DOCSLIB.ORG

Citrix Hypervisor 8.2

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Citrix Hypervisor 8.2 Citrix Hypervisor 8.2 Citrix Product Documentation | docs.citrix.com August 16, 2021 Citrix Hypervisor 8.2 Contents Citrix Hypervisor 8.2 3 新增功能 4 自 XenServer 7.1 以来的新增功能 8 已修复的问题 19 已知问题 21 弃用 25 系统要求 32 配置限制 35 来宾操作系统支持 39 快速入⻔ 42 技术概述 61 技术常⻅问题解答 68 许可 82 安装 89 安装和部署方案 96 从现有版本升级 101 更新您的主机 109 对安装问题进行故障排除 119 从 SAN 环境引导 120 网络引导安装 124 主机分区布局 133 在小型设备上安装 134 XenCenter 当前版本 135 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 2 Citrix Hypervisor 8.2 主机和资源池 135 群集池 150 管理用户 154 基于⻆色的访问控制 161 RBAC ⻆色和权限 161 将 RBAC 与 CLI 结合使用 171 网络连接 176 管理网络连接 189 网络连接故障排除 208 存储 212 存储库格式 216 精简预配的共享 GFS2 块存储 233 管理存储库 240 存储多路径 251 和 IntelliCache 253 存储读缓存 256 PVS 加速器 259 图形概述 266 准备主机以处理图形 270 创建启用了 vGPU 的 VM 279 内存使用率 285 监视和管理您的部署 287 管理虚拟机 307 Windows VM 310 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 3 Citrix Hypervisor 8.2 Linux VM 327 VM 内存 334 迁移 VM 340 导入和导出 VM 343 删除 VM 355 Bromium 安全平台 357 vApp 359 演示版 Linux 虚拟设备 361 虚拟机高级注释 363 为 Linux VM 启用 VNC 372 VM 问题故障排除 384 高可用性 390 灾难恢复和备份 397 启用灾难恢复 399 vApp 402 备份和还原主机和 VM 403 VM 快照 407 处理计算机故障 414 故障排除 417 标准引导补充包 420 Workload Balancing 423 Workload Balancing 入⻔ 425 管理 Workload Balancing 虚拟设备 435 用于 Workload Balancing 的证书 491 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 4 Citrix Hypervisor 8.2 转换 VMware 工作负载 498 命令行接口 511 第三方声明 625 Citrix Hypervisor 开源许可和属性 625 SDK 和 API 630 数据治理 631 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 5 Citrix Hypervisor 8.2 Citrix Hypervisor 8.2 May 18, 2021 Citrix Hypervisor 是一款专为虚拟应用程序和桌面工作负载而优化的高性能虚拟机管理程序，基于 Xen 项目虚拟机管 理程序。 最新版本 Citrix Hypervisor 8.2 是 Citrix Hypervisor 的最新版本，本文档介绍了此最新版本中的功能和配置。 • 要了解有关 Citrix Hypervisor 8.2 中的新增功能，请参阅新增功能。 最新版本的 Citrix Hypervisor 的其他文章列在左侧的目录中。如果您使用移动设备，则可以从⻚面顶部的菜单图标 （三个水平条）访问此目录。 早期版本 有关受支持的早期版本的文档，请参阅： • XenServer 7.1 LTSR • XenServer 7.0 不再受支持的 Citrix Hypervisor 和 XenServer 版本的文档存档在 旧版文档 区域中。 Citrix Hypervisor 的生命周期里程碑中介绍了 Citrix Hypervisor 当前版本和⻓期服务版本的产品生命周期策略。 关于 Citrix Hypervisor Citrix Hypervisor 是 Citrix 推出的完整服务器虚拟化平台。Citrix Hypervisor 软件包中包含了创建和管理在 Xen （接近本机性能的开放源代码半虚拟化虚拟机管理程序）上运行的虚拟 x86 计算机部署所需的所有内容。Citrix Hypervisor 已同时针对 Windows 和 Linux 虚拟服务器进行了优化。 Citrix Hypervisor 直接在服务器硬件上运行而不需要底层操作系统，因而是一种高效且可扩展的系统。Citrix Hypervisor 的工作方式是从物理机中提取元素（例如硬盘驱动器、资源和端口），然后将其分配给物理机上运行的虚拟 机。 虚拟机 (VM) 是指完全由能够运行自己的操作系统和应用程序的软件组成的计算机，就好像是一台物理计算机。VM 的 运行方式与物理机十分相似，并且包含自己的虚拟（基于软件）CPU、RAM、硬盘和 NIC。 Citrix Hypervisor 可用于创建 VM、生成 VM 磁盘快照以及管理 VM 工作负载。有关 Citrix Hypervisor 主要功能的 综合性列表，请访问 https://www.citrix.com/products/citrix-hypervisor。 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 6 Citrix Hypervisor 8.2 XenCenter XenCenter 是 Windows GUI 客户端，在管理多个 Citrix Hypervisor 服务器和资源池以及与之关联的虚拟基础结构 时，可提供丰富的用户体验。有关详细信息，请参阅 XenCenter 文档。 新增功能 May 18, 2021 关于此版本 Citrix Hypervisor 是一款专为虚拟应用程序和桌面工作负载而优化的高性能虚拟机管理程序，基于 Xen 项目虚拟机管 理程序。 Citrix Hypervisor 8.2 是一个⻓期服务版本，旨在最大限度地提高功能集的稳定性。 Citrix Hypervisor 8.2 提供以下版本： • Premium Edition • Standard Edition • Express Edition 有关每个版本中可用的功能的信息，请参阅 Citrix Hypervisor 功能列表。 