This was a LINKEDIN post I made on Dec 20, 2021. I'm reposting here for ease of reference.

There are two detailed articles from VMware outlining the steps necessary within the VMware vCenter appliance for modifying the files to insulate your vCenter appliance from the Apache log4j2 vulnerability. However, VMware leaves out a few pre-requisites and interim steps that you might need to know about to make this task easier.
First, let's start with the prereqs. You'll need to download the python scripts attached to the two VMware articles that outline the remediation steps (links provided below). Then, you're going to need Putty or some other SSH client to be able to log in to the vCenter appliance and run these scripts. Thirdly, you'll need WinSCP or a similar file transfer client to move the files from your PC to the vCenter appliance.
Once you have the three python script files downloaded (vmsa-2021-0028-kb87081.py, remove_log4j_class.py and vc_log4j_mitigator.py), launch your web browser and navigate to the admin interface for your vCenter appliance (https://vcenterdnsname:5480), and log in as root. This is not the root user for your ESX host, it's the root user for the vCenter appliance. If you can't log in, your root password may have expired since for some idiotic reason VMware thought it was a good idea to set the default for root's password to automatically expire in 90 days, after which you're permanently locked out and there is no option to add another root-equivalent user. Anyway, I've provided a link to an article below on how to reset the root password of a vCenter appliance, should that be necessary. Once you've logged in as root, navigate on the lefthand menu to the Access submenu, then go to the upper right side and click EDIT, to enable the BASH SHELL. Set the timeout to 30 minutes or longer. Log out of the admin interface.
Next, navigate to the main menu of the vCenter server (https://vcenterdnsname) and log in using either [email protected] or an Active Directory admin user authorized for vCenter. Find your vCenter appliance in the VMs list, right-click on the VM, go to Snapshots > Take a Snapshot > OK and then wait for that to finish (the user interface may pause for a moment while this happens). Verify that the snapshot has been completed, and then log out.
Now, we're going to transfer the python scripts to the vCenter server. I'll use the WinSCP example here. Since the default shell environment for vCenter is the appliancesh shell, and not bash shell, you'll have to do one of two things. Either SSH to the vCenter appliance and change the default to BASH shell to be able to use secure copy (SCP), or simply use SFTP which can be accessed when the appliancesh is the default shell environment.

In WinSCP new session, select SFTP as the file protocol, type in the host IP address or DNS name of the vCenter appliance, leave port as 22, and the username will be root and type in your root password, then click advanced. See the screenshot above for the protocol options to replace "Default" in the SFTP server block, with shell /usr/libexec/sftp-server, then click OK to close that windows and click LOGIN. Navigate in the righthand pane of the WinSCP client to the ./tmp folder and copy the two python scripts to this folder. You can then end your WinSCP session.
Launch your putty client to connect to the vCenter server via SSH, port 22. If you need to document session input and output for audit reasons, make sure to enable logging in the putty client. Once connected, log in as root. You'll be presented a Command> prompt. Type in shell. You'll then be given a root@vcsaXX [ ~ ]# prompt (with the version of the vCenter server replacing the XX. Type in cd /tmp and press enter. You can then type ls -l *.py to verify that the three python scripts are in this directory.
Now, let's pause here to consider the potential impact of the next two actions. When you run the python scripts several services are STOPPED on the vCenter appliance. This could impact any service that depends on vCenter, such as VMware replication, VMware Backup, Zerto Replication, Veeam Replication, Veeam CDP, Veeam Backup, and other such programs as well as anyone attempting to use the GUI interface of vCenter. Before you run the python scripts you'll need to notify users of the outage and potentially pause other programs to reduce the possibility of an interruption of services for replication or backups. The two article links below outline the services that will be stopped by the python scripts. Review those to determine any potential impact before running the two scripts.
Now that you've considered the consequences of these next steps and taken actions to reduce any potential impact, you can run the first script by typing: python vmsa-2021-0028-kb87081.py from the root@vcsaXX [ /tmp ]# prompt and you'll be then prompted by the script to answer Yes or No as to whether you want to stop services and run the script. Once you answer YES, the script will stop the appropriate services, back up the files that will be modified, and then apply the modification(s) to the necessary files before restarting the associated services. Depending on the speed of your ESX host and the underlying disk drives this process can take 20 minutes or longer. Be patient. You'll then see output similar to this:

Once the first script completes, we can now run the second script by typing: python remove_log4j_class.py and hitting enter. You will be prompted to answer yes or no to continue. Once you type y and hit enter, the script will run with screen output showing files being backed up before modification, and then you will be returned to a command prompt with a message containing the date and INFO main: Done. You can verify that the script worked successfully by typing: python remove_log4j_class.py -r which should then echo that the list of vulnerable files is now empty. Script three (added 12/21/2021) named vc_log4j_mitigator can be run with the command python vc_log4j_mitigator.py -r with the -r indicating running the script in "dry run" mode that checks to ensure all changes are made, without actually modifying any of the files. NOTE: If you are running vCenter Server Appliance 6.0U3j, the remove_log4j_class scripts may not work. You will have to manually remediate using the steps outlined in the 87081 knowledgebase article.
Once you verify that your vCenter is working properly and that all dependent services are also functioning as they should, you can then delete the VM snapshot that we created earlier. This is important due to the fact that a long-running snapshot file can become rather large and not only slow down your vCenter server but present many other problems later such as exhausted disk space.


Here are the links to the two VMware KB articles. Each has the python script(s) attached on the right-hand side of the screen in the block labeled Attachments: 
https://kb.vmware.com/s/article/87088 https://kb.vmware.com/s/article/87081#vCenter67
Here's a link to the VMSA-2021-0028 Advisory that is continuously updated: 
https://www.vmware.com/security/advisories/VMSA-2021-0028.html

If you want to use SCP instead of SFTP to copy files to your vCenter appliance, here are the instructions on changing the default shell from appliancesh to bash. Just remember that once you're done copying the files via SCP, you'll need to change the default shell BACK to appliancesh. 
https://kb.vmware.com/s/article/2100508
And, last but not least, here's the link to the article on how to reset the root password of your vCenter appliance if it expires. Make sure that IF you have to do this you then log back into the vCenter appliance admin console (port :5480), go to the Administration menu, go to Password expiration settings, click EDIT, and set Password Expires to NO. 
https://kb.vmware.com/s/article/2147144

​*note1: Tuesday 12/21/2021 - Added vc_log4j_mitigator.py script reference due to it being added to VMware KB 87081.

​Windows servers running the DHCP role store the active copy of the DHCP database in %SystemRoot%\System32\DCHP directory. By default, the DHCP service backs up the database every 60 minutes to %SystemRoot%\System32\DCHP\backup. However, in the event of a DHCP server crash, DHCP database corruption, or a malware event, you might not be able to access this folder to perform a restore operation. You can add another layer of protection by setting up a scheduled task to back up the database to a network share, or you may simply opt to set up a task to copy the DHCP\backup folder to an alternate location at a scheduled time daily. The Powershell command to back up the database is as follows:

Backup-DhcpServer -path C:\DhcpBackupFolder

This command will create a sub-folder called NEW containing the database backup files and a file called DhcpCfg in the root of the target backup folder. You need both the config file and the files in the backup folder in order to restore.

If you should ever have to restore your DHCP server from your powershell-driven backup process, you will first need to copy the config file and "new" subdirectory contents to the "%SystemRoot\System32\DCHP\backup" folder before the DHCP restore operation will function properly.

If you would rather use Powershell instead of the GUI for the restore, the command is as follows:

Restore-DhcpServer -ComputerName "ServerNameHere" -path "C:\Windows\sytem32\dhcp\backup"

There are times when you might need to issue a self-signed SSL certificate for local intranet web applications, especially when the application vendor includes a self-signed SSL certificate for their application, but not for your specific internal domain. The process of creating a self-signed certificate has become much easier lately.

One option is to download and install Git Bash for Windows (https://git-scm.com/downloads). Git-2.37.1-64-bit.exe is the latest version as of this posting, which includes the OpenSSL library. If you use Git Bash to create an SSL certificate, the key is to make sure you put "winpty" in front of the OpenSSL command in the shell, or the command will lock up the terminal window. There are plenty of articles on the web that explain how to use openssl to create RooCA certs and self-signed certificates for use on your internal network.

