Virtualization Tips » Tools

VMware vSphere and security scan false positives on OpenSSH vulnerabilities

Brian — Thu, 09 Sep 2010 00:40:04 +0000

This is something that we get on a regular basis from the security team. When doing their regular security scans for compliance and vulnerabilities I always get a long list of ESX hosts. The scans normally come back and complain about an OpenSSH x11 vulnerability or an OpenSSH Memory and Buffer Overflow.

These seem to be False positives from the tool being used to scan the hosts. We always make sure that we have installed the necessary updates related to OpenSSH as VMware releases them. But the tool always comes back with these issues. It seems to stem from the fact that the tool looks at OpenSSH in generic terms and assumes that all vendors implement it in the same way. From the documents listed below VMware indicates that since ESX 3.x VMware no longer included the x11 packages with their products. I would recommend that you make sure you are up to date on your patches and if the scans still come back dirty that you should discuss this results with the Application vendor that created the scanning tool. You might find out that this is common and they are just false positives.

Links:

VMware ESX Server and Security Issues in OpenSSH

Security Response: SSH Version Installed with ESX Server May Be Vulnerable

About Brian

Brian is a Technical Architect for a VMware partner and owner of this website. He is active in the VMware community and is helps lead the Chicago VMUG group. This blog Virtualize Tips was started to document and remember things that I come across while working with tech.

Mail | Web | Twitter | LinkedIn | More Posts (169)

Veeam Reporter Free edition is ready for prime time

Brian — Tue, 17 Aug 2010 20:46:29 +0000

Just to be upfront Veeam has a blogger contest running from the date of this article to August 30th, 2010. The basis of this contest is the blogger that drives the most downloads of this new FREE Veeam product. Veeam will then donate $1000 to the winners selected charity and the second place blogger will get to donate $250 to their charity. So I urge you to use this DOWNLOAD LINK and try this cool product from Veeam. Nothing would make me feel better by helping my readers discover a sweet free tool and in turn help me with a chance to help out a local charity in my area. Ok enough with the details and now I can talk about the product info.

The team over at Veeam has been hard at work and is releasing a Free version of their Veeam Reporter tool. The free version joins several other popular free tools that Veeam already offers. The free version of Veeam Reporter includes all of the core features of the paid version with no limits on your number of Hosts, Virtual Machines or size of your data archive. If you want to see the comparison of the free and paid products you can download the PDF here. The release of the free tool also coincides with the update of the paid product to 4.1 version which is adding Capacity Planning to the list of features.

The Veeam Reporter tool both the Free and Paid versions focus on Enterprise reporting, Change management and Capacity Planning. You can report on these important factors and use this to correct any pending pitfalls. Have a look at the short video that I created that shows how simple the product is to setup and begin creating reports. Oh and don’t for get to Download Veeam Report Free Edition.

The new Veeam Reporter Free Edition 4.1 is a powerful tool in it’s own right. I will be using it in my environments in the near future as I dig more into the reports and see how much value I can pull out of them. If you are considering purchasing the full version of this then the Free edition is a great way to get your feet wet in the Veeam Reporter world.

Here are a few of the reports that I will be looking to use in my world. I will use the Infrastructure Change report to find out any that has recently changed that could help in troubleshooting an issue, granted in the free version I will be limited to 24 hours of data. I will also be trying out the capacity reports pack to see if it can produce some of the reports that we may need to create via scripting soon. And lastly the I’ll be working with the Performance Report Pack to see how the reports can help me keep a watchful eye on Host and VM performance. There are many other reports available in the tool but there are just a few that interested me initially.

So in closing your probably wondering man this sounds great why would I need to buy the Full version of the tool. Well here are a the features not available in the Free edition that greatly benefit large environments. You can download the Reporter Free Tool from Veeam here.