Citrix Hypervisor 8.2 中的新增功能和改进功能 Citrix Hypervisor 8.2 引入了面向应用程序、桌面和服务器虚拟化用例的增强特性和功能。获得 Citrix Virtual Apps and Desktops 许可的所有客户都可以使用 Citrix Hypervisor 8.2 的所有功能。 增加了配置限制 提高了以下配置限制： • 最大主机 RAM 现在为 6 TB • 现在，每个主机的最大逻辑处理器数量为 448 个 CPU 有关详细信息，请参阅配置限制。 在 XenCenter 中启用和禁用读取缓存 读取缓存功能可提高托管从同一来源克隆的多个 VM 的 NFS、EXT3/EXT4 或 CIF/SMB SR 上的性能。现在可以从 XenCenter 控制台为每个单独的 SR 启用和禁用此功能。在以下情况下，您可能希望禁用读取缓存： © 1999‒2021 Citrix Systems, Inc. All rights reserved. 7 Citrix Hypervisor 8.2 • 您没有基于文件的 SR • 您没有任何克隆的 VM • 您没有足够的内存可分配给 dom0 以获得任何性能优势 有关详细信息，请参阅更改 SR 属性。 更改了来宾操作系统支持 更新了 Citrix Hypervisor 支持的来宾操作系统的集合。有关详细信息，请参阅来宾操作系统支持。 增加的功能 Citrix Hypervisor 现在支持以下额外的来宾操作系统： • SUSE Linux Enterprise Server 12 SP5（64 位） • Ubuntu 20.04（64 位） • Gooroom 2（64 位）- 需要 修补程序 XS82E021 - 适用于 Citrix Hypervisor 8.2 删除的功能 • Windows 7 • Windows Server 2008 SP2 • Windows Server 2008 R2 SP1 安全性增强功能 在 Citrix Hypervisor 服务器上安装 TLS 证书 Citrix Hypervisor 现在可以轻松安装服务器 TLS 证书。 Citrix Hypervisor 服务器附带安装了一个默认 TLS 证书。但是，必须安装新证书，才能使用 HTTPS 保护 Citrix Hypervisor 与 Citrix Virtual Apps and Desktops 之间的通信安全。Citrix Virtual Apps and Desktops 安装必 须信任颁发证书的证书颁发机构。 此功能提供了一种机制，用于更新不需要用户访问 Citrix Hypervisor 服务器文件系统的主机证书。它还验证证书和密 钥文件是否有效且格式正确。 可以使用以下方法之一在 Citrix Hypervisor 服务器上安装 TLS 证书： • XenCenter。有关详细信息，请参阅 XenCenter 文档中的在服务器上安装 TLS 证书。 • xe CLI。有关详细信息，请参阅在服务器上安装 TLS 证书。 • API。有关详细信息，请参阅 管理 API 指南。 此功能还会在服务器 TLS 证书即将过期时提供 XenCenter 警报。有关详细信息，请参阅 XenCenter 文档中的系统警 报。 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 8 Citrix Hypervisor 8.2 强制使用 TLS 1.2 协议 Citrix Hypervisor 现在强制对 Citrix Hypervisor 与外部网络之间的任何 HTTPS 通信使用 TLS 1.2 协议。所有 Citrix Hypervisor 组件在相互通信时都使用 TLS 1.2 协议。 作为此功能的一部分，旧版 SSL 模式和对 TLS 1.0/1.1 协议的支持已删除。在将池升级或更新到 Citrix Hypervisor 8.2 之前，请务必在池中禁用旧版 SSL 模式。如果您有任何依赖于不同协议的自定义脚本或客户端，请更新这些组件以 使用 TLS 1.2。 Citrix VM Tools 的分类 Citrix VM Tools 现在作为两个单独的组件在 Citrix Hypervisor 下载⻚面 上提供： • 适用于 Windows 的 Citrix VM Tools • 适用于 Linux 的 Citrix VM Tools 因此，guest-tools.iso 文件已从 Citrix Hypervisor 安装中删除。 将这些工具作为单独的组件提供，无需修补程序即可将更新应用到 Citrix Hypervisor 服务器上存储的工具 ISO。 有关详细信息，请参阅Linux VM和Windows VM。 Workload Balancing 设备和 Conversion Manager 设备的更新 其中两个附加组件现在都包括以下改进功能： • 平台更新为 CentOS 7.7 • 通过使用 JSON-RPC 与 Citrix Hypervisor 进行通信提高了性能 • OpenSSL 更新到版本 1.1.1 • 为改进安全性和性能更新了其他第三方库 • TLS 1.2 现已强制实施，以确保安全性 安装选项 可以从 Citrix Hypervisor 产品下载⻚面 下载在以下软件包中提供的 Citrix Hypervisor 8.2： • Citrix Hypervisor 8.2 更新 ISO。使用此文件可以将 Citrix Hypervisor 8.2 作为 Citrix Hypervisor 8.1 或 8.0 的更新进行应用。 • Citrix Hypervisor 8.2 基本安装 ISO。使用此文件可创建 Citrix Hypervisor 8.2 的全新安装或从 XenServer 7.1 CU2 或 7.0 进行升级。 重要： • 如 果 使 用 XenCenter 升 级 您 的 主 机， 则 必 须 在 开 始 操 作 之 前 先 将 XenCenter 安 装 更 新 到 Citrix Hypervisor 8.2 下载⻚面上提供的最新版本。 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 9 Citrix Hypervisor 8.2 • 请始终在升级池中的任何其他主机之前升级池主服务器。 • 请务必先将您的 XenServer 7.1 更新到累积更新 2，然后再尝试升级到 Citrix Hypervisor 8.2。 • 不再支持传统 SSL 模式。在尝试升级到 Citrix Hypervisor 的最新版本之前，在池中的所有主机上禁用此 模式。要禁用旧版 SSL 模式，请在开始升级之前在池主服务器上运行以下命令：xe pool-disable- ssl-legacy uuid=<pool_uuid> • 不再支持 vSwitch Controller。