Novell LINUX ENTERPRISE 11 SP1 - LINUX AUDIT Manual Download Page 11

Page: 11 / 140

Part I. Getting Started with Xen

Summary of Contents for LINUX ENTERPRISE 11 SP1 - LINUX AUDIT

Page 1: ...SUSE Linux Enterprise Desktop www novell com 11 SP1 August 18 2010 Virtualization with Xen ...

Page 2: ...buted copies That this manual specifically for the printed format is reproduced and or distributed for noncommercial use only The express authorization of Novell Inc must be obtained prior to any other use of any manual or part thereof For Novell trademarks see the Novell Trademark and Service Mark list http www novell com company legal trademarks tmlist html Linux is a registered trademark of Lin...

Page 3: ...Suggestions 10 2 2 Managing Domain0 Memory 11 2 3 Network Card in Fully Virtualized Guests 12 2 4 Starting the Virtual Machine Host 14 2 5 PCI Pass Through 15 3 Setting Up Virtual Machines 19 3 1 Creating a Virtual Machine 20 3 2 Installing an Operating System 21 3 3 Including Add On Products in the Installation 25 3 4 Using the Command Line to Create Virtual Machines 26 3 5 Deleting Virtual Machi...

Page 4: ... Bridges 46 6 2 Network Devices for Guest Systems 47 6 3 Host Based Routing in Xen 48 6 4 Creating a Masqueraded Network Setup 51 6 5 Special Configurations 53 7 Block Devices in Xen 59 7 1 Mapping Physical Storage to Virtual Disks 59 7 2 File Backed Virtual Disks and Loopback Devices 61 7 3 Resizing Block Devices 62 8 Virtualization Configuration Options and Settings 63 8 1 Virtual CD Readers 63 ...

Page 5: ...chines 91 10 2 Restoring Virtual Machines 92 10 3 Virtual Machine States 93 11 Xen as High Availability Virtualization Host 95 11 1 Xen HA with Remote Storage 95 11 2 Xen HA with Local Storage 96 11 3 Xen HA and Private Bridges 97 12 SUSE Linux Virtual Machines 99 12 1 Using the Add On Products Program 100 12 2 Virtual Machine Clock Settings 100 12 3 Updating a Network Installation Source 102 13 V...

Page 6: ......

Page 7: ...tallation or configuration make reliable security updates available and support development projects Documentation regarding the Open Enterprise Server 2 is found at http www novell com documentation oes2 index html 1 Available Documentation We provide HTML and PDF versions of our books in different languages The following manuals for users and administrators are available on this product KDE User...

Page 8: ...e of the product inherent security software like Novell AppArmor which lets you specify per program which files the program may read write and execute or the auditing system that reliably collects informa tion about any security relevant events System Analysis and Tuning Guide System Analysis and Tuning Guide An administrator s guide for problem detection resolution and optimization Find how to in...

Page 9: ... audit rules generating reports and analyzing the log files Novell AppArmor Quick Start Helps you understand the main concepts behind Novell AppArmor Find HTML versions of most product manuals in your installed system under usr share doc manual or in the help centers of your desktop Find the latest documen tation updates at http www novell com documentation where you can download PDF or HTML versi...

Page 10: ... Conventions The following typographical conventions are used in this manual etc passwd directory names and filenames placeholder replace placeholder with the actual value PATH the environment variable PATH ls help commands options and parameters user users or groups Alt Alt F1 a key to press or a key combination keys are shown in uppercase as on a keyboard File File Save As menu items buttons Dan...

Page 11: ...Part I Getting Started with Xen ...

Page 12: ......

Page 13: ...r the Domain0 any number of other VM Guests and the tools commands and configu ration files that let you manage virtualization Collectively the physical computer run ning all these components is referred to as a VM Host Server because together these components form a platform for hosting virtual machines The Xen Hypervisor The Xen hypervisor sometimes referred to generically as a virtual machine m...

Page 14: ...It provides the ability to host operating systems in full virtualization mode Xen Based Virtual Machines A Xen based virtual machine also referred to as a VM Guest or DomU consists of the following components At least one virtual disk that contains a bootable operating system The virtual disk can be based on a file partition volume or other type of block device Virtual machine configuration inform...

Page 15: ...P and Windows Server 2003 For more information see Chapter 13 Virtual Machine Drivers page 105 Paravirtual mode does not require the host computer to support hardware assisted virtualization technology but does require the guest operating system to be modified for the virtualization environment Typically operating systems running in paravir tual mode enjoy better performance than those requiring f...

Page 16: ...03 or Windows XP 1 4 The Virtual Machine Host After you install the virtualization components and reboot the computer the GRUB boot loader menu displays a Xen menu option Selecting the Xen menu option loads the Xen hypervisor and starts the Domain0 running the SUSE Linux operating system Running on Domain0 the SUSE Linux operating system displays the installed text console or desktop environment s...

Page 17: ...Figure 1 2 Desktop Showing Virtual Machine Manager and Virtual Machines Introduction to Xen Virtualization 7 ...

Page 18: ......

Page 19: ... all planned VM Guest systems TIP Remember that VM Guest systems just like physical machines perform better when they run on faster processors and have access to more system memory The following table lists the minimum hardware requirements for running a typical virtualized environment Additional requirements have to be added for the number and type of the respective guest systems Table 2 1 Hardwa...

