Showing posts with label ESXi. Show all posts
Showing posts with label ESXi. Show all posts

Tuesday, April 24, 2012

Interesting Virtual News and Posts - #3

virtuallyGhetto: vSphere Security Hardening Report Script for vSphere 5
William has upated his script that allows you to check your vSphere infrastructure hardening. It includes new  requirements from vSphere 5.0 Security Hardening Guide (public draft).

Well, the fact of the publishing of public draft vSphere 5.0 Security Hardening Guide is interesting news also :)
Here is a document with changes between 4.1 and 5.0.

VMware ESXi 5 snapshot changes
Post describes some traits of ESXi 5 snapshots. 

Vmware View 5.1 Rumours: new version will be released on May 9th.

Creating and Reviewing Windows crash dumps in VMware virtual machines
Instructions: how to create memory.dmp from from the running virtual machine with Windows

RVTools is a windows .NET 2.0 application which uses the VI SDK to display information about your virtual machines and ESX hosts. Interacting with VirtualCenter 2.5, ESX Server 3.5, ESX Server 3i, ESX Server 4i, VirtualCenter 4.0, ESX Server 4.0, VirtualCenter 4.1, ESX Server 4.1, VirtualCenter 5.0, VirtualCenter Appliance or ESX Server 5 RVTools is able to list information about VMs, CPU, Memory, Disks, Partitions, Network, Floppy drives, CD drives, Snapshots, VMware tools, ESX hosts, HBAs, Nics, Switches, Ports, Distributed Switches, Distributed Ports, Service consoles, VM Kernels, Datastores and health checks. With RVTools you can disconnect the cd-rom or floppy drives from the virtual machines and RVTools is able to update the VMware Tools installed inside each virtual machine to the latest version.

Tuesday, April 17, 2012

Debate: Hyper-V vs vSphere

There was interesting debate in about month ago "Can Windows Server 8's Hyper-V finally make inroads against VMWare?".

I want to share some interesting notes from this debate. My notes are written in italic type.
Green selection is for Hyper-V fighter, blue is for VMware.


"Currently available statistics show that only around 50% of workloads (e.g. Exchange, SQL Server, SharePoint, etc.) are currently virtualized."

"If I were in product marketing at Microsoft, however, I'd tell you that it's a VMware killer. That's just good business. Also, if you think that VMware isn't going to continue to innovate and produce in the field that it created, you're sadly mistaken. Microsoft's Hyper-V is basically an attempt to enter a committed market."


That's right. All cool Hyper-V features can be found in 3.0 version only that's only in Beta. And I think that only after about year we can try real Hyper-V 3.0.


"It's very difficult to compare a list of features between two products like VMware's vSphere 5 and Microsoft's Hyper-V 3. Why? Because Hyper-V 3 isn't available until next year and vSphere 5 will go through at least one major feature update between now and then. Hyper-V really comes out of the gate in catch-up mode and it will always be in catch-up mode compared to VMware."

"Hyper-V 3 is Microsoft's Great Virtual Hope because they realize that heavy, non-virtual operating systems are about to die a painful and malingering death by attrition"

"I believe that Red Hat and KVM-based offerings from the Open Virtual Alliance will offer a compelling solution for cloud providers who for whatever reason, will want a 100 percent open source virtualization solution and will want to roll their own infrastructure or rely on systems integrators to tie in most of the pieces. But I think this will be the exception rather than the norm -- the majority of enterprises are unlikely to go this route, they will want fully supported vendor solutions if they end up doing things in-house"

"Some people complain about VMware's pricing but those are not the decision makers, they are the techies. People who have the financial responsibility for SLAs and customers aren't going to bank on an unproven technology. When the techies are home playing video games or geeking out over a new gadget, the C-level executives are planning and constructing next year's budget and their long-term plans for expansion and they want stability, scalability and VMware's experience behind that."