在尝试更新或升级到 Citrix Hypervisor 的最新版本之前，请先断开 vSwitch Controller 与池的连接。 1. 在 vSwitch Controller 用户界面中，转到 Visibility & Control（可⻅性和控制）选项卡。 2. 在 All Resource Pools（所有资源池）表中找到要断开连接的池。表中的池使用池主服务器的 IP 地 址列出。 3. 单击⻮轮图标，然后选择删除池。 4. 单击删除进行确认。 更新或升级后，将执行以下配置更改： - 跨服务器专用网络还原为单服务器专用网络。 - 不再应用通过 DVSC 控制台进行的任何服务质量设置。不再强制执行网络速率限制。 - ACL 规则已删除。允许来自 VM 的所有流量。 - 端口镜像 (RSPAN) 已禁用。 更新或升级完成后，如果在池中发现与 vSwitch Controller 有关的任何剩余状态，请使用以下 CLI 命令 清除该状态：xe pool-set-vswitch-controller address= 开始之前的准备工作 在开始安装或从较旧的版本迁移之前，请查看以下文章： • 系统要求 • 已知问题 • 弃用和删除 有关安装、升级或更新过程的信息，请参阅安装 许可 客户必须将其 Citrix 许可证服务器升级到版本 11.16 或更高版本，才能使用 Citrix Hypervisor 8.2 的所有许可功能。 有关 Citrix Hypervisor 8.2 许可的详细信息，请参阅许可。 硬件兼容性 有关最新添加的内容以及针对所有硬件兼容性问题的建议，请参阅 Citrix Hypervisor 硬件兼容性列表。 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 10 Citrix Hypervisor 8.2 如果您的 VM 连接了虚拟 GPU，请确保在升级到最新版本的 Citrix Hypervisor 之前受支持的驱动程序可用。有关详 细信息，请参阅硬件兼容性列表和 GPU 供应商文档。 与 Citrix 产品的互操作性 Citrix Hypervisor 8.2 可与 Citrix Virtual Apps and Desktops 7.15 LTSR、1912 LTSR 和 2006 进行互操作。 Citrix Hypervisor 8.2 可与 Citrix Provisioning 7.15 LTSR、1912 LTSR 和 2006 进行互操作。 Citrix Hypervisor 8.2 能够与 Citrix Cloud 互操作。 有关与其他 Citrix 产品的互操作性的详细信息，请参阅Citrix 升级指南。 本地化支持 此版本中也包含 XenCenter 的本地化版本（简体中文和日语）。在早期版本中，XenCenter 的本地化版本作为单独 的组件提供。在 Citrix Hypervisor 8.2 及更高版本中，所有本地化版本的 XenCenter 都包含在与英文本本相同的 .msi 安装文件中。 产品文档 要访问 Citrix Hypervisor 8.2 产品文档，请参阅 Citrix Hypervisor 8.2 产品文档。 要访问最新的 XenCenter 产品文档，请参阅XenCenter 产品文档。 在此初始版本发行后，本文档可能会有更新或更改。我们建议您订阅 文档历史记录 RSS 源以了解更新。 自 XenServer 7.1 以来的新增功能 May 18, 2021 Citrix Hypervisor 8.2 是 LTSR 版本。如果您使用我们的 LTSR 流，并且正在从 XenServer 7.1 CU2 进行升级，则除 了在 Citrix Hypervisor 8.2 中添加的功能外，您还可以获得在中间的当前版本中添加的所有功能。 本文包含自 XenServer 7.1 CU2 以来添加的所有新增功能的列表。但是，自上一版 LTSR 以来，特性和功能也已删除。 有关已删除和已弃用的功能的详细信息，请参阅弃用和删除。 品牌重塑 自 Citrix Hypervisor 8.0 起，用于描述 Citrix Hypervisor 产品和功能的一些术语发生了变化。有关新名称，请参⻅ 下表。 © 1999‒2021 Citrix Systems, Inc. All rights reserved. 11 Citrix Hypervisor 8.2 之前使用的术语 新术语 XenServer Citrix Hypervisor XenServer PV Tools Citrix VM Tools XenMotion 实时迁移 Storage XenMotion 存储实时迁移 Enterprise Edition Premium Edition Free Edition Express Edition 平台刷新 Citrix Hypervisor 平台已更新，可以使用以下软件： • 内核版本：Linux 4.19 • Xen 虚拟机管理程序版本：4.13 • 控制域操作系统版本：CentOS 7.5 作为内核版本更新的一部分，分配给控制域 (dom0) 的内存量已增加。有关详细信息，请参阅内存使用率。 内核设备驱动程序也已更新到较新的版本。早期版本中支持的某些硬件可能与较新的驱动程序不兼容。请先查看 硬件兼 容性列表，然后再升级到 Citrix Hypervisor 8.2。 此外，随 Citrix Hypervisor 提供的以下设备也已更新，以使用 CentOS 7.5 作为其基本操作系统： • Citrix Hypervisor Conversion Manager 虚拟设备 • Workload Balancing 虚拟设备 • 演示版 Linux 虚拟设备 Workload Balancing 设备和 Conversion Manager 设备的平台刷新 其中两个附加组件现在都包括以下改进功能： • 平台更新为 CentOS 7.7 • 通过使用 JSON-RPC 与 Citrix Hypervisor 进行通信提高了性能 • OpenSSL 更新到版本 1.1.1 • 为改进安全性和性能更新了其他第三方库 • TLS 1.2 现已强制实施，以确保安全性 处理器支持的变化 现在支持以下处理器： © 1999‒2021 Citrix Systems, Inc. All rights reserved. 12 Citrix Hypervisor 8.2 • Xeon 82xx/62xx/52xx/42xx/32xx CascadeLake-SP • AMD EPYC 7xx2(P) • Intel 处理器系列 E-21xxG/21xx (Coffee Lake S) 不再支持以下旧版处理器： • Opteron 13xx Budapest • Opteron 23xx/83xx Barcelona • Opteron 23xx/83xx Shanghai • Opteron 24xx/84xx Istanbul • Opteron 41xx Lisbon • Opteron 61xx Magny-Cours • Xeon 53xx Clovertown • Xeon 54xx Harpertown • Xeon 55xx Nehalem • Xeon 56xx Westmere-EP • Xeon 65xx/75xx Nehalem-EX • Xeon 73xx Tigerton • Xeon 74xx Dunnington • Xeon E3/5/7 系列 - Sandy Bridge • Xeon E3/5/7 v2 系列 - Ivy Bridge 有关详细信息，请参阅 硬件兼容性列表。 