Page 20: ...ost requires a number of software packages and their dependencies to be installed To install all necessary packages run YaST Software Management select View Patterns and choose Xen Virtual Machine Host Server for installation The in stallation can also be performed with YaST using the module Virtualization Install Hypervisor and Tools After the Xen software is installed restart the computer Update...

Page 21: ...CFS2 to host Xen images the latency required for OCFS2 default timeouts in SP2 may not be met To reconfigure this timeout run etc init d o2cb configure or edit O2CB_HEARTBEAT_THRESHOLD in the system configuration 2 2 Managing Domain0 Memory When the host is set up a percentage of system memory is reserved for the hypervisor and all remaining memory is automatically allocated to Domain0 A better so...

Page 22: ... For more informa tion see Section 5 2 Controlling the Host by Modifying Xend Settings page 36 2 3 Network Card in Fully Virtualized Guests In a fully virtualized guest the default network card is an emulated Realtek network card However it also possible to use the split network driver to run the communication between Domain0 and a VM Guest By default both interfaces are presented to the VM Guest ...

Page 23: ... network inter face device vif bridge br0 mac 00 16 3e 50 66 a4 script etc xen scripts vif bridge uuid 0a94b603 8b90 3ba8 bd1a ac940c326514 backend 0 emulated and paravirtualized If the administrator should be offered both options simply specify both type and model The Xend configuration would look like device vif bridge br0 uuid e2b8f872 88c7 0a4a b965 82f7d5bdd31e devid 0 mac 00 16 3e 54 79 a6 m...

Page 24: ...rify that the GRUB boot loader has been updated If the installation has been done without selecting the Xen pattern run the YaST Software Management select the filter Patterns and choose Xen Virtual Machine Host Server for installation After booting the hypervisor the Domain0 virtual machine starts and displays its graphical desktop environment If you did not install a graphical desktop the comman...

Page 25: ... systems it is sometimes necessary to assign spe cific PCI devices to a dedicated domain When using fully virtualized guests this functionality is only available if the chipset of the system supports this feature and if it is activated from the BIOS This feature is available from both AMD and Intel For AMD machines the feature is called IOMMU in Intel speak this is VT d Note that Intel VT technolo...

Page 26: ...t Corporation DECchip 21142 43 rev 41 In this case the PCI number is 06 01 0 2 Run YaST System Boot Loader 3 Select the Xen section and press Edit 4 Add the PCI number to the Optional Kernel Command Line Parameter line pciback hide 06 01 0 5 When preparing for fully virtualized guests add the parameter iommu 1 to Additional Xen Hypervisor Parameters 6 Press OK and finish YaST 7 Reboot the system 8...

Page 27: ...se device pci dev slot 0x01 domain 0x0 bus 0x06 vslt 0x0 func 0x0 For more information about modifying the Xend database see Section 5 3 Con figuring a Virtual Machine by Modifying its Xend Settings page 37 After assigning the PCI device to the VM Guest the guest system must care for the configuration and device drivers for this device 2 5 3 For More Information There are several resources that pr...

Page 28: ...t e c h n o l o g y f o r d i r e c t e d i o v t d e n h a n c i n g i n t e l p l a t f o r m s f o r e f f i c i e n t v i r t u a l i z a t i o n o f i o d e v i c e s http www amd com us en assets content_type white_papers _and_tech_docs 34434 pdf 18 Virtualization with Xen ...

Page 29: ...rtualization mode and requires specific device drivers to be loaded The hardware that is presented to the VM Guest depends on the configuration of the Xend You should be aware of any licensing issues related to running a single licensed copy of an operating system on multiple virtual machines Consult the operating system license agreement for more information NOTE Virtual Machine Architectures The...

Page 30: ... the respective operating system to in stall The Create Virtual Machine Wizard YaST Virtualization Create Virtual Machines helps you through the steps required to create a virtual machine and install its operating system The information that follows is generalized for installing any operating system The actual configuration file for the Xen guests that is used for the installation is stored at etc...

Page 31: ... run an installation program or choose a disk or disk image that already has an installed and bootable operating system Figure 3 1 Installing an Operating System If you choose to run an installation program you are presented with a list of operating systems Select the one you want to install The Summary page shows you a summary of the virtual machine you are creating You can click on any of the he...

Page 32: ...talling an operating system that is modified for virtualization you can create a virtual machine that runs in paravirtual mode For more information about virtualization modes see Section 1 2 Understanding Virtualization Modes page 5 2 Each virtual machine must have a unique name The name entered on this page is used to create and name the virtual machine s configuration file The configu ration fil...

Page 33: ...or equal to the number of physical processors 4 Select the graphics mode to use No Graphics Support The virtual machine operates like a server without a monitor You can access the operating system through operating system supported services such as SSH or VNC Paravirtualized Graphics Adapter Requires that an appropriate graphics driver is installed in the operating system 5 A virtual machine must ...

Page 34: ...more details see Section 8 1 1 Virtual CD Readers on Paravirtual Machines page 63 Note that each CD Rom drive or ISO image can only be used by one VM Guest at the same time When installing many VM Guest systems it may be better to use a network installation source 7 By default a single virtual network card is created for the virtual machine It has a randomly generated MAC address that you can chan...

Page 35: ...e installation screens with no interaction You can also pass instructions to the kernel at install time by entering parameters for the Additional Arguments field These arguments may either be kernel options or options for linuxrc More information about linuxrc can be found in the Deployment Guide If all the information on the Summary screen is correct click OK to create the virtual machine A Virt ...