Does Hyper-V really save money? How much?
"VMware costs can run 10 times Microsoft's costs"
"Hyper-V isn't free. You have to purchase the base OS, which is far from free. There might be a "free" version but you don't get any Windows licenses with it. That's useless. There are other free hypervisors available if you're looking for free ones.
To say that Hyper-V is free is really not being honest. If it's totally free, then can I run it on Linux? No, I have to buy a MS licensed OS first. That really isn't free
"

How easy is it to migrate from a Vmware infrastructure to a Hyper-V infrastructure?
"Very easy... First, System Center can manage both a VMware and a Microsoft environment, allowing co-existence and easy migration. Additionally, Hyper-V comes with Windows Server, so most customers already have it."
"What you really need to know is how difficult will it be to change back to VMware from Hyper-V, once you realize your mistake." I like it :)

Does the pain of migrating justify the cost-savings?

Absolutely...
No way. Absolutely not...   Did you have doubts? :)
"Even with a high migration cost of $600/VM, migrating from VMware can produce a savings of $4 million over 5 years, for a 1000 VM environment."
"Think of the Celsius to Fahrenheit temperature conversion formula when you think of converting from VMware to Hyper-V; double your current hardware requirements and add 32.
This is the step known as the "Microsoft Tax."
"

How about "private cloud"?
"Microsoft is the only company that has in-production private and public cloud offerings today. "
"If you want to lock-in to a vendor for public/private cloud services, then Microsoft might be for you."


What about the Netware comparison?
Perlow brought up the NT versus Netware race as comparable to Hyper-V versus Vmware. How and why does this comparison work, or why doesn't it?
"they (VMware) only have a virtualization stack, they do not have a NOS, they do not have end-to-end managment, and they do not have the application infrastructure. When compared to the overall MS ecosystem, VMware only has virtualization"
"Hyper-V, on the other hand, is really an unnecessary effort on Microsoft's part. These days data centers and desktops need no such consolidation or standardization. Management is (or should be) web-based so that workstations can be Linux, Mac, Windows, Chrome or mobile devices."

How do we tell who's winning in 2012?
"I believe when IT environments start looking at how they need to consolidate imporant, performance based workloads such as SQL server, Sharepoint, and Exchange, and start thinking about creating large shared infrastructure that can be easily provisioned, then we are going to see Hyper-V gather significant market share"
"2012 isn't the deciding year. 2013 won't be either. Your probably looking at 2015 before you'll see any sort of uptake or adoption of Hyper-V, if any. Why? Because of maturity...This isn't VMware's first rodeo, as we say in Texas, and by the time any companies might begin to embrace Hyper-V, VMware will have produced another major version or two, while Microsoft will still be patching Hyper-V version 3 with weekly "Patch Tuesday" updates or releasing its R2 version"

Summary
"VMware has a single area of specialization -- Virtualization, for which it charges a heavy premium. And that single area of specialization is an exposure when your competitor has a complete solution across the entire stack and your entire reason for being is to provide virtual access to your competitor's operating systems.
With Hyper-V in Windows Server 8, Microsoft will offer you a best in class hypervisor along with great deal more built-in features for a heck of a lot less money, which has become scarce in today's shrinking IT budgets. These financial constraints have been pressuring CIOs to do a lot more with a lot less, and it's a trend that is not going to change anytime soon.
The bottom line is that Hyper-V has been a stable, proven, high-performance virtual infrastructure solution for at least the last two years, and it has already been gaining some traction in enterprises for its ability to consolidate high-performance Windows workloads. Environments should not throw out their existing VMware infrastructure, but if your organization is looking to grow its virtualized Windows footprint, you'd be foolhardy not to give Hyper-V a very close look
"
"VMware has more soldiers than Microsoft does. Virtualization is VMware's only profession. Microsoft is a highly diversified software company that produces hundreds of different software programs including games, desktop applications, server applications, operating systems, servers and more. VMware invented x86 virtualization. Hyper-V is Microsoft's attempt to remain relevant in this cloud-oriented, virtualization-focused world"

Audience Favored: Hyper-V (54%)
My vote is for VMware. What's about you?