更改了来宾支持 Citrix Hypervisor 不再支持以 PV 模式运行的来宾。有关详细信息，请参阅弃用和删除。 有关 Citrix Hypervisor 8.2 中支持的来宾操作系统的完整列表，请参阅来宾操作系统支持。 互操作 适用于 Citrix Virtual Apps and Desktops 服务订阅者的 Citrix Hypervisor 授权 如果您具有允许使用本地 Citrix Virtual Apps and Desktops 的 Citrix Virtual Apps and Desktops 服务云订阅， 则将有权使用 Citrix Hypervisor 托管这些桌面和应用程序。 安装此许可证后，可以使用与使用本地
Load more

Recommended publications
  • Xen Enterprise
    Xen: the Past, Present and Exciting Future Ian Pratt Chairman of Xen.org, SVP and Founder of Bromium Sponsored by: & 1 Outline • Community Update • Xen 4 Review • Xen and the next wave of virtualization 2 COMMUNITY UPDATE 3 2011 Highlights • Inclusion of Xen into Linux 3 (and distros) • New Initiatives: – Project Kronos – Xen.org Governance – Renewed focus on Xen for ARM • Successful Community Initiatives – Documentation Day – Google Summer of Code – Hackathons: Cambridge (Citrix) and Munich (Fujitsu) • Lars Kurth: (not so) new Community Manager 4 Contribution Statistics By Change Sets Contributors to Xen.org 5000.0 200 4500.0 180 4000.0 160 3500.0 140 3000.0 120 XenARM** 2500.0 100 PVOPS Individuals 2000.0 XCP 80 Orgs 1500.0 Xen HV 60 1000.0 40 500.0 20 0.0 0 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011* *) End of Sept 2011 **) Activity on Development branch (not yet in xen-unstable) 5 2010 & 2011 Contributors (by KLOC) 2010** 2011** *** 1% 2% 3% 4% 5% 4% 6% 5% Citrix HV 28% Citrix XCP Citrix XCP 5% Citrix HV Oracle Samsung* 39% 11% Intel Novell 6% Novell Oracle Fujitsu AMD 7% AMD Individual Individual 13% Intel Misc 18% Misc 8% University 20% 15% *) Activity on Development branch (not yet in xen-unstable) **) Includes PVOPS ***) Until Sept 2011 6 Developer mailing list traffic Conversations, excluding patches excluding Conversations, 1000 1500 2000 2500 500 0 Oct-03 Dec-03 Feb-04 Apr-04 Jun-04 Aug-04 Oct-04 Dec-04 Feb-05 Apr-05 Jun-05 Aug-05 Oct-05 Dec-05 Feb-06 Apr-06 Jun-06 Aug-06 Oct-06 Dec-06 xen-devel Feb-07 Apr-07 Jun-07 Aug-07
    [Show full text]
  • Bromium Advanced Endpoint Security Protect | Detect | Respond
    Data Sheet Bromium Advanced Endpoint Security Protect | Detect | Respond At a Glance Today’s enterprises are fighting a losing battle against advanced, Bromium Advanced Endpoint Security targeted and often undetectable cyber attacks. In spite of the uses micro-virtualization and contextual, increased spend on more and more layered security solutions, real-time detection to protect across all major threat vectors and attack types. organizations are not making headway against attackers. Enterprises Enterprises can finally defeat cyber attacks and eliminate endpoint breaches. are getting breached, users’ productivity is hampered by side effects of security solutions, and IT is stuck on a treadmill of never-ending Key Business