There is a new web interface for the Patch and Update Releases for VMware that simplifies the selection and download of the patches. So far, it applies to the following products: ESX Server 2.0.2 to 3.5, ESX Server 3i and Virtual Center.

This is the link to the new page!

Posted by Gabriel Maciel

A week or so ago, Andrew Kutz made public 2 new client plugins for the VMware Infrastructure 3.5 environment. This week, we are glad to see that the list goes up to 7!

1. SVMotion: This VI plugin allows VMware administrators to invoke storage VMotion (SVMotion) events.
2. Add Port Groups: This plugin enables the creation of multiple port groups of any type on an number of ESX servers and virtual switches at once.
3. Rdp: Allows for RDP from VMware Virtual Infrastructure client right click menu.
4. Console: Adds a SSH enabled tab named 'Console' when a host system is selected.
5. KeySniffer: KeySniffer is an example of how VI 2.5 client plugins can be abused. This plugin sniffs all key strokes that occur within the VI 2.5 client and outputs them to C:\viclientkeystrokes.txt.
6. Invoke: Allows third-party applications to be launched from within the VI 2.5 client using an existing, authenticated session cookie.
7. 37migrations: The 37migrations plugin was developed in conjunction with 37migrations.com. It increments your VMotion count on the 37migrations server every time a migration event occurs.

Posted by Gabriel Maciel

VMware is now offering email patch notifications for all of its products. It seems that the service has been running since last December but the VMTN Blog just mentioned this a couple of weeks ago.

"With this service, you will immediately be sent an email alert as soon as a patch or maintenance release becomes available on the VMware products you've purchased. How does this work? You can initiate this activity by selecting the Receive Patch/Maintenance Alerts link from our Support home page, providing your email address, and then, after verifying that we've got the right contact, you can select the product/s you would like notification on by selecting "Confirm Subscription" from within the email confirmation we will send you."

Posted By Gabriel Maciel

Here are some best practices published by the VMware Security Blog for keeping your VMotion traffic secure:

1. The most important VMotion best practice is to isolate your VMotion activity from all production network traffic. The current design of VMotion assumes that the VMotion network is secure within a data center, certainly within a rack or set of adjacent racks. In a typical situation, servers in one or more co-located racks would each have one or two network cards dedicated for VMotion; these would be connected to a switch or VLAN that has no other endpoints connected.
Isolating VMotion takes away that most common of staging points for man-in-the-middle: some unpatched box anywhere on the production network that has already been taken over by malware. Indeed why any non-ESX box, compromised or not, would be on this network at all would be immediately in question. The researcher's assumption is that long-haul VMotion over wide area networks might become popular in the future. However, most companies today already use encrypted links for inter-datacenter traffic.

2. Tightly restrict access to VI administrative accounts and roles. With VMotion isolated, a virtual rogue presence is more plausible than a physical one, but even a compromised guest VM does not have a virtual NIC on the VMotion network, only on the production network. Therefore the rogue VM must be configured in VI to have a vNIC on the VMotion network.

3. Don't enable promiscuous mode on vswitches. Unlike a physical network card, someone who has taken over a guest VM cannot cannot configure a vNIC to be promiscuous. Another VI admin setting, promiscuous mode (off by default) is configured on the virtual switch port separately from a VM. Also, to manipulate rather than snoop, the proof-of-concept technique requires traffic actually route through the rogue VM, which would not occur naturally on the vswitch."
More Best practices for hardening your VMware Infrastructure environment can be found here.

More information about this article here.

Posted By Gabriel Maciel

There are several tools and utilities that I use every day to administer our VMware environment and I would like to share here with you:

Virtual Center and ESX:

• PuTTY is a robust and highly configurable free implementation of Telnet and SSH.
• Veeam FastSCP (Fast & Secure Copy) is my favorite tool for managing files in ESX or Windows. Also, WinSCP is another good utility that has been around for a while.
• Veeam RootAccess gives you an easy way to enable / disable remote root access or create a regular user account. Combine it with FastSCP and you can easily enable root access, transfer your files and disable root access again.
• EsxDiag for ESX Server 3.x is a free console script that will check several services and configurations for you. EsxDiag is part of Veeam Configurator.
• vmCDConnected scans all the Virtual Machines and shows if they have a CD connected to it. After scanning the VM's, you can disconnect the CD's with a simple click.
• SnapHunter will report to you which virtual machines have snapshots. The tool is very useful if you want to automatically track how much space they are consuming in your virtual environment.
• esx-autopatch.pl is another rock solid utility that combined with a Web Server (optional) can quickly patch you entire environment.

• VMware DiskMount GUI is a front-end for VMware's drive mapper.
• VMware DiskManager GUI is a front-end for VMware's disk manager.
• Virtual DiskFactory is another front-end for VMware's disk manager with more advanced functions.
• EasyVMX is the best on-line virtual machine builder.

As always, feel free to add your tools to the list!

Posted By Gabriel Maciel