Example: winpty openssl genpkey -algorithm RSA -des3 -out c:\folder\my-private-key.pem -pkeyopt rsa_keygen_bits:4096

A second option is to use the New-SelfSignedCertificate commandlet within Windows Powershell (version 5.1 or later).
Example:
$todaydt=Get-Date
$3years=$todaydt.AddYears(3)
New-SelfSignedCertificate -dnsname myserver.domain.local -notafter $3year -CertStoreLocation cert:\\LocalMachine\My
*note1: the -notafter switch is not valid on versions of Windows Server prior to 2016. Also, the cert:\\LocalMachine\My stores the new self-signed certificate in the signed-on user's local certificate datastore
An output similar to below will be shown. Note the thumbprint as you'll need to use that in the next command.
Directory: https://lnkd.in/dThSAdpY\\Certificate::LocalMachine\\My
Thumbprint Subject
---------- -------
54005B7DB6DC641F9EF982BACD9A8CBEB1D2E15F CN=myserver.domain.local

Next, you'll need to create a .pfx file.
Example:
$CertPassword = ConvertTo-SecureString -String "passw0rd!" -Force -AsPlainText
Export-PfxCertificate -Cert cert:\\LocalMachine\My\\54005B7DB6DC641F9EF982BACD9A8CBEB1D2E15F -FilePath "C:\\PutAFolderNameHere\\myserverHttpsCert.pfx" -Password $CertPassword

To generate the pem, key, crt, and cer files, it's easiest to use the Git Bash shell OpenSSL utility.

Run the following commands:
*note: enter pwd at the $ prompt in Git Bash to find out the default directory path to place your pfx file.

winpty openssl pkcs12 -in mysslcertfile.pfx -out mysslcertfile.pem -clcerts   
(*note: this will prompt for password that was used in the $Certpassword to generate the PFX file earlier)

winpty openssl pkcs12 -in mysslcertfile.pfx -nocerts -out mysslcertfile.key
winpty openssl pkcs12 -in mysslcertfile.pfx -nocerts -out mysslcertfile-encrypted.key
winpty openssl rsa -in mysslcertfile-encrypted.key -out mysslcertfile-decrypted.key
winpty openssl pkcs12 -in mysslcertfile.pfx -clcerts -nokeys -out mysslcertfile.crt
winpty openssl x509 -inform pem -in mysslcertfile.crt -outform der -out mysslcertfile.cer

*note: you'll obviously replace "mysslcertfile" with the actual cert file name, example: subdomain.domain.com


You'll need to follow the application vendor's instructions for installing your new SSL cert, or in the case of an internally-developed application, install the SSL cert into IIS or Apache using instructions found elsewhere.

After creating the .pfx file, you'll need to import it into your PC's local root certificate store. Go to the Windows Search bar and type MMC (Microsoft Management Console), run as administrator. Got to File -> Add or Remove Snap-ins -> Certificates and click Add and then OK. Next, Navigate to the Certificates (Local Computer) add-in, then right-click on Trust Root Certification Authorities -> All Tasks -> Import. In the Certificate Import Wizard click Next, Browse and go to the folder where you output your PFX file, select the file, click Open, Next and then finish the wizard.

Now, when you browse to your intranet web application you should not get the "Your Connection is Not Private" error, but rather it will now reflect it as an SSL site.

This is an update (July 2022) to a LinkedIn article written in 2017 giving instructions on how to turn a Raspberry Pi 3b into a 5250 terminal. The newer Raspbian OS versions (Buster/Bullseye) made some of my prior instructions invalid. There's a link at the end of the article to a Youtube video that shows these steps in detail.

The new Raspberry Pi 4B 2Gb model costs around $46. Add a case, heat sinks, power supply, and an 8GB microSDHC card for around $34, and you've got the makings of an inexpensive ($80-ish) 5250 terminal.
There are two basic methods we've used with good success to create a 5250 terminal from a Raspberry Pi. First, if you have an IBM-i with active software maintenance (SWMA) and are running IBM-i 7.x, then the new IBM-i Access Client Solution for Linux is one option. Alternatively, if you're wanting a simple user interface or don't have active SWMA then the open source TN5250j project is your other option. Both of these programs are 100% java-based and thus can run on any OS or device that supports java without having to be recompiled.