Benefits patching and remediation. PROTECT AGAINST ZERO-DAY ATTACKS Revolutionary micro-virtualization technology prevents known and Bromium® Advanced Endpoint Security next-generation endpoint protection unknown cyber attacks from offers a better way to defeat cyber that integrates endpoint threat isolation, compromising endpoints and your attacks that target the endpoint, where threat analytics and continuous host corporate network more than 70% of breaches originate. monitoring to enable organizations TRUE PREVENTION WITHOUT The first to deliver an endpoint security to protect, detect and respond to USER DISRUPTION Users can safely click on anything from solution based on virtualization, targeted attacks, zero-day threats and home, branch offices, airports and cafes— Bromium offers comprehensive attempted breaches in real time. without the need for restrictive policies DETECT ATTEMPTED BREACHES Behavioral detection techniques alert and monitor suspicious activity on the host system ELIMINATE REMEDIATION AND EMERGENCY PATCHING COSTS Bromium-protected endpoints are self-remediating because any possibility of malware persistence is eliminated.
    [Show full text]
  • Improving Desktop System Security Using Compartmentalization
    Improving Desktop System Security Using Compartmentalization by Mohsen Zohrevandi A Dissertation Presented in Partial Fulfillment of the Requirements for the Degree Doctor of Philosophy Approved April 2018 by the Graduate Supervisory Committee: Rida Bazzi, Chair Gail-Joon Ahn Adam Doupé Ming Zhao ARIZONA STATE UNIVERSITY August 2018 ABSTRACT Compartmentalizing access to content, be it websites accessed in a browser or docu- ments and applications accessed outside the browser, is an established method for protect- ing information integrity [12, 19, 21, 60]. Compartmentalization solutions change the user experience, introduce performance overhead and provide varying degrees of security. Strik- ing a balance between usability and security is not an easy task. If the usability aspects are neglected or sacrificed in favor of more security, the resulting solution would have a hard time being adopted by end-users. The usability is affected by factors including (1) the gen- erality of the solution in supporting various applications, (2) the type of changes required, (3) the performance overhead introduced by the solution, and (4) how much the user expe- rience is preserved. The security is affected by factors including (1) the attack surface of the compartmentalization mechanism, and (2) the security decisions offloaded to the user. This dissertation evaluates existing solutions based on the above factors and presents two novel compartmentalization solutions that are arguably more practical than their existing counterparts. The first solution, called FlexICon, is an attractive alternative in the design space of compartmentalization solutions on the desktop. FlexICon allows for the creation of a large number of containers with small memory footprint and low disk overhead.
    [Show full text]
  • Securing the Path to Windows 10 How to Achieve the Benefits of Virtualization-Based Security Without a Hardware Refresh White Paper
    White Paper Securing the Path to Windows 10 How to Achieve the Benefits of Virtualization-based Security Without a Hardware Refresh White Paper Introduction “Bromium, a Microsoft partner, For enterprises the #1 reason to upgrade to Windows 10 is delivers hardware-enforced improved security, but the critical enhancements that rely on security to today’s deployed Windows endpoints. More hardware protection will be difficult to adopt until you buy importantly, Bromium enables new PCs. Bromium, a Microsoft partner, delivers hardware- IT organizations to easily upgrade existing PCs to Windows 10 with enforced security to today’s deployed Windows endpoints. More hardware-enforced security importantly, Bromium enables IT organizations to easily upgrade that extends the in-box security existing PCs to Windows 10 with hardware-enforced security that of Windows 10, without a hardware refresh, accelerating extends the in-box security of Windows 10, without a hardware Windows 10 rollouts.” refresh, accelerating Windows 10 rollouts. Windows 10 Security Windows 10 Enterprise promises many security enhancements over Windows 7 and 8, and introduces a family of hardware-assisted security technologies in Device Guard (DG). DG helps to ensure a secure boot, whitelists kernel code and offers credential protection and biometric authentication. The most important Figure 1: Windows 10 Device Guard SECURING THE PATH TO WINDOWS 10 2 White Paper “VBS uses endpoint CPU feature is virtualization-based security (VBS) which uses Hyper-V, enhanced with virtualization to isolate and elements of micro-virtualization, to help protect the operating system using protect two critical Windows hardware virtualization. The Bromium / Microsoft partnership aims to accelerate services: Windows Code Integrity service which protects the kernel the roadmap for VBS.
    [Show full text]
  • Weekly Internet / Digital Media / Saas Sector Summary
    Weekly Internet / Digital Media / SaaS Sector Summary Week of October 28th, 2013 Industry Stock Market Valuation Internet / Digital Media / SaaS Last 12 Months Last 3 Months 170 130 58% 55% 160 53% 125 46% 22% 150 43% 21% 120 43% 13% 43% 140 11% 40% 115 9% 32% 130 8% 8% 110 7% 120 7% 105 110 100 100 95 90 80 90 10/25/12 01/24/13 04/25/13 07/25/13 10/25/13 07/25/13 08/16/13 09/09/13 10/02/13 10/25/13 (1) (2) (3) (4) NASDAQ Search / Online Advertising Internet Commerce Internet Content Publishers (5) (6) (7) (8) Diversified Marketing Media Conglomerates Gaming SaaS Notes: 1) Search/Online Advertising Composite includes: BCOR, BLNX-GB, GOOG, FUEL, MCHX, MM, MRIN, MSFT, QNST, RLOC, TRMR, VCLK, VELT, YHOO, YNDX, YUME. 2) Internet Commerce Composite includes: AMZN, AWAY, CPRT, DRIV, EBAY, EXPE, FLWS, LINTA, NFLX, NILE, OPEN, OSTK, PCLN, PRSS, SSTK, STMP, TZOO, VPRT. 3) Internet Content Composite includes: AOL, DHX, DMD, EHTH, IACI, MOVE, MWW, RATE, RENN, RNWK, SCOR, SFLY, TRLA, TST, TTGT, UNTD, WBMD, WWWW, XOXO, Z. 4) Publishers Composite includes: GCI, MMB-FR, NWSA, NYT, PSON-GB, SSP, TRI, UBM-GB, WPO. 5) Diversified Marketing Composite includes: ACXM, EFX, EXPN-GB, HAV-FR, HHS, IPG, MDCA, NLSN, VCI, WPP-GB. 6) Media Conglomerates Composite includes: CBS, CMCSA, DIS, DISCA, LGF, SNE, TWX, VIA.B. 1 7) Gaming Composite includes: 035420-KR, 036570-KR, 2432-JP, 3632-JP, 3765-JP, 700-HK, ATVI, CYOU, EA, GA, GAME, GLUU, NTES, PWRD, UBI-FR, ZNGA.
    [Show full text]
  • It's That Time
    December 2014 / January 2015 | Vol. 8 No. 1 VirtualizationReview.com 2015 READERS CHOICE AWARDS WINNER IT’S THAT TIME OFYEAR! Eggnog, presents and the products you like best. PLUS > VIRTUAL PREDICTIONS > DELL’S VDI STRATEGY > UNTANGLING VMWARE DRS VISIT VIRTUALIZATIONREVIEW.COM contents The objective is helping organizations accomplish their 6 goals; not to push any specifi c type of technology. By Dan Kusnetzky 2015Readers Choice Awards “Chromebook desktop ÌÌÌÌ Winner ÌÌÌÌ access looks especially promising, especially in the education market.” Garret Grajek, dinCloud 18 6 December 2014 / January 2015 | VIRTUALIZATION REVIEW | VOL. 7, NO. 2 FEATURES 11 Best Cloud Storage Product 15 Best Network 4 The 2015 Reader’s Choice 12 Best Cloud Security Product Virtualization Product Awards and Buyer’s Guide 12 Best Cloud Software Product 16 Best Virtualization Security Product You, the readers, have spoken. 13 Best Business Continuity Product Here are the virtualization and Best Converged 14 Best Virtualization 17 cloud computing products that Automation Product Infrastructure Product rock your world. Best Virtualization Training 15 Best Storage 17 6 Best Application Virtualization Product Virtualization Product 6 Best Server Virtualization Product Best Desktop Virtualization/ 7 18 2015 Virtualization Predictions COLUMNS Virtual Desktop Infrastructure Product What can you expect to happen 2 Editor’s Note: KEITH WARD in the virtualization and cloud 3 Expectations for 2015 8 Best Mobile Virtualization/ BYOD Product industries in the coming year?