Page 36: ...l in environments without a graphical user interface This command defaults to using a graphical user interface if available and if no options were given on the command line For information on scripting a virtual machine installation see the man pages of vm install and vm install jobs 3 5 Deleting Virtual Machines When you use Virtual Machine Manager or the xm command to delete a virtual machine it...

Page 37: ...ne that tells the system about its root file system If your VM Guest used to live on dev hda2 append the string root dev xvda2 to the kernel command line This option should enable you to boot the system although additional file systems still will not be available to the system To make all the needed file systems available to the VM Guest do the following In order to have a valid initial RAM disk t...

Page 38: ...s If the requests for memory exceed the size of the buffer it usually results in a hung boot process To check if this is the case switch to console 10 and check the output there for a message similar to kernel PCI DMA Out of SW IOMMU space for 32768 bytes at device 000 01 02 0 In this case you need to increase the size of the swiotlb Enter swiotlb 128 on the Domain0 command line Note that the numb...

Page 39: ...ftware that is more recent than the software planned for the virtual machine update 2 Shut down the virtual machine you want to update 3 Prepare the virtual machine s operating system environment for the update by completing any prerequisite tasks It is recommended to make a copy of the entire virtual disk 4 View or print the virtual machine s configuration found with xm list l vm_name 5 Use the V...

Page 40: ...lowing the instructions on the screen After the installation program is completed the virtual machine should run SLE 11 and be registered with Xend 13 Log in to the SLE 11 virtual machine 14 If you want the SLE 11 virtual machine to run in GUI mode complete the following from its command line 14a Enter init 3 14b Enter sax2 to configure the GUI environment 14c Enter init 5 to restart the GUI 4 1 B...

Page 41: ...Part II Advanced Configurations ...

Page 42: ......

Page 43: ...iles are methods you can choose from to manage your virtualization environment Virtual Machine Manager is a graphical utility available in YaST that can be launched from the virtual machine Domain0 Figure 5 1 Desktop Showing Virtual Machine Manager and Virtual Machines Managing a Virtualization Environment 33 ...

Page 44: ...ility can be run either locally on the VM Host Server or remote The connection is then secured either with an SSL TLS with x509 certificate or with a tunnel over SSH NOTE Close Virtual Machine Manager if you are not actively using it and restart it when needed Closing Virtual Machine Manager does not affect the state of virtual machines Figure 5 2 Virtual Machine Manager Main Console When starting...

Page 45: ... the password of the root user of the controlling Domain0 This is not necessary when using SSH keys and configuring the local user as authorized for root access on the controlling Domain0 When connected to a controlling Domain0 the Virtual Machine Manager offers several configuration possibilities Selec a virtual machine and click Open to display the virtual machine window showing the virtual mach...

Page 46: ...me on a migration host To specify Xend operating parameters edit the etc xen xend config sxp file The settings take effect the next time Xend starts sh Xend configuration file This example configuration is appropriate for an installation that utilizes a bridged network configuration Access to Xend via http is disabled Commented out entries show the default for that entry unless otherwise specified...

Page 47: ...requires you to export a virtual machine s settings from the Xend database to a text file edit the settings in the file to meet your configuration requirements import the file back into Xend and restart the virtual machine Some commonly used configurations can be done online with the xm command These include the attachment or detachment of virtual block network or PCI devices For more details see ...

Page 48: ...35 841108115 online_vcpus 2 3 Delete the existing configuration from Xend with the command xm del vm_name 4 Enter xm new F filename to import the virtual machine s new settings into Xend 5 Enter xm start vm_name to start the virtual machine with its new settings You should repeat the entire process of exporting the file each time you want to make changes to a virtual machine s settings 5 4 The xm ...

Page 49: ...se there is nothing to do For more details about the state flags see man 1 xm The syntax of the xm command usually follows the format xm subcommand domain id OPTIONS where subcommand is the xm command to run domain id is the ID number assigned to a domain or the name of the virtual machine and OPTIONS indicates subcommand specific options Other useful xm commands include xm start starts a virtual ...

Page 50: ...nd_start to the desired value For more details see the section called on_xend_start page 129 Example on_xend_start start When shutting down Xend Xend can tell the VM Guest system to shut down However it does not to check if the guest was stopped when doing a system shutdown of Domain0 Thus it is not recommended to rely on this feature Example on_xend_stop shutdown When rebooting the VM Guest Xend ...

Page 51: ... the used CPU see cat proc cpuinfo All resources that are used by a specific guest system must be available on all in volved VM Host Server systems This means the network bridges must be in the same subnet and all used block devices must exist on both VM Host Server systems Using special features like PCI Pass Through may be problematic Do not implement these when deploying for an environment that...

Page 52: ...CSI see http www novell com documentation sles11 stor_admin data cha_inst_system _iscsi html NFS is a widely used root file system that can easily be accessed from different locations DRBD can be used if only two VM Host Server systems are involved This gives some extra data security because the used data is mirrored over the network For more information see http www novell com documentation sles1...

Page 53: ...ption live must be set to migrate a system that is currently running The speed of the migration depends on how fast the memory print can be saved to disk sent to the new VM Host Server and loaded there This means that small VM Guest systems can be migrated faster than big systems with a lot of memory Managing a Virtualization Environment 43 ...

Page 54: ......

