROMOTIONS JUST RELEASED!!! appeared first on eGroup.

We all know the complexities and costs of managing large geographically separated fleets of desktops.  Just maintaining hardware, OS patches and AV software updates tend to consume all of the small amount of resources that most small to mid-size companies have in their IT budget.  And that doesn’t even start to add the complexities of encrypting data at rest on those fleets of pc’s.

An often talked about benefit of Virtual Desktops is data security.  However, I’m not sure that discussion sinks in deeply since we’re all worried about how much RAM we might need and how many IOPS we have to plan for in order to avoid the dreaded boot storm.  But, this benefit is real and in this case all the thieves would have walked away with COULD have been some dumb thin clients.  In the VDI world the PHI that was stored on these disks would have never left the data center and had any of the trainees or trainers stored PHI data on their desktops, the data would still have remained in the data center.

I realize there are long lists of pro’s and con’s along with ROI and TCO models that companies must go through prior to choosing or not choosing VDI but, these 1.5 million reasons go a long way to proving that VDI can provide many more benefits to businesses than just easier patch or software deployment tasks.

The post 1.5 Million Reasons for VDI appeared first on eGroup.

For VNXe customers, EMC VSI 5.2 now utilizes the EMC VNXe Advanced Storage Access feature to support cloning and compression of NFS datastores.

For VDI customers EMC VSI 5.2 integrates with VMware View and Citrix Xendesktop providing simplified storage management for those complex environments.

More features, enhancements and fixes are outlined in Power Link.  From the home page navigate to the following:

Home > Support > Technical Documentation and Advisories > Software ~ T-Z ~ Documentation > Virtual Storage Integrator (VSI) > Virtual Storage Integrator for vSphere > 

This tool is definitely worth trying out and keeping up with as it continues to add features.

The post EMC Virtual Storage Integrator (VSI) for vSphere appeared first on eGroup.

EUC part 1 of 3

Its day two of FLISH MADNESS and today’s topic is End User Computing.

Recently I was on plane flight coming back from Las Vegas and I looked around half way through the flight to see that 80 % of the people around me were using some type of tablet computing device.  I thought to myself the post PC era is truly underway.  But, we have a ways to go.  First and for most we still have too many devices per person.  Case in point, I carry my laptop, iPad and iPhone to every meeting I go on.  Ideally we would combine at least two of these devices if not all three.

I envision a world where we have one device (call it an identity disc) where we jack into computing resources (public, private, personal cloud) as needed.  Some of us are already taking steps in this direction.  For example, the Cisco Cius can be “docked” into a station where you would have the full keyboard, monitor and mouse capabilities of a traditional desktop.  From there you could launch native applications, VDI from Citrix or VMware or some type of legacy application presentation.

End User Computing is one of the most spoken buzz terms across all tech industry verticals today.  The actual meaning of the term may depend on whom you are speaking with.  But what it boils down to is empowerment for users of the users and by users.  In IT we no longer live in a world where we have the luxury to control what end point device the users bring to work.  We do have the ability to control the corporate data, how the data gets to the end user (including how it is presented), and finally how the data is secured.

To summarize this line of thought, EUC needs three things to be successfully deployed in an IT environment.

1. Device agnosticism aka BYOD (Bring Your Own Device)
2.  Application abstraction / Modern Application development (HTML 5)
3.  Secure MDM (Mobile Device Management)

Device Agnosticism

It’s happened to every IT admin out there.  A VIU (very important user) for example a CEO or CFO brings in his latest and greatest smart phone and expects it work seamlessly with all corporate systems.  This of course is as tremendous challenge but surmountable with the right technology applied.

The idea of bringing your own device to work simple put makes the user feel “empowered”.  A user that is empowered with end point choice is usually happier than one that isn’t.  Furthermore, if IT can “containerize” the corporate assets that the end user needs on their chosen device they open the door for getting out of the end user hardware business and getting into software as a service.

Think about it, as an IT admin you want to profile, image, and streamline your end user’s experiences; that way you have consistent, manageable interfaces that the user cannot meddle with.  This would seem almost impossible if everybody brought their own device.  Unless, we abstract the corporate resources needed by the end user thus sandboxing the corporate experience from the chosen end point device.  We’ll get into the specifics of how this can be done in EUC part 2 and 3.

Stay tuned as FLISH MADNESS continues tomorrow as we continue the EUC conversation.

The post End User Computing Part 1 of 3 appeared first on eGroup.

Cloud Infrastructure and Management Promotions

Free Training with vSphere Acceleration Kit with Management

• February 1, 2012 – June 15, 2012
• Free Instructor-Led Training ($3,500 value) with Purchase of Any vSphere Acceleration Kit with Management!

vSphere Essentials to Essentials Plus with VSA Upgrade

• February 1, 2012 – June 15, 2012
• Upgrade to VMware vSphere Essentials Plus with vSphere Storage Appliance for 35% off list price and save more than $2,700.

vSphere Essentials Plus to Enterprise Acceleration Kit Upgrade

• February 1, 2012 – June 15, 2012
• Upgrade to VMware vSphere Enterprise Acceleration Kit for 30% off List Price and save more than $4,500.

Business Continuity/Disaster Recovery for Small Sites and Large Sites

• February 1, 2012 – June 15, 2012
• Small Sites – Receive 40% off a 75-VM pack of SRM Standard and vCOps Enterprise for customers with up to 75 VMs
• Large Sites – Receive 75 VMware Training Credits with every 75-VM pack of the Business Production Bundle Purchased.

LIMITED TIME – vCenter Operations Management Advanced!

• December 26, 2011 – March 9, 2012
• FREE 25-VM pack license for vCenter Operations Management Advanced edition 5.0 plus one year of Basic Support and Subscription (SnS) at no additional charge with purchase of vSphere, Standard or higher edition.

Cloud Application Platform Promotions

Hyperic to vFabric Application Performance Manager

• February 1, 2012 – June 15, 2012
• For a limited time,if you own vFabric Hyperic with a valid SnS contract can upgrade their web infrastructure monitoring solution to include the critical real-time perspective on application performance to better manage SLAs and user experience for applications running in the cloud delivered by vFabric Application Performance Manager

Desktop and End User Computing Promotions

VMware View 500 Pack & 250 Pack Promotions

• February 1, 2012 – June 15, 2012
• Get 25% off the license list price for a 500 pack View Premier or 18% off the license list price for a 250 pack View Premier.

Up to 25% off Zimbra Introductory Offer

• November 1, 2011 – March 15, 2012
• Save up to 25% on VMware Zimbra – an innovative, open email and collaboration solution that connects end users to critical data on any device or platform

If you would like to take advantage of any of these promotions, please e-mail insidesales@egroup-us.com or contact us at1-877-eGROUP-1.

The post NEW VMWARE PROMOTIONS TO START OFF YOUR 2012 NEW YEAR appeared first on eGroup.