    [Show full text]
  • Hardware-Assisted Security for High-Value Information
    SOLUTION BRIEF Application Code Security Intel® Software Guard Extensions Hardware-Assisted Security for High-Value Information Numecent, Bromium, and wolfSSL employ Intel® Software Guard Extensions (Intel® SGX) to create more secure, next-generation solutions Developers have long been constrained by the security capabilities that major platform providers have exposed for application development. These same capabilities are also well known to hackers, who have exploited weaknesses to steal sensitive data and credentials, or hijack code for attacks. Until now, developers have been forced to rely on the provider’s security architecture, with no way to apply a security model designed to fit their own requirements after a platform release has shipped. Recognizing the need for a new model that protects selected code and data from disclosure or modification, Intel designed Intel® Software Guard Extensions (Intel® SGX), a hardware-assisted trusted execution environment with the smallest possible attack surface. With Intel SGX, developers can partition their application into CPU-hardened “enclaves,” or protected areas of execution, that increase security even on compromised platforms. Using this new application-layer trusted execution environment allows developers to enable identity and records privacy, secure browsing, DRM, harden end point protection, or any high assurance security use case that needs to safely store secrets or protect data. Intel SGX is an Intel® technology for application developers who are seeking to protect select code and data from disclosure or modification. Intel SGX makes such protections possible through the use of enclaves. Application code can be put into an enclave by special instructions and software made available to developers via the Intel SGX SDK.
    [Show full text]
  • Piper Jaffray Cybersecurity Earnings Update
    Piper Jaffray Cybersecurity Earnings Update Third Quarter 2017 Marc Steifman Greg Klancher Co-Head of Technology Principal Investment Banking Piper Jaffray & Co. Piper Jaffray & Co. MINNEAPOLIS | BOSTON | CHICAGO | HOUSTON | LONDON | LOS ANGELES | NEW YORK | SAN FRANCISCO | ZÜRICH Piper Jaffray Companies (NYSE: PJC) is an investment bank and asset management firm headquartered in Minneapolis with offices across the U.S. and in London, Zurich and Hong Kong. Securities brokerage and investment banking services are offered in the United States through Piper Jaffray & Co., member NYSE and SIPC, in Europe through Piper Jaffray Ltd., authorized and regulated by the Financial Conduct Authority, and in Hong Kong through Piper Jaffray Hong Kong, authorized and regulated by the Securities and Futures Commission. Asset management products and services are offered through three separate investment advisory affiliates registered with the U.S. Securities and Exchange Commission: Advisory Research Inc., Piper Jaffray Investment Management LLC and PJC Capital Partners LLC. Piper Jaffray & Co., Member SIPC and FINRA 11/17 Piper Jaffray Case Study: Vista Equity Partners acquires majority stake in Jamf Vista Equity Partners: Undisclosed . Vista Equity Partners is a U.S.-based investment firm with more than $30 billion in cumulative capital commitments, currently invests in software, data and technology-enabled organizations. The firm invests in middle market management and leveraged buyouts, growth and acquisition Has purchased a majority financing, recapitalizations, private transactions, spin-outs and corporate divestitures. stake in . The firm was founded in 2000 and is headquartered in Austin, Texas. Jamf: . Jamf focuses on helping businesses, education and government organizations succeed with November 2017 Apple through its Jamf Pro and Jamf Now solutions.
    [Show full text]
  • Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks
    Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks Stefano Cristalli and Mattia Pagnozzi, University of Milan; Mariano Graziano, Cisco Systems Inc.; Andrea Lanzi, University of Milan; Davide Balzarotti, Eurecom https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/stefano This paper is included in the Proceedings of the 25th USENIX Security Symposium August 10–12, 2016 • Austin, TX ISBN 978-1-931971-32-4 Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks Stefano Cristalli Mattia Pagnozzi Mariano Graziano Universita` degli Studi di Milano Universita` degli studi di Milano Cisco Systems Inc. Andrea Lanzi Davide Balzarotti Universita’ degli Studi di Milano Eurecom Abstract ception Handling Overwrite Protection (SEHOP) [29], Spraying is a common payload delivery techniue and Control Flow Integrity [3]—just to name some of used by attackers to execute arbitrary code in presence the most popular solutions. Even though the combina- of Address Space Layout Randomisation (ASLR). In tion of all these techniues have certainly increased the this paper we present Graffiti, an efficient hypervisor- security of modern operating systems, no matter how based memory analysis framework for the detection and high the bar was set, attackers have always found a way prevention of spraying attacks. Compared with previ- to overcome it to take control of a vulnerable system. ous solutions, our system is the first to offer an effi- ASLR is certainly one of the most common and suc- cient, complete, extensible, and OS independent protec- cessful techniues adopted by modern operating sys- tion against all spraying techniues known to date.
    [Show full text]
  • Master Arbeit
    Hochschule Wismar Fakultät für Ingenieurwissenschaften WINGS Studiengang IT Sicherheit und Forensik Master-Thesis Capabilities of Live/Memory-Forensics on Compartmentalized Systems Using Bromium, Qubes and Proxmox as Examples Eingereicht am: 31. August 2019 von: Ute Schüller Matrikelnummer: XXXXXX Erstgutachter: Prof. Dr.-Ing. A. Raab-Düsterhöft Zweitgutachter: Prof. Dr.-Ing. A. Ahrens Scope of Work Scope of Work With the constantly increasing digitalization of daily life, there is also a rising number of attacks, against private as well as company computers. One of the options to reduce those risks, is the usage of operating systems or software, that provide compartments (aka. sandboxes or containers), when working on a network-connected computer. Despite the reduced risks, sometimes the need for live/memory-forensics arises on those systems, as well. How to perform such an analysis, is well-documented for e.g. VMware; nevertheless, for Bromium, Qubes and Proxmox, there is not much literature available. Consequently, the aim of this master thesis is to investigate the available options for those 3 operating systems. On one Hand, this includes examining the systems for already present IT-forensic capabilities, and, on the other hand, investigating additional possibilities to collect live/memory forensic data, that can be gathered, using freely available software like Rekall or Proxmox. Additionally, commercial software (Axiom, EnCase, X-Ways and Nuix) should be looked at, to find out, which possibilities are available, within those programs. Finally, if possible, a half-automated data collection on Qubes should be implemented, for later IT-forensic investigation. In GERMAN: Titel: Möglichkeiten der Live/Memory-Forensik auf kompartimentierten Systeme am Beispiel von Bromium, Qubes und Proxmox Aufgabenstellung Mit der stetig wachsenden Digitalisierung des täglichen Lebens, wächst auch die Anzahl der Angriffe auf private, wie auch auf Firmen-Computer.
    [Show full text]
  • Xenserver 7.3 Release Notes December 2017
    XenServer 7.3 Release Notes December 2017 XenServer 7.3 Release Notes Welcome to XenServer 7.3. This document provides important information about the XenServer 7.3 release. XenServer 7.3 is a Current Release (CR). The Current Release model allows customers to consume new features at the earliest possible juncture. This contrasts with the Long Term Service Release (XenServer 7.1 LTSR), which guarantees stability in terms of the feature set within XenServer. XenServer 7.3 is available in two commercial editions: • Standard Edition • Enterprise Edition Note: If you use XenServer in an unlicensed1 state, there are new restrictions on the set of features that are available to you. Before moving to XenServer 7.3, ensure that you review the information in the Licensing section to see which features now require a license. XenServer 7.3 is available to download from the XenServer Product Download page. New Features and Improvements in XenServer 7.3 XenServer 7.3 introduces enhanced features and functionality for application, desktop, and server virtualization use cases. All XenServer 7.3 features are available to all licensed XenApp/XenDesktop customers. Citrix Director Integration You can now use Citrix Director version 7.16 and later to access consoles of Server and Desktop OS machines hosted on XenServer. This way, XenApp and XenDesktop users don’t require XenCenter to troubleshoot issues on XenServer-hosted VDAs. For more information, see the Director documentation: • https://docs.citrix.com/en-us/xenapp-and-xendesktop/current- release/director/troubleshoot-machines.html#machine_console Bromium Enhanced Security Enterprise Edition You can now use Bromium Secure Platform on Windows VMs running on XenServer.
    [Show full text]
  • Disaggregated System Services Through Lightweight Capability Domains
    Disaggregated System Services Through Lightweight Capability Domains John Regehr, Associate Professor School of Computing, University of Utah 50 S. Central Campus Dr., Room 3190 Salt Lake City, UT 84112 [email protected] +1 801 581 4280 Contacts: Ben Laurie, Mark Miller Abstract For several decades the operating system community has accepted that the only way of minimizing the trusted com- puting base, and constructing more secure, least authority systems, is to reimplement monolithic kernel functionality as a set of isolated microkernel servers. Our work aims to explore a less invasive means of constructing fine-grained, least authority environments. Instead of splitting the core functionality of a traditional operating system into multiple servers, we will develop a mechanism that can securely isolate individual kernel components right inside the address space of the monolithic operating system kernel. The traditional OS boots normally, supporting discovery, configura- tion, and initialization. However, after the system is initialized, the kernel will transfer execution of some subsystems into isolated protection domains. To implement protection domains, we propose to extend a hypervisor with support for lightweight protection domains and a capability access control model. Although these protection domains will run inside the guest OS’s kernel address space, they will be fully protected by the hypervisor, which also provides a mediated capability interface. Effectively, we will execute a traditional operating system on a capability machine, which we implement in the hypervisor rather than on specialized hardware. In contrast to the traditional microkenelization, our isolated service implementations will not require major modifications to their code. Our goal is to develop a small set of interfaces, communication, and synchronization mechanisms that can run the common kernel subsystems in both monolithic and disaggregated configurations.
    [Show full text]