Page 55: ...tion and customize it to the local needs If desired Xen VM Host Server can be installed after performing a default Physical Server installation using the Install Hypervisor and Tools module in YaST This module will prepare the system for hosting virtual machines including invocation of the default bridge networking proposal In case the necessary packages for a Xen VM Host Server are installed manu...

Page 56: ...ridge that is connected to some DHCP server If you intend to create a virtual bridge that has no connection to a real Ethernet device use Statically assigned IP Address In this case it is a good idea to use addresses from the private IP address ranges for example 192 168 x x or 10 x x x To create a bridge that should only serve as a connection between the different guests without connection to the...

Page 57: ...NE2000 ISA Intel e100 PCI Intel e1000 PCI All the network interfaces are just software interfaces Because every network interface must have a unique MAC address an address range has been assigned to Xensource that can be used by these interfaces TIP Virtual Network Interfaces and MAC Addresses The default configuration of MAC addresses in virtualized environments just creates a random MAC address ...

Page 58: ...d eth1 respectively There is one VM Guest running with the id 2 that has two Ethernet devices available eth0 on the VM Guest is bridged with eth1 on the VM Host Server and eth1 on the VM Guest is connected to eth0 on the VM Host Server At this time the third bridge with name br2 is not connected to any VM Guest nor real Ethernet device 6 3 Host Based Routing in Xen Xen can be set up to use host ba...

Page 59: ...nfig network ifcfg alice 0 with the following content NAME Xen guest alice BOOTPROTO static STARTMODE hotplug 2b Edit the file etc sysconfig SuSEfirewall2 and add the following configurations Add alice 0 to the devices in FW_DEV_EXT FW_DEV_EXT br0 alice 0 Switch on the routing in the firewall FW_ROUTE yes Tell the firewall which address should be forwarded FW_FORWARD 192 168 1 21 32 0 0 Finally re...

Page 60: ... Virtual Machine by Modifying its Xend Settings page 37 3b Remove the entry bridge br0 3c Add the following line to the configuration vifname alice 0 3d Change the script that is used to set up the interface to the following script etc xen scripts vif route ifup 3e Activate the new configuration and start the VM Guest 4 The remaining configuration tasks must be accomplished from inside the VM Gues...

Page 61: ... For easier configuration only an already installed guest is modified to use a masqueraded network Procedure 6 2 Configuring a masqueraded IPv4 VM Guest 1 Shutdown the VM Guest system with virt manager or xm shutdown 2 Prepare the network configuration on the VM Host Server 2a Create a hotplug interface that will be used to route the traffic To accomplish this create a file named etc sysconfig net...

Page 62: ...g line to the end of etc sysconfig network routes 192 168 100 1 dolly 0 2d Activate all changes with the command rcnetwork restart 3 Proceed with configuring the Xen configuration of the VM Guest 3a Change the vif interface configuration for dolly as described in Section 5 3 Configuring a Virtual Machine by Modifying its Xend Settings page 37 3b Remove the entry bridge br0 3c Add the following lin...

Page 63: ...e outside world 6 5 Special Configurations There are many network configuration possibilities available to Xen The following configurations are not activated by default 6 5 1 Bandwidth Throtteling in Virtual Networks With Xen you may limit the network transfer rate a virtual guest may use to access a bridge This configuration option is not available from a graphical user interface at this time To ...

Page 64: ...at the rate is either Mb s megabit per second or MB s megabyte per second In the above example the maximum transfer rate of the virtual interface is 100 megabit By default there is no limitation to the bandwidth of a guest to the virtual bridge It is even possible to fine tune the behavior by specifying the time window that is used to define the granularity of the credit replenishment device vif b...

Page 65: ... and possibilities are available in the manual page man 8 iftop 6 5 3 Setup Bonding Devices For some systems it is desired to implement network connections that comply to more than the standard data security or availability requirements of a typical Ethernet device In these cases several Ethernet devices can be aggregated to a single bonding device The configuration of the bonding device is done b...

Page 66: ...are at your disposal No IP Address Dynamic Address with DHCP or Zeroconf Statically assigned IP Address Use the method that is appropriate for your environment 4 Select the Ethernet devices that should be included into the bond by activating the check box in front of the respective Bond Slave 5 Edit the Bond Driver Options The modes that are available for configuration are the following balance rr...

Page 67: ... in a different network segment or if you want to create a private bridge that only VM Guest systems may connect to even when running on different VM Host Server systems An easy way to build such connections is to set up VLAN networks VLAN interfaces are commonly set up on the VM Host Server and either just intercon nect the different VM Host Server systems or they may be set up as physical interf...

Page 68: ...ning an IP address to the VLAN device 7 Press Next to finish the configuration It is also possible to use the VLAN interface as physical interface of a bridge This makes it possible to connect several VM Host Server only networks and allows to live migrate VM Guest systems that are connected to such a network YaST does not always allow to set no IP address However this may be a desired feature esp...

Page 69: ... contains a disk image accessible from the file system of the host Disk images can be encoded as raw QEMU or VMware file mnt disks sles10sp1 iso tap aio mnt disks sles10sp1 iso specifies a raw disk that might be taken from a different virtualization platform tap qcow mnt disks sles10sp1 iso qcow tap vmdk mnt disks sles10sp1 iso vmdk A remote storage device specified using the Internet SCSI iSCSI p...

