Virtualization Intro COVER STORY GOINGChoosing tools for effective VIRTUALvirtualization

Good tools are half the battle – even if you are just managing virtual machines. This month we take a practical look at virtualization, and we show you a new threat to watch for in the virtual future. BY JENS-CHRISTOPH BRENDEL, HENNING SPRANG, AND JÜRGEN QUADE

ervers are not human. They don’t • Provisioning and deployment – creat- for virtual hardware, physical hard- live and breathe. They just con- ing the required number of virtual ware, users, and privileges. Ssume power and take up space. instances as quickly as possible and • Workload management – handling Do we really need so many? The virtual- with minimal need for manual config- multiple virtual machines or physical ization revolution is about saving uration. hosts and replacing instances in case money, time, and floor space. Today’s • Migration – converting physical ma- of failure. virtualization tools provide an efficient chines to virtual machines – and vice • Monitoring – providing detailed, real- environment for testing, running, and versa – if necessary. The ideal is on- time information on the status and managing applications – with lower elec- line conversion across the network, resource usage of individual virtual tric bills and fewer hardware headaches. requiring as little personal interven- machines. But is virtualization all good, or does it tion as possible. Equally important is The best solution for your network also open the door to new kinds of ensuring freedom of movement for depends on your needs and your budget. threats? virtual machines during operations. Table 1 introduces some of the more In this month’s cover story, we exam- Live migration is the basis of load ine the practical side of virtualization. balancing solutions with virtual We start with an introduction to some machines. of the virtualization tools available for • Administration – one of the Linux. Then we take a closer look at a most important consider- pair of popular open source virtualiza- ations for most networks. tion alternatives: Xen and VirtualBox. It starts with capacity Finally, we settle in for a look at the dark planning for virtual side of virtualization: the mysterious instances, through world of virtualizing rootkits. staging of storage and network Practical Virtualization resources, to The virtualization paradigm has come countless down to Earth, leaving the lofty heights settings of Mount Olympus for real-world con- cerns like stability, performance, and ease of management. A virtualization system that wants to fulfill all of these requirements must be ready for:

COVER STORY

Virtualizing with Xen ...... 30

Networking with VirtualBox ..... 34

Virtualizing Rootkits ...... 39

MAY 2008 ISSUE 90 21

021-027_coverintro.indd 21 12.03.2008 16:39:35 Uhr COVER STORY Virtualization Intro

popular virtualization options for Linux environments. Management Tools Many distributors have gone to great lengths to facilitate virtualization for their customers. Both the Novell and Red Hat enterprise distributions integrate a tool known as Virtual Machine Manager (or Virt-Manager). On SUSE, the tool is integrated with YaST. Virt-Manager gives users the ability to set up a Xen instance in a couple of simple steps. Besides Linux (Novell, Red Hat), Solaris 8-10, and Netware 6, the tool also works with various Windows versions – provided the CPU has the required virtualization support. Red Hat Enterprise Linux 5.1 also uses Virt-Manager for managing virtual ma- chines. Red Hat also offers a tool on top Figure 1: OpenQRM lets you manage physical and virtual computers with a single tool. of Enterprise Server, called Advanced Platform, which builds clusters of virtual administration tool, something that has physical machines on the same interface. machines and is capable of migrating been a mere sideshow in the past. Another contender is Qumranet's Solid guests across the borders of a physical Google also has a tool for virtual clus- ICE, which focuses entirely on desktop host. ter management, Ganeti, which is re- virtualization using the KVM kernel Fedora 8 gives a clue to where things leased under the GPL. Installing Ganeti hypervisor. are headed for Red Hat. The latest Fe- is complicated because the tool requires At the other end of the scale are vari- dora includes the new Xen 3.1, and the half a dozen Python modules, which ous small command-line tools, such as Virt-Manager version supports both Xen Novell, for example, does not provide in xen-tools, a collection of scripts used and QEMU. Additionally, Red Hat is a single package. on Debian for creating and configuring looking to improve the security of the Ganeti does not offer the convenience virtual instances. of a GUI. This said, the text-based Ganeti Virtualization in Action commands lend themselves to scripting Hosting Farms Amazon’s S3 storage system lets cus- solutions, which provides a means for In many cases, users do not need to sim- tomers store volatile data. Although this integrating the tool with other open ulate a full-fledged computer with a cus- offering is still officially in the “Unlim- source utilities. tom kernel for every one of the virtual ited Beta” phase, some companies are Another tool for managing virtual ma- guests. Professional hosters, who are already considering it for production chines is openQRM, a powerful utility simply concerned with keeping their use. that manages images for virtual and customers’ web offerings apart, are quite In November 2007, IBM announced that it would offer a similar service, Blue What Runs Where? Cloud, based on Xen and IBM’s own Power VM. Google also uses Xen: In a A rule of thumb dictates that flexibility requires either more performance or special move that is atypical for the corporation, hardware. In hardware virtualization, the physical CPU handles most of the guest’s which tends not to reveal details of its IT instructions: The hypervisor only steps in to avoid conflict. If the hardware is unable to systems, Google introduced the Ganeti detect conflict directly, para-virtualization takes the role of manager. This technology is management tool, which they have de- fairly advanced with respect to the main processor, whereas virtualization of I/O compo- veloped specially for this purpose. nents is still at an early stage of development. Emulators simulate almost any scenario and architecture, but their performance is comparatively slow because everything is Ganeti was released under the GPL in handled by the software. August 2007. The search giant uses the technology for its internal systems, but All of the virtualization solutions we discuss in this issue support Linux as a guest sys- not for its search engine. Ganeti is best tem, although some require changes to the guest kernel. These changes can cause a suited to systems with low resource re- problem with support for some applications, especially if the service provider requires quirements, said Google’s Guido Trotter a special kernel version. VMware and VirtualBox will basically run on any recent, un- at the LISA 07 conference. patched kernel, as will the emulators. Lufthansa also uses Xen for test sys- Guest support for different versions may be limited. The current Windows versions, tems. Recently, both Oracle and Sun XP and Vista, are supported by all server virtualizations; operating system virtualization surprised the market with the Oracle VM tools, such as OpenVZ or VServer, work on a different principle and cannot offer this and Sun xVM Xen variants. feature.

22 ISSUE 90 MAY 2008

021-027_coverintro.indd 22 12.03.2008 16:40:08 Uhr Customised IT solutions for individual needs are our strength!

With over 500 installed clusters, we offer everything – except inflexibility. We cover the entire portfolio from cost-effective entry clusters to enterprise solutions.

transtec Entry HPC Clusters are suitable for small work groups and fulfill the need for superior computing performance. Our mid-range clusters ensure that there are sufficient resources available for multiple power users or mid-sized work groups. The Enterprise Clusters offer the computing performance of multiple TFLOPs and a large number of compute nodes. You will always have enough power for future requirements and to work efficiently.

>> www.transtec.co.uk/go/cluster

Anytranstec AGquestions? We are happy to help: •Waldhörnlestraße transtec Computers 18 Ltd. • Suite A, Castle Link • 39 North Bar • Banbury • Oxfordshire OX16OTH 72072 Tübingen •Tel: Tel: 0 70 +44 71 / 703-400(0) 1295/756 100 • www.transtec.co.uk www.transtec.de

021-027_coverintro.indd 23 12.03.2008 16:40:22 Uhr COVER STORY Virtualization Intro

this approach to brand name. The OpenVZ virtualization the virtualization tools are available with any major distri- problem, giving bution. users an amazing application den- Shopping for Server sity on normal Virtualization? hardware, with The big players in the server virtuali- low overhead. zation market each offer advantages, Many profes- although a few of the tools are only for sional hosters use Windows. the commercial Virtuozzo product VMware to give customers Market leader VMware offers an excel- who want to lent line of virtualation products. How- manage their own ever, VMware's VirtualCenter manage- systems access to ment tool, which plays the role of man- Figure 2: XenCenter, the Citrix Xen Server command center, only virtual consoles. aging the guests on the ESX and GSX runs on Windows. SWsoft, the com- servers, only runs on Windows at pres- pany behind ent – and it doesn’t look like a Linux happy with a single kernel that the OpenVZ and Virtuozzo, first acquired port will be on the roadmap any time guests can share. a majority shareholding in Parallels, the in the near future. Virtualization solutions such as desktop virtualization company, early If you prefer a Linux-only solution, OpenVZ, Virtuozzo, and VServer use in 2007 and is now using the Parallels you have to make do with the free VM- Table 1: Virtualization Solutions Product Current Vendor Support Technology Typical Deployment Host OS Guest OS Version Scenarios XenServer 4 XenSource/ Citrix XenSource/ Citrix Hypervisor, para- Virtualization for Linux Modified Red Linux, Windows virtualization, and full and Windows servers Hat included virtualization with hardware support Xen GPL 3.1.2 Linux distributors Distributions, Hypervisor, para- Virtualization for Linux Linux, Solaris, Linux, Windows, independent virtualization, and full and Windows servers FreeBSD, FreeBSD, and vendors virtualization with NetBSD NetBSD in part hardware support para-virtual, Solaris (not all supported on all host systems) VMware VI 3 VMware VMware, partner Hypervisor with full Server virtualization, Linux Linux, Windows, virtualization virtual desktops BSD, … VMware 6 VMware VMware, partner Emulation Desktop virtualization Windows, Linux Linux, Windows, Workstation BSD, … Virtual Iron 4 Virtual Iron Virtual Iron Xen hypervisor Server virtualization Linux Linux and Windows OpenVZ 2.6.22 SWsoft and Community Virtualization at Server virtualization Linux Linux in host -ovz005 OpenVZ operating system on Linux kernel version Community level Virtuozzo 4 SWsoft SWsoft Virtualization at Server virtualization Windows, Linux Linux in host operating system on Linux/Windows kernel version, level Windows on Windows hosts VServer 2.2.0.5 Linux VServer Distributions, Virtualization at Server virtualization Linux Linux in host project independent operating-system on Linux kernel version vendors level KVM 55 Qumranet Community and Hardware Server and desktop Linux Linux, Windows, Qumranet for virtualization virtualization BSD, … commercial product QEMU 0.9.0 Fabrice Bellard Community Emulation, optionally Software testing, Linux, Windows Linux, Windows, accelerated via kernel desktop virtualization BSD; other pro- module for direct sor architec- access to resources tures possible (not with KQEMU) VirtualBox 1.5.2 Innotek Innotek Emulation, hardware Optional desktop Linux, Linux, Windows, virtualization virtualization Windows, OS X BSD in part

24 ISSUE 90 MAY 2008

021-027_coverintro.indd 24 12.03.2008 16:40:29 Uhr ฀฀฀฀฀฀฀฀฀฀ -/
/" Ê\Ê 18 ÜÜÜ°ˆ˜Õ݇“>}>∘i°Vœ“

iÜÃ

"˜ˆ˜iÊ ÝVÕÈÛiÊ œ˜Ìi˜ÌÊ

À̈ViÊ
ÀV ˆÛi

6ˆ`iœÊ-ÌÀi>“ˆ˜}Ê
ÀV ˆÛi

ˆ˜ÕÝÊ >}>∘iÊ"˜ˆ˜iÊ i«ÃÊޜÕÊÃÌ>ÞÊVœ˜˜iVÌi`Ê̜ÊÌ iʈ˜ÕÝÊ՘ˆÛiÀÃi°

"ÕÀʘiÜÊÜiLÈÌiʜvviÀÃÊiÝVÕÈÛiÊ>À̈ViÃʜ˜ÊV >i˜}ˆ˜}ÊÌiV ˜ˆV>Ê̜«ˆVÃÊ >˜`Ê«ÀœÛˆ`iÃʈ˜ÃÌ>˜ÌÊ>VViÃÃÊ̜ÊÌ iʏ>ÌiÃÌʈ˜ÕÝʘiÜðÊ9œÕÊV>˜ÊLÀœÜÃiÊvœÀÊ >˜ÃÜiÀÃÊLÞÊÃÕLiVÌʜÀÊÃi>ÀV ʜÕÀÊiÝÌi˜ÃˆÛiÊ>À̈ViÊ>ÀV ˆÛi°

vÊޜռÀiÊ Õ˜Ìˆ˜}ÊvœÀÊÌ iÊ«iÀviVÌÊ̜œ]ʜÀʈvÊޜÕʍÕÃÌʘii`ÊܓiÊ i«ÊÜˆÌ Ê Ì>VŽˆ˜}Ê>ʘiÌܜÀŽÊ«ÀœLi“]ÊÌ՘iʈ˜Ê̜ʈ˜ÕÝÊ >}>∘iÊ"˜ˆ˜it

NNN%C@ELO$D8>8Q@E<%:FD

021-027_coverintro.indd 25 12.03.2008 16:40:35 Uhr COVER STORY Virtualization Intro

least the most expensive Extended Enter- prise Edition, not only supports cloning of virtual instances and live migration, but also dynamic capacity management of virtual machines at run time. The Virtual Iron virtualization envi- ronment also includes high-availability features, such as failover for virtual ma- chines on a reserve host (N+1 clusters). Virtual Iron comes with sophisticated monitoring and logging for virtual in- stances and policy-based capacity man- agement, which gives administrators the ability to swap out virtual machines automatically if a host exceeds a specific load threshold. On the storage side, Virtual Iron sup- ports iSCSI, SAN (Fibre Channel), and NAS. VMware’s lead on its competitors is no longer very substantial; however, the price differences are still significant. Virtual Iron starts at US$ 500 per socket, whereas the price for VMware’s ESX Figure 3: VirtualBox supports either Windows or Linux guests. Server starts at approximately three times that. ware server. This entry-level solution laris 10. Although VMware Server does still has much to offer. The biggest visual not let you migrate VMs between physi- Xen Source change compared with the previous 1.x cal machines (in contrast to its big Xen Source Server used to be a Linux version on VMware server is the new brother ESX Server), and definitely not virtualization solution that was very web interface, Virtual Infrastructure Web at run time, at least virtual machines can Access. (The former standalone server reside in a shared memory area exported INFO console is no longer usable.) This web by NFS. Load balancing is also restricted [1] VMware: http://www. vmware. com interface requires a separate browser to the commercial versions; however, [2] Virtual Iron: plugin (Figure 1). the free version has excellent centralized http:// www. virtualiron. com Provisioning and deployment of VMs server administration and monitoring. [3] Novell: http:// www. novell. com is supported by a large number of tem- plates – for 17 Windows versions and Virtual Iron [4] Red Hat: http:// www. redhat. com/ 17 Linux distributions (including 64-bit Virtual Iron is hot on the heels of VM- [5] Xen: http:// www. xen. org/ variants) – as well as NetWare and So- ware. Its Virtual Iron 4 product, or at [6] Citrix: http:// www. citrix. com/ [7] VServer: http:// linux-vserver. org/ [8] Qumranet: http:// www. qumranet. com/ [9] KVM: http:// kvm. qumranet. com/ [10] Solid ICE: http:// web1. qumranet. com/ [11] QEMU: http:// fabrice. bellard. free. fr/ qemu/ [12] VirtualBox: http:// www. virtualbox. org [13] S3: http:// www. amazon. com/ gp/ browse. html?node=16427261 [14] Parallels: http:// www. parallels. com/ [15] Ganeti: http:// code. google. com/ p/ ganeti/ [16] SWsoft: http:// www. swsoft. com [17] OpenVZ: http:// openvz. org/ [18] openQRM: http:// www. openqrm. com [19] xen-tools: http:// xen-tools. org Figure 4: KVM is popular with both users and kernel developers.

26 ISSUE 90 MAY 2008

021-027_coverintro.indd 26 12.03.2008 16:40:37 Uhr Virtualization Intro COVER STORY

Figure 5: Tracking virtual systems with Virtual Machine Manager. Figure 6: Monitor your virtual environment with Virtuozzo.

close to the VMware concept. Citrix re- Motion, which resembles VMware’s the major contenders. On the other cently acquired Xen Source. The server VMotion. hand, a single host is easily managed product, which is now know as Citrix through less sophisticated alternatives. Xen Server, is still a Linux system at its Conclusions Before choosing a virtualization sys- core. Unfortunately, the Citrix Xen Server Linux virtualization has entered the real tem, take a careful look at your needs command bridge, which is known as world, and the choice of tools comes and build a comprehensive solution that Xen Center, has been transformed into down to real-world questions of stability, is easy to manage, monitor, and deploy. a Windows-only application (Figure 2). efficiency, and management. The com- Also, leave yourself room to grow, be- One point worthy of notice is that Xen mercial vendors, with their well-inte- cause you're no longer limited by the now has a live migration feature, Xen- grated, graphical controls, are currently size of your server room. the mathematics of humour

TWELVE Quirky Humans, Over Two Million Geeks around the world can’t be wrong! TWO Lovecraftian Horrors, COME JOIN THE INSANITY! ONE Acerbic A.I., ONE Fluffy Ball of Innocence and TEN Years of Archives EQUALS ONE Daily Cartoon that Covers the Geek Gestalt from zero to infinity!

MAY 2008 ISSUE 90 27

021-027_coverintro.indd 27 12.03.2008 16:40:47 Uhr