Capacity Planning – report pack
Historical Change Management – beyond 24 hour limit in free tool
Microsoft Visio reporting
Full access to archive data
Full feature dashboard – 1 report limit in free tool
Automatic report distribution – have it waiting in your Inbox each morning

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

VKernel announces Chargeback 2.0 for vSphere and Hyper-V shops

Brian — Tue, 27 Jul 2010 21:42:24 +0000

The team at VKernel have announced the release of Chargeback 2.0. The new release extends chargeback support to both Microsoft Hyper-V Server 2008 R2 and VMware ESX environments. While I don’t know of many mixed environment shops yet, but I know that people will continue to move this direction. It’s nice to see vendors begin to update tools to support multiple vendors. I have not had a chance to look at this product yet but plan to test it in the future and will write up something about my experience. You can read more at their site http://www.vkernel.com/products/chargeback

Some text from their press release

The release also adds support for mixed chargeback models. VKernel Chargeback 2.0 now supports both allocated and actual resource consumption models. By reporting on both measures, infrastructure teams can chargeback for actual resource consumption, allocated resources, or simply show application teams the difference in real dollars between their allocated capacity and actual usage. This cost visibility is critical to capacity management, reducing VM spral and supporting private cloud initiatives.

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

VKernel Capacity Analyzer goes head to head with VMware CapacityIQ

Brian — Tue, 20 Jul 2010 16:22:03 +0000

After a recent release of a comparison chart from VMware marketing it appears that VKernel is also taking the gloves off. In the past the two parties seem to be playing nice and VMware was not actively marketing the CapacityIQ product. But VMware seems to be on the attack now and is no longer going to concede this segment to third parties. I recently received the email listed below from VKernel as their response to VMware’s actions, They feel their product stands up against VMware CapacityIQ and is willing to offer administrators a challenge.

Hi There,

You may have seen a recent VMware marketing sheet comparing VMware CapacityIQ to VKernel’s products. We are flattered by their attention!

So here is our challenge: download CapacityIQ from VMware and do the same for Capacity Analyzer. See which one more accurately shows current performance bottlenecks in your VM environment or predicts future bottlenecks.

If we lose, dinner is on us from Omaha Steaks, or we will make a $100 contribution to a charity of your choice.

Either way, you will end up with a full belly or a VM environment free of performance problems.

Best regards,
Bryan Semple
CMO, VKernel
Blog: http://blog.vkernel.com

VKernel Corp.
300 Brickstone Square, Suite 503
Andover, MA 01810

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

Install vSphere ESX 4.0 with EDA Deployment appliance

Brian — Tue, 29 Jun 2010 03:50:16 +0000

I’ve seen a few other guides for this same type of install. I just wanted to put something together to save for myself. I will show you how to use the EDA deployment appliance to install vSphere in VMware Workstation. You can follow most of the same steps for a physical machine install with just a few changes.

For this I was testing things for my home lab and created this on my laptop just using Workstation 7.0. I created two virtual machines, one for the EDA appliance and one blank that will get ESX 4.0 installed from the Deployment script.

Step 1: Download the EDA appliance http://www.vmware.com/appliances/directory/va/89313/download

Step 2: Import the EDA virtual appliance into VMware workstation.

Step 3: After the input I had to add in a CD-Rom to the VM and attached the vSphere .iso file to the CD drive.

Step 4: You can then start up the EDA appliance and choose Reconfigure.

Step 5: Fill out your network information on the screen shown below. Then press enter or click on OK.

Step 6: You can now log into the configuration web page for the EDA appliance. In my configuration it was http://192.168.1.19
The default login for the page is root - root. You will be presented with several sections that will allow you to configure options for the install. I will briefly cover these parts as I did not change much on them for this test. The Post installation commands section allows you to script any custom changes or adds that you want to make for your install. The General settings section is used for basic network and disk settings for each install, this section is pretty easy to understand.

Step 7: Now you are ready to prepare the Host specific details. Refer to the image below as I describe the steps. You can either modify the sample host that is loaded by default. By clicking on the host name or selecting “new host” you will get a screen like the 2nd picture below. This will allow you to specify host name and IP addresses needed for your base install. Once created if you click on the “ks” link for the hostname you will see what the kick start file contains for commands.

Step 8: Now you will need to setup the options for the DHCP server. Upon clicking on the “configure DHCP server” link from the top menu you will be presented with the following configuration file. I highlighted a few of the important lines that I changed to work for my setup. You will need to make sure all of the normal DHCP options are set in this file.

Step 9: Now you will need to “import PXE files” so that you can boot the server that you will be installing ESX onto. You need to make sure that the ESX CD or .iso file is mounted to your EDA appliance. If the ESX disc or file is properly mounted you will see the confirmation in the top right just like the image below. Then you select the “Import PXE bootfiles” from the menu and you will see a screen like the second image below.

Step 10: If you are using a physical server to install onto you can start now and have the machine PXE boot.
If you are going to use a virtual machine you need to create a VM with the proper OS select, disk size, memory and number of Nic’s that you wish to use. Once this is done you will see a screen like the one below you start the install. I trust that you know what settings need to be used for installing ESX into VMware workstation, if not there are plenty of good guides for it. If you are using Workstation 7.x the process is now built in and very easy to select from the OS choices.

Note: If you created multiple host install names you will get presented with the options and can type the name of the one you wish to install. I circled in red above as an example.

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

Updated version of VMware Guest Console (VGC) has arrived

Brian — Wed, 02 Jun 2010 18:18:56 +0000

The VGC is probably my personal favorite from VMware Labs so far. It is a simple but powerful utility with some cool features you don’t get with the standard vSphere client. I wrote about VMware guest console in the past covering its basic features that you can read here. Listed below are the latest features to be added or updated to this little Gem. You can have a look at VMware labs and download VGC for yourself here.

Performance & Scalability -
1. VM retrieval is enhanced to discover VMs in much lesser time.
2. VGC can manage up to 315 Powered On VMs on all connected servers. Number of VMs retrieved from a server will be limited once this limit is reached.
Support for 64 bit Windows has been added.
Remote Console feature has been extended to work with VMs hosted on vCenter.
Workspace files created with this version of VGC will be encrypted. However, workspace files created using earlier versions are not compatible with this release.
VM Templates are differentiated from regular VMs.
Workspace files can now be loaded in VGC by double clicking the .vgc files.

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

RV Tools 2.9 has been released

Brian — Fri, 30 Apr 2010 19:17:45 +0000

I have written about RV Tools in the past and what a great free tool Rob has created. He has recently updates to version 2.9 with some new features. I recommend that you have a look and I know it’s a staple in my toolkit. Here are some of the updates in this new version. You can download the tool from Rob’s site here.

On vHost tab new fields: Vendor and model.
On vHost tab new fields: Bios version and Bios release date.
On vInfo tab new field: VM overall size in bytes (visible when using VI API 4.0)
On vSnapshot tab new fields: Snapshot filename and size in bytes (visible when using VI API 4.0)
New vNic tab. The vNic tab displays for each physival nic on the host the following fields: Host, datacenter, cluster name, network device, driver, speed, duplex setting, mac address, PCI and wakeon switch.
Layout change on vHost, vSwitch and vPort tabpages. They now all start with host name, datacenter and cluster name.
The commandline function ExportAll extended with an extra optional parameter. It’s now possible to specify the directory where the export files are written.

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

Beginners guide on how to setup HP MSA 2312sa Storage array

Brian — Fri, 02 Apr 2010 15:41:12 +0000

I recently setup a HP MSA 2300 series storage array. It was the SAS model with 4 enclosure trays. I have to admit that I have not setup one of these with Fiber or iSCSI but they are very similar other than the assign to host part. In the setup guide I cover how to configure the management interfaces, create Vdisks, create volumes and then assign them to hosts. It covers different ways to setup your hot spare drives.

After reading this short document you will be able to get that new MSA array up and running quickly. I set my array up to talk to a small 3 node vSphere cluster but the setup would be the same if you were using for a Windows cluster or most other uses.

You can download the PDF of the document How to Setup MSA array here.

Update 1-10-2011

I saw that someone else has created a Best practices document for the P2000 series. It’s not an official document but worth a look for new users. Have a look here.

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

HP Insight Control integration with VMware vCenter server announced

Brian — Mon, 29 Mar 2010 20:32:01 +0000

Today at the HP Storage Day blogger event HP announced the integration of HP Insight Control with VMware vCenter. This raises the bar with whats been available to this point via CIM agents provided by hardware manufacturers. I have listed some of the main bullet points from HP below. My biggest question will be can I manage the RAID adapters inside the hosts with this new plugin?

The HP Insight Control extension for VMware vCenter Server delivers powerful HP hardware management capabilities to virtualization administrators, enabling comprehensive monitoring, remote control and power optimization directly from the vCenter console. In addition, Insight Control delivers robust deployment capabilities and is an integration point for the broader portfolio of infrastructure management, service automation and IT operations solutions available from HP. Key capabilities integrated into the vCenter console include:

Combined physical and virtual view: From a single pane of glass, monitor status and performance of virtual machines and the underlying host systems that support them.
Integrated troubleshooting: Receive prefailure and failure alerts on HP server components and invoke HP management tools, such as Systems Insight Manager and Onboard Administrator, in-context, directly from the vCenter console
Powerful Remote Control: Remotely manage and troubleshoot HP ProLiant and BladeSystem servers using HP Integrated Lights Out Advanced capabilities directly from the vCenter console.
Proactive power management: Get the most out of your existing power envelope by comprehending and proactively managing power for hosts and pools of virtual machines across hosts

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)

VMware labs Guest Console is a great tool

Brian — Sun, 21 Mar 2010 17:34:18 +0000

I’ve been taking some time when it’s available to play with some of the great tools available from the VMware Labs site that launched recently. The Labs site offers tools developed by talented people that are not yet ready for general release but are very good programs. The latest one that I tried was the VMware Guest Console. Not knowing what it was going to be since there are a few others like this from 3rd party developers already.

The VGC as it’s also known has been a pleasant surprise. It’s way more than just a remote control application. I have broken down some of the biggest features below along with screen shots. Some of my favorite features so far are the ability to open a putty session to the ESX host, Open the VM console or RDP session to the VM from the application. You can also use file explorer to see the local drives on the VM and Task Manager of the VM to see what processes are running. You can download the VGC application here.

Once you have connected to a ESX host or vCenter server you will get many of the standard options for a host or virtual machine. You work with snapshots of a Virtual Machine such as Create, Go To or Remove a Snapshot. There are also the standard VMware power related tools to allow for power on/off, reset and suspend of a Virtual Machine. You also have the option to upgrade the tools in the guest machine.

Lets take a look at the guest console options. You have a few options related to the Terminal and Console buttons depending on if you are selecting a Host or Guest machine. You can see from the picture below that if you choose the console selection from menu while selecting a Guest machine you will get the VM console of that guest. From there you can use the Device menu to connect to a Floppy or CD image and see details about the network adapters. Along the bottom of the screen you also have icons giving you feed back about what devices are connected to this guest machine. You can launch a RDP session by clicking the Terminal button while selecting a Windows guest machine.

Next up would be the ability to look into the Guest machine and work with Task Manager. Once you have authenticated with the Guest machine you will be able to access the Task Manager to see and interact with the process running on the machine. For this I used a Windows guest machine and was able to End a process or End a similar process by right clicking on an item. If you use the Applications menu from the menu at the top you can also select the “New Task” selection to execute a application in the Guest Machine. There is also an option to Save Processes Details which will export to a .CSV file. The file will give you a listing of the processes running at the time of the capture into a file.

Next up would be the File Explorer section. From this section you will be able to browse the local drives of the Guest Machine much like using Windows Explorer. From here you can choose to download a file or folder and also be able to upload files to the Guest. This could be very handy in uploading something that you need to while connected to the console.

There are a few other basic features of the application that are very similar to working with guests and the host from the vSphere client or vCenter server so I did not cover them here. One nice thing was the ability to click on a host then the Virtual Machine tab and you get the following view that shows things like Guest name, IP Address, Uptime, OS Type, Authenticated user and some basic virtual hardware information.

So if any of these features sound appealing to you I would highly suggest that you give the VGC a test run and see how it might help you in your daily work. Remember you can download it from the VMware Labs.

About Brian

Mail | Web | Twitter | LinkedIn | More Posts (169)