Page 70: ...ine Output from Xend vbd dev xvda disk uname file var lib xen images sles11 disk0 mode w type disk backend 0 Table 7 1 Available uname Settings Example Description Protocol phy dev sdc Block devices such as a physical disk in domain 0 phy file path file Raw disk images accessed by using loopback file ndb ip_port Raw disk images accessed by using NBD nbd tap aio path file Raw disk images accessed b...

Page 71: ...ice on the host By default the host allows up to 64 loopback devices to be consumed To simultaneously run more file backed virtual disks on a host you can increase the number of available loopback devices by adding the following option to the host s etc modprobe conf local file options loop max_loop x where x is the maximum number of loopback devices to create Changes take effect after the module ...

Page 72: ...be used can be resized Sometimes for example with ext3 some features must be switched off to be able to resize the file system A file system that can be resized online and mounted is XFS Use the command xfs_growfs to resize that file system after the underlying block device has been increased in size For more information about XFS see man 8 xfs_growfs When resizing a LVM device that is assigned to...

Page 73: ...e A virtual CD reader can be based on a physical CD DVD or based on an ISO image Virtual CD readers work differently depending on whether they are paravirtual or fully virtual 8 1 1 Virtual CD Readers on Paravirtual Machines A paravirtual machine can have up to 100 block devices comprised of virtual CD readers and virtual disks On paravirtual machines virtual CD readers present the CD as a virtual...

Page 74: ...hysical CD reader such as dev cdrom are able to read the inserted CD Assuming the operating system has automount func tionality the CD should automatically appear in the file system Virtual CD readers cannot be used to write data to a CD They are configured as read only devices 8 1 3 Adding Virtual CD Readers Virtual CD readers can be based on a CD inserted into the CD reader or on an ISO image fi...

Page 75: ...n also enter ls sys block to see all disks available to the virtual machine The CD is recognized by the virtual machine as a virtual disk with a drive designation for example dev xvdb 9b Enter the command to mount the CD or ISO image using its drive designation For example mount o ro dev xvdb mnt mounts the CD to a mount point named mnt The CD or ISO image file should be available to the virtual m...

Page 76: ...r mouse This type of configuration is often referred to as headless and requires the use of remote administration tech nologies Typical configuration scenarios and technologies include Graphical Desktop with X Window Server If a graphical desktop such as GNOME or KDE is installed on the virtual machine host you can use a remote viewer such as a VNC viewer On a remote computer log in and manage the...

Page 77: ...rt number is the lowest port number available when the virtual machine starts The number is only available for the virtual machine while it is running After shutting down the port number might be assigned to other virtual machines For example if ports 1 and 2 and 4 and 5 are assigned to the running virtual machines the VNC viewer assigns the lowest available port number 3 If port number 3 is still...

Page 78: ...1 20 8 3 1 Assigning VNC Viewer Port Numbers to Virtual Machines Although the default behavior of VNC viewer is to assign the first available port number you might want to assign a specific VNC viewer port number to a specific virtual ma chine To assign a specific port number on a VM Guest edit the Xend setting of the virtual machine and change the location to the desired value device vfb type vnc...

Page 79: ... vfb type sdl Remember that unlike a VNC viewer window closing an SDL window terminates the virtual machine 8 4 Virtual Keyboards When a virtual machine is started the host creates a virtual keyboard that matches the keymap entry according to the virtual machine s settings If there is no keymap entry in the virtual machine s settings the host uses the keymap entry specified in host s Xend file xen...

Page 80: ... config sxp For example you can specify a German keyboard Make sure the virtual machine s operating system is set to use the specified keyboard After you specify the host s keymap setting all virtual machines created by using the Create Virtual Machine Wizard on the host add the host s keymap entry to their virtual machine settings Virtual machines created before a host s keymap entry is specified...

Page 81: ... be French Belgium fr ca French Canada fr ch French Switzerland hu Hungarian is Icelandic it Italian ja Japanese nl Dutch nl be Dutch Belgium no Norwegian pl Polish pt Portuguese pt br Portuguese Brazil ru Russian sv Swedish Virtualization Configuration Options and Settings 71 ...

Page 82: ...nd considered very useful due to the complexity of the topic there may well be flaws to the system To assign a USB device as for example a USB keyboard device to a VM Guest proceed as follows Procedure 8 1 Adding an USB keyboard to a VM Guest 1 Plug the USB keyboard device into the VM Host Server 2 Make sure that the kernel module usbbk is loaded by the system with the com mand lsmod grep usbbk If...

Page 83: ... 1 run the command xm usb attach alice 0 1 4 2 After completing this procedure you may use the keyboard for example to type inside a VNC window To detach the USB device you need to know the number of the virtual host controller and the port number of the assigned device inside the VM Guest The port numbers of the host controllers start with the number 0 and the port numbers with 1 List currently a...

Page 84: ...ers xend domain lock and xend domain lock path control the behavior To use the directory srv xen as locking directory modify the settings as follows xend domain lock yes xend domain lock path xen lock Activate the new settings either by rebooting the VM Host Server system or by restarting xend with the command rcxend restart When all VM Host Server systems use this locking directory Xen will refus...

Page 85: ... Server it is mandatory that the VM Guest system only uses CPU features that are available on both VM Host Server systems If the actual CPUs are different on both hosts it may be necessary to hide some of the features before the VM Guest is started in order to maintain the possibility to migrate the VM Guest between both hosts For fully virtualized guests this can be achieved by configuring the cp...