The first basic assumption for our Raspberry Pi 5250 project is that we do not want a full GUI with all the bloat-ware that comes with a full Raspbian OS desktop (as of the date of this post the current version is Raspbian Bullseye). Thus, we're building this with Raspbian Bullseye Lite and adding a basic GUI. Unlike my 2017 article, I'm going to cover both the TN5250J and IBM Access Client Solutions setup this time around.
Here are the basic steps that I will outline in some detail in this article:
1) Download software and prep the microSD card,
2) Install the Raspbian Bullseye Lite OS;
3) Update and modify the Raspbian OS;
4) Copy 5250 programs and modify files;
5) Modify the boot load sequence of OS to auto-launch 5250 (if desired)

Step1: Download the Raspbian Bullseye Lite .img file zip archive and unzip. If you're a Windows user you'll need to install Win32DiskImager or Raspberry Pi Imager application. Also, go ahead and download TN5250J from SourceForge and the IBMiACS from the IBM Downloads site. If you purchased a new micro SDHC card it should already be formatted, if not format it as FAT32.

Step 2: Use Win32DiskImager or Raspberry Pi Imager to burn the Raspian Bullseye Lite .img file to the microSD card. My suggestion is that if you're going to use this microSD as a template for creating more microSD cards for more terminals, use a 4GB microSD card as your template. That way the image you'll create will be 4GB instead of 8, 16, or 32GB. Once Win32DiskImager finishes writing the .img to the microSD card, Windows will prompt you to Format the drive - CANCEL this prompt. Accept and Exit Win32DiskImager. Eject the microSD card.

Step 3: Time to hone your Linux chops or learn some new ones. Once you insert the microSD card into your pi and apply power, the OS should boot and begin asking some setup questions. As an aside, you need a USB keyboard, USB mouse, a monitor, and a network connection to complete this setup. The Pi has a micro-HDMI port so you may need a micro-HDMI to HDMI or VGA converter. The Pi will grab a DHCP network address; you can change this to a static IP later. It will first ask you for keyboard setup; the system defaults to English(GB), so scroll down to Other, select the appropriate option, in my case English (US), next, scroll to the top of the list, US (English) or another language as appropriate; OK. It will then prompt you for a default USERID and Password. You'll have to enter the password twice. For this article, I've simply used USERID: pi and PASSWORD: pi to keep things simple.

Next, let's run: sudo raspi-config and set our keyboard type, language set, time zone and WLAN country. 
sudo raspi-config ->(4)localization -> (I1)Locales->Change Locale; scroll down and un-select (using space bar) en_GB.UTF-8 (unless of course you live in Great Britain), scroll down further to en_US.UTF-8 (for those in the US), tab, OK, on the next screen arrow down to en_US.UTF-8 (or other selected locale), tab, OK (this will generate locale files); Now, go to locale > keyboard and I selected > keyboard Generic US/104 (or other depending on location). Next, set your timezone: (I2)timezone (in my case US->Central); finish (should prompt to reboot); if not, type sudo reboot at the terminal prompt.
Now for installing a base GUI without all the stock bloat-ware:

To make the RaspPi automatically boot to the GUI, use sudo raspi-config to go to Boot Option menu ->(B1)Desktop/CLI -> (B4)Desktop Autologin; tab; OK; tab; Finish;
If your users are going to use IBMiACS and print reports to PDF for viewing,
type: sudo apt-get install mupdf   (to install a PDF reader.)


Step 4: Next, we'll download tn5250j-0.7.6-full-bin.zip (or the latest version) from SourceForge and unzip. Rename the unzipped folder to tn5250j for simplicity. Copy the folder to a USB stick. Insert the USB stick into the booted RaspberryPi. The GUI should automatically prompt to "Open with File Manager". Use File Manager to drag the tn5250j folder to /home/pi/ folder. For IBMiACS, create a folder on your USB stick called ibmiaccess and copy the following files from your download: acsbundle.jar, AcsConfig.properties, and logo128.png. Drag the ibmiaccess folder to the /home/pi folder. Open a terminal window and type: cd /home/pi/tn5250j or cd /home/pi/ibmiaccess <enter>, and type sudo chmod u+x *.jar to make all of the .jar files executable.

You can get the IBMiACS here: https://www.ibm.com/support/pages/ibm-i-access-client-solutions. It requires an IBM ID to log in and download the file(s).

To create a shell script for running the TN5250J program:

You must also go to System Tools > File Manager (launch), go to Edit > Preferences, and check the box beside: Don't Ask Options On Launch Executable File, and click Close, so that the GUI won't prompt you each time the desktop shell file attempts to launch your emulator program. At this point, if you reboot the RasPi the system should auto-login to the GUI and then launch the TN5250J or IBMiACS program (if you elected for auto-launch option above). You can then set up a terminal session to your IBM-i system (yes, you can define multiple sessions), remap your keyboard (by default the enter key on the number pad isn't mapped as Enter). You're restricted to two key maps per function in TN5250J, so if you're used to the right control key also being an Enter key, you'll have to choose. If for some reason you should have an issue with the TN5250J application locking up on launch due to a possible error in session settings, just launch a terminal session, cd /home/pi/.tn5250j *important: put the period in front of tn5250j in this case, as it is a hidden directory that contains the configuration files*. Typing pwd will display your current directory. Use ls -l to display files in the directory. You can delete the sessions file using sudo rm sessions. TN5250J will recreate the sessions file when you launch TN5250J and re-add the sessions to the configuration screen. Always remember to click APPLY. Mark the first session you create as "default" and it will auto-launch that session every time the device boots. Also, to modify sessions or add sessions, you must right-click the mouse inside the session window and the edit options panel will pop up.


The IBM i Access Client Solutions setup is a bit different. If you use this on your Windows PCs, then you're already familiar with the setup. One important mention is that if you want to RESTRICT the functions that the user can access within the IBMiACS client, you do the following: close the IBMiACS client. Open a terminal window (SystemTools>LXTerminal) and type: cd /usr/local/bin. Now, type sudo ibmiaccess.sh to launch the IBMiACS client as the ROOT user. This will give you access to a "hidden" menu that only the root user has access to. Go to Edit, and Preferences, and you'll now see a Tab named Restrictions. Check the box next to the functions that you WANT to restrict users from accessing. There's also an option at the bottom of this list to "hide restricted functions" so that users can't see what they don't have access to. Once you define a system and session and save as an .HOD file, you can insert those values into your shell program to automatically launch the emulator with the pre-defined system, session, and terminal ID.
​

If you want the Display Power Management System (DPMS) to NOT auto-sleep the display, go to the main menu (bottom left), and click Preferences > Screensaver. You can then disable the screensaver or set the timeout variable, and the Advanced tab has the DPMS settings (disabled by default). Here's my Youtube Video that shows all of these steps: https://youtu.be/Me-cefl_9qM

​​If you want the 5250 session to open in full screen and auto login to the 5250 emulator (not the IBM-i login), then do the following:

Open terminal session
cd/usr/local/bin
sudo nano ibmiaccess.sh
​edit the java execution line to read as follows:
java -jar $dir/$jar_name /plugin=5250 /system=SystemDNSName /name=SessionName /wsid=WorkStationID* /fullscreen=1 /nosave=1 /prompt=0 /sso=0
Ctrl-O and enter to save, Ctrl-X to exit

cd /home/pi
sudo nano .netrc  (yes, the filename should have a period at the beginning)
*type this into the nano editor:
machine DNS-name-of-IBM-i-system login LOGINIDHERE password SESSIONPASSWORDHERE
ctrl O -> enter to save file
ctrl x to exit nano
ls -l -a .netrc will show file and owner as root
sudo chown pi:pi .netrc
ls -l -a .netrc  (should now show pi as owner)
reboot 

Based on recent input, I've edited the original post to add instructions for cloning the SD card for the Pi-5250 project. Insert the SD-card into your Windows PC. For those without an SD-card slot, there are USB SD-card readers. Launch Win32DiskImager (available on SourceForge). Click the folder icon next to the Image File box, navigate to a local folder and type in the name of the image file you want to use, with a .img extension (see example below). Choose your SD-card device drive letter. It will have (2) drive letters assigned such as E and F. Pick the E: drive as the device. Now click READ at the bottom of the window. Win32DiskImager will read the SD entire card to a .IMG file. You can then insert a blank SD-card into your PC, re-launch Win32DiskImager, navigate to the .IMG file location, pick your image, choose the SD-card device drive letter, and click WRITE to create a new SD card that is a clone of your prior image.