Sunday, April 8, 2012

Enable remote syslog in ESXi 5.0 Update 1

VMware changed default firewall behavior with ESXi 5.0 Update 1.
So if you use remote syslog, you need to enable syslog service in firewall settings:

esxcli network firewall ruleset set –ruleset-id=syslog –enable=true
esxcli network firewall refresh

Friday, February 24, 2012

Hyper-V vs vSphere: new comparison


I just read interesting post-thought about Hyper-V future. Can Microsoft close the gap between Hyper-V and VMware vSphere with Hyper-V 3.0 release? In my opinion they can, but it will depend on its release date and released feature set. At least for now Hyper-V 3.0 looks very promising. Will see...
I recommend to check this post also to get interesting comprasion Hyper-V 3.0 and vSphere 5.0

Tuesday, January 17, 2012

Free tool to check VMware ESX/ESXi compliance

I'm pleasure to announce that we have released new version of vGate Compliance Checker (update June 25 2015: now we have Russian version only).

Compliance checker is a free reporting tool that allows you to verify whether your virtual environment complies with industry standards for information security: PCI DSS 2.0, CIS VMware ESX Server Benchmark, VMware Security Hardening Best Practices.

It is distributed as a single executable – no installation or registration is required.

Supported VMware product versions:
VMware vSphere 4 (Update 2)
VMware vSphere 4.1 (ESX & ESXi)
VMware vSphere 5.0

Enjoy :)

Thursday, December 1, 2011

Run vSphere Security Hardening report in Windows

As you probably know VMware has interesting guideline: vSphere 4.1 Security Hardening Guide. This document provides instructions on how to securely deploy VMware vSphere™ 4.1 (“vSphere”) in a production environment. Also you can find very useful Perl script vmwarevSphereSecurityHardeningReportCheck.pl that can be ran on your environment and allows you to check your current state in according to the Security Hardening Guide.
Despite the fact that script does not check all requirements, it can help a lot.
To use this script you need to download and run vSphere Management Assistant in your environment. It is distributed as OVF template and can be installed very quickly. Virtual machine already has all necessary SDKs installed and you need just to copy vmwarevSphereSecurityHardeningReportCheck.pl script on your vMA. Note: to enable SSH connections on your vMA you need to read this article where you can find instructions “Issue with vMA5 & ssh” (check comments also, because I had some issues with file editing)
The main issue with vMA is its 64-bit OS, so if you want to run vMA on the virtual ESX(i) server you need to have hardware that supports VT-x/EPT instructions. I have Intel Core 2 Duo on my workstation and it doesn’t support this feature.
Actually script does not need vMA, it uses vSphere SDK for Perl so I have decided to try to run it in Windows host. I installed vSphere SDK for Perl and ran script. And it works, but with some issues that I have fixed: I replaced ‘grep’ with ’findstr ‘ and changed folder creation method. Also you need to have openSSL on your host. I use binary files from this package:http://gnuwin32.sourceforge.net/packages/openssl.htm).
These are step by step instructions:
1. Download and install vSphere SDK for Perl on the your Windows host (I use Win7 but I think that it should work on XP, 2003 and 2008 also)
2. Download openSSL binary package and copy openssl.exe, and libssl32.dll to the directory with Perl binaries.
3. Add path to the Perl binaries to your PATH environment variable
4. Download this script and enjoy. It supports ESX(i) 4.X and 5.0. Check RN in the script.
ALL COPYRIGHTS for script pertain to William Lam http://www.virtuallyghetto.com | @lamw
During the script checking I have fixed 2 bugs in the setting analysis. I posted these bugs (1 & 2) to VMwarevSphereSecuriyHardening Group forum and I as far I know William fixed it in the original script also.
Command line example:
perl.exe "PATH_TO_SCRIPT\vmwarevSphereSecurityHardeningReportCheck_win.pl" --recommend_check_level enterprise --server YOUR_SERVER --password PSWD --username USER --reportname "esx41_enter.html"
Check original script page to get details about command line parameters.
I will update this post and script as soon as it will be changed. I'm planning to extend its functionality so stay tuned.
Now we're planing to use this script for automatic testing. Our product vGate helps you ensure that your virtual infrastructure is compliant to popular security standarts: VMware Security Hardening Guide, CIS Benchmarks for vSphere 4.0 and PCI DSS 2.0
Thanks to William who was very responsive and answered all my questions.

Friday, June 3, 2011

All ESXi host config files in webAccessibleConfigFiles.xml

ESXi 4.1 server has interesting file '/etc/vmware/hostd/webAccessibleConfigFiles.xml' where is all configuration files are listed. You can find its names and paths there.

Actually it's list of all config files those are available with web access:
...

<configfileinfo>
<urireference>/host/vmware.lic</urireference>
<path>/etc/vmware/vmware.lic</path>
<displayname>vmware.lic</displayname>
<mimetype>text/plain</mimetype>
<method>GET</method>
<method>HEAD</method>
<method>PUT</method>
</configfileinfo>
<configfileinfo>
<urireference>/host/vmware_config</urireference>
<path>/etc/vmware/config</path>
<displayname>vmware_config</displayname>
<mimetype>text/plain</mimetype>
<method>GET</method>
<method>HEAD</method>
<method>PUT</method>
</configfileinfo>
<configfileinfo>
<urireference>/host/vmware_configrules</urireference>
<path>/etc/vmware/configrules</path>
<displayname>vmware_configrules</displayname>
<mimetype>text/plain</mimetype>
<method>GET</method>
<method>HEAD</method>
<method>PUT</method>
</configfileinfo>

...

Configure persistent logging (syslog) on ESXi host

ESXi 4.1 maintains a log of activity in log files, using a syslog facility. The
following logs are available:
• hostd.log
• messages
• vpxa.log (only if the host has been joined to a VirtualCenter instance)

By default, the messages log on ESXi are stored only in the in-memory file system. The logs are lost upon reboot, and only 1 day’s worth of logs are stored.
According to VMware Security Hardening Guide you can configure persistent logging to a datastore and a dedicated records of server activity are available for that host always.

VMware kb has recommendations about how to make it possible. But manual changes in 07.logger file work only for current session. After restart all changes reverted (kb has note about this). David note in this thread explains this issue. But how to resolve it and make possible persistent logging? Well, yes, vSphere Client works perfect and you can change syslog settings there. But I need to change it from TSM.

I have tried to edit '/etc/syslog.conf' file and it works! Between vSphere Client stores its changes for syslog settings in this file also.
So you need to:
- set your path to log file with 'logfile=' parameter. ie

logfile=/vmfs/volumes/4d5abbeb-22518c58-5ddc-000c2954a30d/logging/messagesX

where '4d5abbeb-22518c58-5ddc-000c2954a30d' is your storeID. You can use datastore label also (like "datastore1") in this path. Be sure that all folders in this path exist.

- find existing syslogd process and restart it:
ps | grep syslog > PID of syslogd
kill -HUP $syslogPID (restart process with selected PID)

Check that syslogd logs in the new file. Keep in mind that it continues to log in original "messages" file also (/var/log/messages). New log file is rotated and old versions are compressed automatically.

Manage ESXi Lockdown Mode from DCUI

If your VMware ESXi 4.0 & 4.1 servers are joined in VMware vCenter Server infrastructure then you can enchance security for these hosts. Follow on VMware Security Hardening you need to enable Lockdown Mode to restrict root access (HCN02 requirement).

Lockdown mode forces all operations to be performed through vCenter Server (you can continue to use Direct Console User Interface aka DCUI to manage host).

VMware Security Hardening guide notes that lockdown mode can be enabled or disabled in two places:
• In the vSphere Client, when connected to the vCenter Server managing the host
• In the DCUI of the host

In ESXi 4.0:
To check if Lockdown mode is enabled, run the command:
vim-cmd -U dcui vimsvc/auth/admin_account_is_enabled

To disable Lockdown mode, run the command:
vim-cmd -U dcui vimsvc/auth/admin_account_enable

To enable Lockdown mode, run the command:
vim-cmd -U dcui vimsvc/auth/admin_account_disable

In ESXi 4.1:
To check if Lockdown mode is enabled, run the command:
vim-cmd -U dcui vimsvc/auth/lockdown_is_enabled

To disable Lockdown mode, run the command:
vim-cmd -U dcui vimsvc/auth/lockdown_mode_exit

To enable Lockdown mode, run the command:
vim-cmd -U dcui vimsvc/auth/lockdown_mode_enter

See VMware kb to more details