Page 86: ...xxxxxxxxxxxx ecx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx The respective bits may be changed by using the following values 1 Force the corresponding bit to 1 0 Force the corresponding bit to 0 x Use the values of the default policy k Use the values defined by the host s Like k but preserve the value over migrations Note that counting bits is done from right to the left starting with bit 0 For an example a...

Page 87: ...Part III Administration and Best Practices ...

Page 88: ......

Page 89: ... by using YaST or by directly editing the boot loader configuration file The YaST boot loader program is located at YaST System Boot Loader The Boot Loader Settings screen lists the sections that appear as options on the boot menu From this screen you can change the boot loader so it auto selects the virtual machine host option when booting Administration Tasks 79 ...

Page 90: ...ion then click Edit to manage the way the boot loader and Xen function Figure 9 2 Boot Loader Settings Section Management You can use the Boot Loader program to specify functionality such as Pass kernel command line parameters 80 Virtualization with Xen ...

Page 91: ...itle XEN root hd0 5 kernel boot xen gz hyper_parameters module boot vmlinuz xen kernel_parameters module boot initrd xen The title line defines sections in the boot loader file Do not change this line because YaST looks for the word XEN to verify that packages are installed The root line specifies which partition holds the boot partition and boot directory Replace hd0 5 with the correct partition ...

Page 92: ...n is the second title line To specify it change the value of default from 0 to 1 9 2 Sparse Image Files and Disk Space If the host s physical disk reaches a state where it has no available space a virtual ma chine using a virtual disk based on a sparse image file is unable to write to its disk Consequently it reports I O errors The Reiser file system perceiving a corrupt disk environment automatic...

Page 93: ...lib xen images sles11 disk0 seek 8000 bs 1M count 2000 Be sure to use the right seek else data loss may happen If the VM Guest is running during the resize operation also resize the loop device that provides the image file to the VM Guest First detect the correct loop device with the command losetup j var lib xen images sles11 disk0 Then resize the loop device for example dev loop0 with the follow...

Page 94: ...ore the routing of the network connection to the virtual network device must be correct The following xend options which are located in the etc xen xend config sxp file need to be set on both hosts to make live migration work xend relocation server yes xend relocation port 8002 xend relocation address xend relocation hosts allow For information on modifying xend settings see Section 5 2 Controllin...

Page 95: ...st Server an overview of the CPU usage of all the running guests is displayed It is also possible to get information about disk and network usage with this tool how ever you must first activate this in the preferences 1 Run virt manager and connect to the VM Host Server system 2 Select Edit Preferences 3 Change the tab from General to Stats 4 Activate the check boxes for Disk I O and Network I O 5...

Page 96: ...uted network no network will be displayed at all B Display the respective block devices and their cumulated usage count For more information about xentop see the manual page man 1 xentop 9 5 3 More Helpful Tools There are many different system tools that also help monitoring or debugging a running SUSE Linux Enterprise system Many of these are covered in the official SUSE Linux Enterprise document...

Page 97: ...et interface eth0 assigned that is connected to br0 in the VM Host Server iptables save Especially when using masquerade networks or if several ethernet interfaces are set up together with a firewall setup it may be helpful to check the current firewall rules The command iptables may be used to check all the different firewall settings To list all the rules of a chain or even of the complete setup...

Page 98: ...pecific VM Guest for example a guest with the name alice run the command xm list l alice grep description 9 7 Providing Host Information for VM Guest Systems In a standard Xen environment the VM Guest systems have only very limited informa tion about the VM Host Server system they are running on If a guest should know more about the VM Host Server it runs on vhostmd can provide more information to...

Page 99: ...0 xvdb r 6 Log on on the VM Guest system 7 Install the client package vm dump metrics 8 Run the command vm dump metrics If you would like to have the result in a file use the option d filename The result of the vm dump metrics is an XML output The respective metric entries follow the DTD etc vhostmd metric dtd For more information see the manual pages man 8 vhostmd and usr share doc vhostmd README...

Page 100: ......

Page 101: ...e is stopped The amount of time to save the virtual machine depends on the amount of memory allocated When saved a virtual machine s memory is returned to the pool of memory available on the host The restore operation is used to return a saved virtual machine to its original running state IMPORTANT After using the save operation do not boot start or run a virtual machine that you intend to restore...

Page 102: ...tual machine s previously saved memory state file and starts the virtual machine The virtual machine does not boot the operating system but resumes at the point that it was previously saved The operation is slightly similar to coming out of hibernation IMPORTANT After using the save operation do not boot start or run the virtual machine you intend to restore If the virtual machine is at any time r...

Page 103: ... is the previously saved memory state file 10 3 Virtual Machine States A virtual machine s state can be displayed in Virtual Machine Manager or by viewing the results of the xm list command which abbreviates the state using a single char acter r running The virtual machine is currently running and consuming allocated resources b blocked The virtual machine s processor is not running and not able t...

Page 104: ... c crashed The virtual machine has crashed and is not running d dying The virtual machine is in the process of shutting down or crashing 94 Virtualization with Xen ...

Page 105: ...Section 5 6 Migrating Xen VM Guest Systems page 41 In the following several typical scenarios are described 11 1 Xen HA with Remote Storage Xen can directly provide a number of remote block devices to the respective Xen guest systems These include iSCSI NPIV and NBD All of these may be used to do live migrations When a storage system is already in place first try to use the same device type you al...

Page 106: ...able with adapters that support a high NPIV data rate of at least 4 Gbit s and allows the setup of complex storage systems Typically a 1 Gbit s Ethernet device will be able to fully utilize a typical hard disk or storage system When using very fast storage systems such an Ethernet device will probably limit the speed of the system 11 2 Xen HA with Local Storage For space or budget reasons it may b...

Page 107: ... bridge that is only connected to guest systems In a HA environment that also should support live migrations such a private bridge must be connected to the other Xen hosts This is possible by using dedicated physical Ethernet devices and also using a dedicated network A different implementation method is using VLAN interfaces In that case all the traffic goes over the regular Ethernet interface Ho...

Page 108: ......

Page 109: ...o the end of the kernel line xenfb video 8 1024 768 For SLES10 the same parameter is needed However it must be added to the extra boot parameters of the configuration TIP Mouse Synchronization in VNC During the installation of SUSE Linux Enterprise it may happen that the mouse in VNC is not in sync with the mouse of your controlling X Server To get both in sync it is advisable to let SaX2 create a...

Page 110: ... ISO image file or as a CD inserted in the host s CD reader 12 2 Virtual Machine Clock Settings When booting virtual machines get their initial clock time from their host After getting their initial clock time fully virtual machines manage their time independently from the host Paravirtual machines manage clock time according to their independent wall clock setting If the independent wallclock is ...

Page 111: ...ing independent wallclock and manag ing its time independently from the host Procedure 12 2 Permanently Changing the Independent Wallclock Setting 1 Log in to the virtual machine environment as root 2 Edit the virtual machine s etc sysctl conf file 3 Add or change the following entry xen independent_wallclock 1 Enter 1 to enable or 0 to disable the wallclock setting 4 Save the file and reboot the ...

Page 112: ...etwork Installation Source The installation of SUSE Linux Enterprise Desktop 9 is only supported from a network installation source To have the right device names supported in Xen you must update the kernel and initrd that are used to install the system Furthermore the updated kernel must be available in the installation source In the following example the network installation source is found at s...

Page 113: ...sr bin create_package_descr x setup descr EXTRA_PROV 8 Create the checksums needed for the installation process with the commands cd srv ftp updates suse setup descr for i in do echo n META SHA1 sha1sum i awk ORS print 1 echo n basename i done srv ftp updates content After this procedure the packages that are copied to the updates directory are available during the installation However they will o...

Page 114: ......

Page 115: ...irtualized network bus and block drivers for a number of Microsoft Windows operating systems including Windows XP Windows Server and Windows 7 These drivers bring many of the performance advantages of paravirtualized operating systems to unmodified operating systems because only the paravirtualized device driver not the rest of the operating system is aware of the virtualization platform For examp...

Page 116: ......

Page 117: ...Part IV Appendix ...

Page 118: ......

Page 119: ...r as described in Section 5 3 Config uring a Virtual Machine by Modifying its Xend Settings page 37 When a virtual machine s settings are stored in xend it is referred to as a xen managed domain or xen managed virtual machine Whenever the xen managed virtual machine starts it takes its settings from information stored in the xend database not from settings in the initial start up file Although it ...

Page 120: ... based on a block device Virtual memory in Mb memory Number of virtual CPUs vcpus Specifies paravirtual mode Linux or full virtualization mode hvm builder Name of the virtual machine name Randomly assigned MAC addresses and bridges assigned to use the virtual machine s network addresses vif Specifies a localtime 0 or UTC 1 time setting localtime Specifies the action that the virtual machine perfor...

Page 121: ...system crashes on_crash Parameters passed to the kernel extra Location and filename of the domU boot loader bootloader Location of the kernel and initial ramdisk bootentry Type of operating system ostype Identification number for a virtual drive uuid Virtual Machine Initial Start Up Files 111 ...

Page 122: ......

Page 123: ...ese expressions are either stand alone or have another expres sion as argument For example to define that a VM Guest has 2 CPUs available the expression would look like domain vcpus 2 The following pages contain descriptions for most of the commonly used options for the Xend configuration However there is no guarantee for completeness ...

Page 124: ...is domain It needs several subelements to store all needed data bootloader Define the program that is used to boot the VM Guest Paravirtualized SUSE Linux Enterprise 11 systems use usr bin pygrub by default Example bootloader usr bin pygrub bootloader_args Provide additional parameters to the boot loader program Example bootloader_args q cpus Defines which CPUs are available to a VM Guest The sett...

Page 125: ... location protocol uuid Defines the console that can be accessed with xm console id 1 1 location Defines the connection information for the console of the given VM Guest A vfb device will look like location localhost 5901 1 2 protocol The interface to use for the console protocol This may be one of these vt100 Standard vt100 terminal rfb Remote Frame Buffer protocol for VNC rdp Remote Desktop prot...

Page 126: ... that is dedicated to the given VM Guest bus A PCI device with device number 03 02 1 has the bus number 0x03 bus 0x03 domain Most computers have only one PCI domain This is then 0x0 To check the domain numbers of the PCI devices use lspci D domain 0x0 func A PCI device with device number 03 02 1 has the function number func 0x1 slot A PCI device with device number 03 02 1 has the function number s...

Page 127: ...paravirtualized virtual devices are implemented by a split device driver This expression defines the domain that holds the back end device that the front end device of the current VM Guest should connect to Example backend 0 3 2 bootable Defines if this block device is bootable Example bootable 1 3 3 dev Defines the device name of the virtual block device in the VM Guest Example dev xvda disk 3 4 ...

Page 128: ...c3ba 54a7574e283b 3 8 VDI Defines if the current virtual block device is a virtual disk image VDI This is a read only setting Example VDI 4 vfb vfb keymap location type uuid vncunused xauthority The Virtual Frame Buffer VFB defines a graphical interface and input device to the VM Guest 4 1 keymap Defines the language to use for the input Example keymap en 4 2 location Defines where to access the v...

Page 129: ...ed port above 5900 vncunused 1 4 6 xauthority When using SDL the specified file is used to define access rights If not set the value from the XAUTHORITY environment variable is used Example xauthority root Xauthority 5 vif vif backend bridge mac model script uuid The virtual interface definition is used to create and set up virtual network devices To list add or remove network interfaces during ru...

Page 130: ...rface that should be presented to the VM Guest See also Section 6 2 Network Devices for Guest Systems page 47 Example model rtl8139 5 5 script Defines the script to use to bring the network interface up or down Example script etc xen scripts vif bridge 5 6 uuid Unique identifier for the current virtual network device Example uuid cc0d3351 6206 0f7c d95f 3cecffec793f 6 vkbd vkbd backend Defines a v...

Page 131: ...ices Example backend 0 7 2 num ports Defines the number of ports that the virtual USB host controller provides for the VM Guest Example num ports 8 7 3 usb ver Define which USB revision should be used Note that unlike the real USB revision numbers this is only an integer Example usb ver 2 7 4 port Starting with port 1 depending on num ports there are several port sections available If an USB devic...

Page 132: ...g a kernel from the image definition args defines extra boot parameters for the kernel Example args sax2 1 1 2 device_model The device model used by the VM Guest This defaults to qemu dm Example device_model usr lib xen bin qemu dm 1 3 kernel Defines the path to the kernel image this VM Guest should boot Defaults to no image Example kernel boot vmlinuz 1 4 notes Displays several settings and featu...

Page 133: ...uld be available to the VM Guest Example apic 1 2 3 boot Defines the drive letter to boot from Example boot c 2 4 device_model The device model used by the VM Guest This defaults to qemu dm Example device_model usr lib xen bin qemu dm 2 5 extid Defines whether a guest should use Hyper V extensions Only applies to guests types that support Hyper V Example extid 1 2 6 guest_os_type Defines the guest...

Page 134: ...9 isa Defines if an ISA only system should be emulated Example isa 0 2 10 kernel Defines the path to the kernel image this VM Guest should boot Defaults to no image Example kernel 2 11 keymap Defines the language to use for the input Example keymap de 2 12 loader Defines the path to the HVM boot loader Example loader usr lib xen boot hvmloader 2 13 localtime Defines if the emulated RTC uses the lo...

Page 135: ...notes SUSPEND_CANCEL 1 2 17 pae Enable or disable PAE Physical Address Extension of the HVM VM Guest Example pae 1 2 18 pci pci Bus Slot Function Add a given PCI device to a VM Guest This must be supported by the hardware and can be added multiple times Example pci 03 02 1 2 19 rtc_timeoffset Defines the offset between local time and hardware clock Example rtc_timeoffset 3600 2 20 serial Defines D...

Page 136: ...B devices should be emulated Example usb 1 2 24 usbdevice Adds the specified USB device to the VM Guest usbdevice tablet 2 25 vnc Defines if VNC should be enabled for graphics Example vnc 1 2 26 vncunused If not set to 0 this option enables the VNC server on the first unused port above 5900 vncunused 1 2 27 xauthority When using SDL the specified file is used to define access rights If not set the...

Page 137: ...n different managing utilities Example name sles11 online_vcpus Number of CPUs that are currently available to the VM Guest Example online_vcpus 2 on_crash on_crash coredump destroy coredump restart destroy preserve rename restart restart Defines the behavior after a domain exits because of a crash 1 coredump destroy Dumps the core of the VM Guest before destroying it Example on_crash coredump des...

Page 138: ... The old VM Guest is renamed and a new domain is started with the old name Example on_crash rename restart 6 restart The old VM Guest is not cleaned up Instead a new VM Guest is started Example on_crash restart on_poweroff on_poweroff destroy preserve rename restart rename Defines the behavior after a domain exits because of a restart For details about the available parameters see the section call...

Page 139: ...d_stop on_xen_stop destroy preserve rename restart rename shutdown Defines the behavior when Xend stops For details about the available parameters see the section called on_crash page 127 shadow_memory Define how much shadow pagetable memory in MB is available for the VM Guest This is needed for fully virtualized VM Guest systems Example shadow_memory 10 start_time Time in seconds when the VM Gues...

Page 140: ..._mfn Number of shared pages for the current VM Guest Example store_mfn 262141 uuid Unique identifier for this VM Guest Example uuid 7892de3d 2713 a48f c3ba 54a7574e283b vcpus Number of virtually available CPUs in the current VM Guest Example vcpus 2 130 Virtualization with Xen ...

Search results

Summary of Contents for LINUX ENTERPRISE 11 SP1 - LINUX AUDIT

Reviews:

Novell LINUX ENTERPRISE 11 SP1 - LINUX AUDIT, Manual, Page: 11 / 140

Search results

Summary of Contents for LINUX ENTERPRISE 11 SP1 - LINUX AUDIT

Reviews: