How to Create VMware Templates

VMware vCenter Server allows you to create templates from existing virtual machines. You can use templates to reduce the amount of time spent building and implementing new servers, cutting down the provisioning process to just a few hours.
vCenter Server uses one of two methods to build templates. The first method, Clone to Template, duplicates a virtual machine and changes it to the template format. Unlike Convert to Template, which I’ll cover in just a moment, Clone to Template leaves the original virtual machine intact.
During the cloning process, you’ll have the option to change the format of the virtual disk(s). You can either configure the disk to fill all of the space in the datastore (thus enabling the template to maintain the same level of performance as the source VM), or use the thin provisioned format to compress the disk space so that the template uses only as much of the datastore as it needs.
Of course, when vCenter clones the source virtual machine, it doesn’t just duplicate the virtual disks, but also creates a copy of the .vmx file. The .vmx file holds the data used to configure the VM. Thus, before you run Clone to Template, you should remove any unwanted settings from the .vmx file associated with the source VM.
Convert to Template, the other method used to create templates in vCenter, is much faster than Clone to Template, because it doesn’t create a duplicate of the source VM; instead, it just changes the VM to the template format. Convert to Template is more flexible than Clone to Template because you can change the template back to a virtual machine at any time. For example, software installed to templates created through Clone to Template can’t be updated. With Convert to Template, however, you can temporarily change the template to a virtual machine and install updates to the software, then change the VM back to template when done.

Preparing for Template Creation

Before creating a template in vCenter, you’ll need to install Sysprep to VMware if you intend to clone or convert Windows-based virtual machines. Each release of Windows (including service packs) requires its own version of Sysprep; you can find the appropriate files on the operating system CD/DVD or on the Microsoft Download Center website. Find and double-click deploy.cab, and then extract the contents of the compressed file to the following location:  %allusersprofile%\vmware\vmware virtualcenter\sysprep
If you’re running Windows Server 2003 or below, extract the contents to: %allusersprofile%\application data\vmware\vmware virtualcenter\sysprep
There are also a few things to keep in mind before you create your source virtual machine (the virtual machine on which the template will be based). Components like Active Directory and Microsoft SQL Server should be excluded from the template, as these can interfere with the template creation process or cause problems after the fact. Also, if you’re running VMware Infrastructure 3.5 or later, you can perform a hot clone of a virtual machine using the Clone to Template method. Hot cloning enables you to keep the source VM active during the cloning and conversion process.
Once you’ve installed Sysprep and created the source virtual machine, you can begin building templates.

Creating a Template with Clone to Template

1. Right-click the source virtual machine. Point to “Template,” then select “Clone to Template” from the context menu.

2. Create a name for the template and then choose an Inventory location from the folder list. Click “Next.”

3. Select the ESX host or cluster where the template should be stored. Click “Next.”
4. Select a datastore with enough available space to accommodate the template. Click “Next.”
5. Click “Same as Source” to use the same disk format as the source VM; click “Thin Provisioned” to save space on the datastore; click “Thick” to reserve all of the datastore space for the virtual hard disk. If you select “Thin Provisioned,” make sure to allocate the virtual disk to a VMFS3+ datastore. Click “Next.”

6. Review your selections on the Ready to Complete screen. Click “Finish” to create the new template in VMware vCenter Server.

Create a Template with Convert to Template

1. Power off the source VM. Right-click the virtual machine, and then point to “Template.”
2. Click “Convert to Template.” Select “Home.” Go to VMs and Templates view to locate the new template.

3. Right-click the template and then click “Convert to Virtual Machine” to return the template to its original state whenever necessary.
You can also create new templates from existing templates. Right-click the source template and then click “Clone” to begin the duplication process. The steps in the wizard are identical to those in Clone to Template.

Create a Virtual Machine from a Template

After you finish creating a template, you can run the Deploy Template Wizard to create a new virtual machine.
1. Switch to VM and Templates view. Right-click the template and select “Deploy Virtual Machine from This Template” from the context menu.
2. Name the virtual machine and select a folder location. Click “Next.”
3. Select the ESX host and/or cluster on which the VM will run. Click “Next.”
4. Choose which resource pool the new virtual machine will use. Click “Next.”
5. Select which datastore or datastores will accommodate the virtual machine. Click “Next.”
6. Choose the appropriate disk format and then click “Next.”
7. Click “Do Not Customize,” “Customize Using the Customization Wizard,” or “Customize Using an Existing Customization Specification,” depending on your preferences. You won’t see this screen if you didn’t load Sysprep into vCenter. If you selected the second or third option, follow the on-screen instructions to configure the template.
(Note: If the OS installed to the source virtual machine requires an OEM product code, select option two and then enter the information into the appropriate field when prompted.)

8. Click “Edit Virtual Hardware” to make changes to the VM configuration, if necessary. Click “Finish” to deploy the new virtual machine.

VMware Networking: Configuring and Troubleshooting a vNetwork Part 2

For the second half of the series, I’ll explain how to set up a distributed vNetwork (DVN) with VMware, and how to troubleshoot your vNetwork if problems occur. In part one, I discussed the basics of virtual networks, as well as how to create and configure a standard vNetwork.
Distributed virtual networks use a distributed virtual switch (DvSwitch) to manage data transmission between virtual machines and enable guest systems to connect to physical networks. As I explained in the last post, a DvSwitch works like a global switch; all of the hosts in a datacenter can connect to a single distributed switch. A DvSwitch also enables the use of private virtual local area networks (PVLANs), which divide VLAN domains into smaller sub-domains, enabling multiple hosts to use the same address space, but exist separately, or isolated, from one another.
Like standard virtual switches, distributed virtual switches provide virtual uplinks called distributed virtual uplinks (dvUplinks). Uplinks represent physical network adapters. When creating a DvSwitch, the virtualization platform finds the maximum number of uplinks associated with a host and uses that number as a basis when setting up the dvUplinks on the switch.
DvSwitches offer more ports than do standard virtual switches; the former offers up to 6,000, compared to the latter, which provides up to 4,088. A maximum of 64 hosts can connect to a single DvSwitch and up to 16 distributed switches can be implemented per host.
DvSwitches are stored to the VMkernel, but the settings linked to the DvSwitch are contained in the vCenter database. Therefore, to create a distributed switch in VMware, you must have vCenter installed.

Creating a Distributed Virtual Switch

1. In vCenter, select “Home” and then “Networking.” Click the datacenter on which the host or hosts reside.
2. Select from the toolbar the icon to launch the Create vNetwork Distributed Switch wizard. Name the vNetwork. Click “Next.”

3. Select each host to associate with the DvSwitch, and then select which network adapters to use with each ESX/ESXi host. Choose multiple network adapters to create uplink groups and provide load balancing and fault tolerance to a host. Make sure to select the correct network adapters during the creation process, as reassigning the adapters is not a simple process. Click “Next.”

4. Click “Finish” to create the DvSwitch in vCenter.

Configuring DvSwitches and Port Groups

DvSwitches and vSwitches share most of the same options, but distributed switches offer a little bit more control over the operation of the vNetwork. To access the settings, right-click the virtual switch and then select “Edit Settings” from the context menu.
On the General tab are options to change the name of the switch and the number of dvUplinks connected to the vNetwork. On the Advanced tab are options to increase or decrease the maximum transmission unit (MTU), which limits packet size, and enable Cisco Discovery Protocol. In later versions of vSphere, you can also set up features like NetFlow, which analyzes network communications transmitted between virtual machines and physical networks; or port mirroring, which copies packets from one port to another for monitoring purposes.

To configure the port group, right-click it and then click “Edit Settings.” Most of the options match those described in the previous article, with a few exceptions:
General

• Static Binding: Adheres a virtual machine to a port on the DvSwitch that remains active even when the machine is powered off
• Dynamic Binding: Assigns a port to a virtual machine at the time the machine is powered on
• Ephemeral: Allocates a port to a virtual machine when powered on. If the machine reboots, it loses its old port and is assigned a new one

Advanced

• Override Port Policies: Overrides the settings associated with the dvUplinks
• Live Port Moving: Transfer stand-alone port groups to distributed port groups, assigning settings associated with distributed port group to the stand-alone group
• Configure Reset at Disconnect: Port settings are reset when a port is disconnected from a virtual machine
• Port Name Format: Changes the naming convention of a port group

Troubleshooting a vSwitch or DvSwitch

Under ideal circumstances, the vNetwork will work as intended after creating and configuring the virtual switches and port groups — but certain settings can interfere with how the virtual network functions.
A virtual machine uses a port group to communicate across a network. Port groups are associated with a parent switch, so if a machine’s virtual network adapter is not assigned the correct port group, it might not link to the correct distributed or standard switch, either. Furthermore, port group names are case-sensitive, so a group named “Test,” for example, is not the same as a group named “test.”
To confirm that a virtual machine is connected to the correct port group, right-click the virtual machine and then select “Edit Settings” from the context menu. Select the appropriate port group from the drop-down menu.

While in Virtual Machine Properties, also confirm that “Connected” and “Connect at Power On” are checked under the Device Status heading. Click “OK.” Restart the virtual machine or network services if the machine has not been assigned a static IP.
If the settings for the virtual machine are correct, move on to checking the vNetwork settings for the host. Click the Configuration tab after selecting the appropriate ESX/ESXi host and then select the Networking link.
Choose “Virtual Switch” or “Distributed Virtual Switch” from the menu. Click the call-out icon for the correct switch or port group and review the settings shown in the dialog box to confirm that the network configuration is correct.
If you detected a problem with the settings, click the Properties link to make changes to the vSwitch. If you’re working with a distributed switch, follow the instructions in the above sections to change the switch’s properties. To learn more about the options available on these screens, go to the first part of this series and view “Configuring Port vSwitches and Port Groups.”
If you’re working with a vSwitch, make sure that the port group is using the original name assigned to it upon creation. If you’ve changed the name of the port group, you must edit the properties of every virtual machine originally connected to it and select the new name from the drop-down menu under Network Connection.
If your switches and port groups are all in order, the next things to check are the network adapters. If working with a standard switch, select the Network Adapters tab from the vSwitch properties window. If working with a DvSwitch, select “Manage Physical Adapters” from the Networking screen.
Confirm that the adapter is using the correct speed and duplex. If the adapter settings don’t match that of a network component or client, performance or connectivity issues can occur. Click “Edit” to change the adapter settings.

VMware Networking: Configuring and Troubleshooting a vNetwork Part 1

The term vNetwork refers to the technologies that VMware vSphere utilizes to integrate networking and input/output functions on an ESX/ESXi host. vSphere includes a number of features and enhancements to provide administrators thorough control over networking processes and make management of these processes simpler.
Implementing a vNetwork in ESX or ESXi is essential for enabling virtual machines to communicate with one another within a networking environment — but establishing a vNetwork on a host can be a difficult and complicated process if you don’t understand how virtual networking works in vSphere.
A virtual network is made up of virtual machines that run on a single, physical machine and transmit data to and from one another. In vSphere, a virtual switch is called a vSwitch. Virtual machines connect to the virtual ports that make up the vSwitch to create a vNetwork. The vSwitch then routes network traffic between the connected virtual machines. vSwitches can also use physical network adapters, or uplink adapters, to connect to a physical switch and associate the virtual network with a physical network.
In vSphere 4, VMware introduced an enhancement to vNetworks: the distributed virtual switch, or DvSwitch. A DvSwitch acts like a global switch, enabling administrators to associate a single switch with all ESX or ESXi hosts in a datacenter, rather than configure a vSwitch for each individual host.
vSphere separates vSwitches and DvSwitches into smaller groups called port groups. VMware uses port groups to connect virtual machines to a switch and define settings like traffic shaping, NIC teaming, load balancing, and other parameters.

Creating Standard Switches

In vSphere, vSwitches can be mapped to one network adapter or to multiple network adapters. vSwitches that have no associated network adapters can also be implemented as well.
A standard switch that has no associated adapters is called an internal vSwitch. Virtual machines connected to an internal vSwitch cannot communicate with other virtual machines outside of the host. These switches can be used to test virtual machines before mapping them to a production network. A vSwitch that is associated with two or more adapters is called a teamed vSwitch; these switches provide an added layer of protection to a network and are used for fault tolerance and load balancing.
A vSwitch starts out with 56 ports, by default, but can be configured to use up to 4,088 ports, and up to 20 network adapters can be associated with a host.
To create a standard switch in vSphere, follow the instructions below:
1. In vSphere, select the ESX or ESXi host. Click “Configuration.” Select “Networking” from the Hardware box. Click “Add Networking” to run the Add Network Wizard.

2. Select “Virtual Machine” and then click “Next.”

3. Select each network adapter to associate with the vSwitch. To create an internal vSwitch, make sure that all network adapters are deselected.

4. Create a unique name for the port group. Names are case-sensitive. (A couple things to keep mind when naming port groups: one, if the names aren’t consistent from host to host, problems will occur when migrating virtual machines or using VMotion; two, while it’s possible to rename a port group after-the-fact, virtual machines that were connected to that port group will disassociate with the switch. Therefore, to avoid potential complications, it’s best to keep track of port group names and follow a standardized naming convention.)

5. Click “Finish” to create a standard vNetwork.

Configuring vSwitches and Port Groups

After creating a vNetwork in vSphere, you can modify the vSwitch to add additional ports and change network parameters.

Add Port Groups

As I mentioned in “Creating Standard Switches,” vSwitches start out with 56 ports, but administrators can increase the port number up to 4,088. Increasing the number of ports per vSwitch is not recommended unless the operating environment requires it, as the ESX/ESXi host must be restarted after the change, and upping the port number requires additional overhead that will lead to wasted resources.
To increase the number of ports per switch:
1. Select the host and then click the Configuration tab. Click “Networking” from the Hardware box.
2. Select the Properties link. Click “vSwitch.” Click “Edit.”
3. Choose from the drop-down menu the number of ports to use with the standard switch. Click “OK.”

Set Network Policies

You can change the parameters of a vSwitch to apply global policies to the vNetwork. Port groups feature options similar to those available to switches and can be used to add greater flexibility to a virtual network, as the settings associated with the port group can act as exceptions to the global policies. You can access the network settings using the same method as described in the section above.
I’ll provide a brief overview of the options you’ll find on each tab:

Security

• Promiscuous Mode: Enables a network adapter to retrieve and read all network traffic. Used for packet sniffing to troubleshoot and diagnose network issues.
• MAC Address Changes: Allows the virtual MAC address associated with a virtual machine to be changed. Used to create cluster addresses for services like Network Load Balancing, used by Windows Server.
• Forged Transmits: Enables a virtual machine to transmit network traffic even if the MAC address on the guest operating system doesn’t match the MAC address stored to the .vmx file (the file that holds the virtual machine’s configuration information).

Traffic Shaping

Traffic shaping is used to control bandwidth on a vNetwork. Traffic shaping focuses on outbound traffic sent from a virtual machine to the physical network; it doesn’t interfere with inbound traffic. The vast majority of administrators will never need to use this feature, particularly because traffic shaping in the vSphere environment is not dynamic and can hinder network performance.

NIC Teaming

NIC Teaming is used for fault tolerance; you can configure standby adapters to take over when the primary adapter fails.

• Load Balancing: Configures how outgoing traffic is handled across multiple network adapters in a teamed vSwitch.
• Network Failover Detection: Specifies how the host detects network failure.
• Notify Switches: Tells the physical switches to route network traffic from virtual machines to different physical network adapters.
• Failback: Specifies how the failed adapter should operate if it comes online again.

That’s it for configuring standard switches in vSphere. In part two, I’ll explain how to set up a vNetwork that runs on a distributed switch, and how to troubleshoot your vNetwork if problems occur.

Top 5 Most Common VMware Compatibility Issues (and How to Work Around Them)

If a computer is not equipped with the hardware required to run a specific version of VMware ESX or ESXi, a number of errors can occur during or after the installation process. If a machine lacks a compatible BIOS or CPU — equipment central to the operation of the system, in other words — setup will usually fail to initialize or complete. Sometimes, however, the hardware configuration is just enough to get the hypervisor up and running — and that’s where most of the problems occur. Incompatibilities can cause hardware to stop operating or fail to respond, produce error messages when booting a host or virtual machine, and result in poor performance when running VMware vCenter Server or accessing a datastore or virtual network.
Before installing or upgrading to a version of ESX or ESXi, it’s important to confirm that the hardware of the target system is compatible with the hypervisor. Even if a previous version of ESX/ESXi works with the machine, that doesn’t mean a more recent version will work just as well. Review the minimum requirements to confirm that your hardware is supported.
Some hardware issues can be worked around, however, and some errors that seem hardware-related are instead caused simply by misconfigured settings. Below is a list of common compatibility errors or issues you might encounter after installing the hypervisor, configuring resources, or creating a virtual machine, as well as solutions for resolving these problems.

Datastores

ESX/ESXi 4.0 does not support LUNs larger than 2TB in size. If the size of a LUN surpasses 2TB, the host will fail to assign block devices, or storage resources, to the LUN, and prevent VMware from creating a datastore on the device.
You can use extents to work around this limitation. An extent is a partition on a LUN. A datastore can consist of up to 32 extents. Since each LUN is limited to 2TB in size, and a datastore can utilize 32 extents in total, volumes of up to 64TB in size are possible in VMware. In other words, if you need a datastore to be larger than 2TBs, spread the datastore across multiple LUNs to expand the size of the volume.
To expand a datastore in VMware:
1. Select the target host. Click “Configuration” and then select “Storage” from the Hardware pane.

2. Right-click the target datastore and then click “Properties.” Click “Increase.”

3. Select the appropriate LUN from the options and then click “Next.” To create a new extent, select a LUN marked as un-expandable (listed as “No” under the “Expandable” category); to increase the size of an extent, select a LUN marked as expandable. Select the appropriate disk layout and then click “Next.”

4. Check “Maximize Capacity” to use all available disk space, or enter the desired amount in the applicable field. Click “Next.”
5. Review your options on the summary screen and then click “Finish.”

Central Processing Unit

While older versions of the hypervisor, such as ESX/ESXi 3.5, can run without issue on 32-bit processors, ESX/ESXi 4.0 and ESXi 5.0 both require 64-bit CPUs. ESXi 5.0 has additional hardware requirements above what ESX 4.0 and ESXi 4.0 require, as well: the latest version of the hypervisor must run off, at minimum, a dual-core CPU that supports SAHF and LAHF (instructions that control which flags are loaded into the upper half of the AX register, the latter of which is used to gather the results from arithmetic and logic calculations). Chip manufacturers didn’t begin integrating SAHF and LAHF into the 64-bit instruction set until 2005, however, so even if you’re running a 64-bit multi-core CPU, it still might not work with ESXi 5.0. If the CPU isn’t compatible with the hypervisor, installing/upgrading ESX/ESXi will fail.
Even if the host is able to run off the processor, however, certain virtual machines might not. As to be expected, a 64-bit guest operating system utilizes a 64-bit CPU. However, just having a processor with a 64-bit instruction set isn’t enough to run a 64-bit virtual machine; the CPU also must have virtualization technology enabled.
If VT is disabled, the following error is likely to appear when attempting to run a 64-bit guest OS in VMware: “Host CPU is incompatible with the virtual machine’s requirements at CPUID level.” Enabling Intel VT-x or AMD-V in the BIOS should resolve the above error, allowing the virtual machine to boot. Since the BIOS varies based on the make and model of the motherboard or computer, consult the documentation for your machine to determine how to enable virtualization technology.

Optical Drive

When performing a cold migration, the error “Incompatible device backing specified for device” will appear if the optical disc drive is misconfigured. To reconfigure the drive in vSphere:
1. Right-click the virtual machine and then click “Edit Settings.”

2. Select the CD- or DVD-ROM from the Hardware tab. Choose “Client Device” as the device type and then click “OK.”

If the above steps fail to resolve the error, check the VMX file associated with the virtual machine to see if the optical device is connected in the configuration data. If the file indicates that the optical device is connected, remove and then re-add the CD- or DVD-ROM from the same window.

TEAC DV-28 series DVD-ROM drives can also cause, at random, an ESX or ESXi 4.0 host to stop responding in vCenter Server or refuse connections from VMware vSphere. While certain models are incompatible with ESX/ESXi altogether, upgrading the outdated firmware on some devices will resolve the issue and restore function to the host. (Some manufacturers, such as Dell, provide firmware flash upgrades for certain TEAC DV-28 series models.)

Virtual Disks

When attempting to run a virtual machine created in another VMware virtualization platform, such as VMware Workstation, the VM will fail to start and the message “Unsupported and/or invalid disk type” will appear. This error occurs because the virtual disk formats associated with the different virtualization platforms are incompatible with ESX/ESXi.
You can use VMware vCenter Converter to convert the disk and import the virtual machine into vSphere. This is a called a cold migration in ESXi (V2V).
Running the following command from the server console will also convert the virtual disk to a format that ESX/ESXi can understand:

vmkfstools -i <original file>.vmdk <new file>.vmdk

Networking

VMware vSphere can run virtual standard switches (vSwitches), which apply to a single host, or virtual distributed switches (vDS), which span across multiple hosts. If the license is incompatible with the vDS feature, vCenter Server will fail when creating a distributed switch. To work around this error in vSphere 5, you must upgrade each host to the Enterprise Plus license.

Conclusions

It’s important to keep in mind although there are workarounds for some compatibility issues, if a critical hardware device isn’t supported by the hypervisor, there’s little recourse. For example, if the hypervisor requires a 64-bit CPU but your system only includes a 32-bit processor, you have no choice but to upgrade the hardware or stick with an older version of ESX/ESXi.

How to Protect Yourself from the “Flame” Virus

Recently, reports have been circulating that a virus, called “Flame,” has been infecting users in the Middle East, particularly Iran. This has led many to conclude it is the work of Israel’s engineers. Experts also suggest there is more evidence to suggest this including the links of this malware with previous malware targeting Iran. The official name for Flame is W32.Flamer because it targets 32bit Windows PC users.

The “Flame” Virus Looks to be the Work of Professionals

According to the USA Today, the reason for the suspicion existing about Israel being pinned as the culprit is that Iran has been particularly affected by it. This led Kaspersky Lab to conclude engineers in Israel should claim responsibility as there is distrust and animosity between the two nations.
Another virus launched last November, called Stuxnet, that targeted nuclear centrifuges in Iran and Flame. It shares a lot of similarity to Flame, according to reports. It has been speculated for quite a while now that engineers from Israel created Stuxnet.
The New York Times reported last November, the virus was precisely created to disrupt Iran’s nuclear program. It caused nuclear centrifuges to be sent out of control.
The Russian anti-virus company, Kaspersky Lab, also claims responsibility for the discovery of its existence, as reported by a company news brief. However, other anti-virus companies have also been analyzing it and trying to address its reach as well.
According to USA Today, a unit within Iran’s communication and information technology ministry claimed it has anti-virus software capable of identifying and removing it:
“Tehran has not said whether it lost any data to the virus, but a unit of the Iranian communications and information technology ministry said it had produced an anti-virus capable of identifying and removing Flame from its computers.”
When Israel’s Vice Premier Moshe Yaalon didn’t outright dismiss Israel’s responsibility for it when asked about its significance. This leads to further conclusion Israel’s hands were at work here.
“Israel is blessed with high technology, and we boast tools that open all sorts of opportunities for us,” he said.

What Makes “Flame” Stand Out Among Malware

Flame is particularly alarming in terms of the security concerns it poses for users on the recipient end of it. It really shows just how exposed anyone of us can be online if we do not take precautions. Examples of damage it can do include allowing its creators to take screenshots, log keystrokes, and even steal data from mobile devices via Bluetooth.
“It can be used to spy on everything that a user is doing,” said researcher Roel Schouwenberg in the USA Today report.
I recently spoke to the director of Norton’s Star Program, Kevin Haley, about the threat and what risks it poses for end users.
Besides its ability to spy on users; take screenshots of user activity and send it back for analysis; and steal files, it can also be improved upon or patched.
Haley said that its creators can write modules adding functionality to it over time. This means they do not have to create new malware but simply modify Flame for added functionality end threats.
“It was clearly built so it could be added upon again and again.”
He also pointed out its complexity when analyzing it and looking at its size. The actual file size is about 200MB, which makes it much larger in scope than most other malware. It also makes Flame harder to detect in many cases due to users thinking it is a legitimate application or program.
“It is like 20 times as large as Stuxnet. It is bigger and more modular, Haley said. “It is build like multiple people worked on it and didn’t know what other people were doing.”
What he meant by calling its engineering modular was that multiple groups of professional engineers were probably contracted to create it in different steps. Then their work was put together into what is now known as Flame.
Haley also indicated that in his opinion it probably took about 6 months to create and it will take Norton months to fully comprehend it. Norton has only been analyzing it for the last few days although there are indications it was around for at least two years in one shape or form.

A Disguised File

Haley said that its creators found clever ways to hide it inside systems it infects. Because of its large size, it may trick users into thinking it is harmless, but also in the way it runs on machines without showing indications of its approach.
“It tries to hide itself inside other applications to disguise itself,” he said. “It also hides itself inside another process inside the computer.
“If you weren’t examining it closely, you would think it is doing things that are harmless. It has functionality that normal programs have to make users think it is not doing anything not unique.”

Command-and-Control Server

The way its authors use Flame is through a command-and-control server (C&C). Its authors give it instructions through this structure to accomplish certain tasks.
“Typically once it gets on a machine it will report back to CMC server and wait for instructions,” haley said. “The author gives commands like show what documents they are and these are the ones I want you to copy.”
By the way, Symantec has provided further analysis of the virus in a blog posting on the company’s website titled “Painting a Picture of @32.Flamer.” This analysis points out that Flame is actually a whole platform and not just a file with a single function. It includes a Web server, a database server, and secure shell communications. It also includes a scripting editor.

How to Protect Yourself from the “Flame” Threat

What makes Flame such a threat is that it may have the potential of infecting users who have great firewalls or are not even connected online. Malware can, for instance, be infected from a USB drive.
However, Haley said that anyone with an updated version of Norton’s or Symantec’s anti-malware programs should be safe (these two product lines are linked to the same company, but Symantec is geared for enterprise users while Norton is geared for regular computing users). It should automatically detect and remove Flame. He even pointed out that competitor products are also able to remove it now. It is the users who are not protected that should make sure their system is safe.
Haley described how in 2011 alone there were over 400 million unique threats and he expects 2012 to show greater figures.
He thinks that a layered approach is needed with anti-virus software, firewalls, and other tools. He described one of these tools, which Norton uses, as the intrusion prevention systems (IPS).
“IPS intrusion prevention systems looks for patterns in network traffic,” Haley said. “It will detect malware unlike firewall that just blocks it.”
Despite Haley’s enthusiasm for anti-virus software being able to remove it, keep in mind that he did also say its creators have the ability to modify it and add functionality to it. Take that as you will, but it may mean that it still can pose a danger to any user.

Conclusion

Viruses like Flame show the challenges users and companies face every day when targeted by calculating and skillful threats. However, do not expect the average hacker to be able to create something this sophisticated. A group like Anonymous may have the potential over time so do not rule the idea out. However, this was most likely the work of engineers being hired full time to work on it over a period of numerous months as Haley pointed out.

Installing WordPress on IIS7 – Part 2

Now that we’ve installed and setup a WordPress blog on IIS 7 let’s get into the details and enhance it a bit.
First we’ll set up search engine friendly URLs for our WordPress on IIS 7 to increase SEO. Then we’ll learn how to take advantage of the many WordPress plugins. And finally I’ll talk about setting up IIS Authentication for our WordPress site.
If you missed it, here’s Part 1 of Installing WordPress on IIS 7.

Search Engine Friendly URLs for WordPress on IIS7

Now if you’re interested in getting free and highly targeted traffic to your website, you can’t do much better than the search engines. As of this writing most search engines put a good deal of weight on having friendly URLs that include what the page is about.
For example, in our current install if you click on the default post you will notice that the url is:

http://domainname/?p=1

This doesn’t really tell the search engines anything about the page so they will not use it in their ranking weight. Now what if this was changed to something like:

http://domainname/hello-world

The search engines would accord more ranking weight for the keywords "Hello World" that are in the url. This is the reason I had you install the URL Rewrite module, because there is a little code you can include to help make the URLs friendly to both search engines and users.
1. Browse to the directory you have installed WordPress in and create/open the web.config file in Notepad.

2. Now navigate to the <System.Webserver> element and copy the code below into it and save it.
<rewrite>
          <rules>
                   <rule name="Main Rule" stopProcessing="true">
                   <match url=".*" />
                   <conditions logicalGrouping="MatchAll">
                   <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                   <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                   </conditions>
                   <action type="Rewrite" url="index.php" />
                   </rule>
          </rules>
</rewrite>
NOTE: Your web.config file might look very different from mine due to any other options that are installed on your server. The main thing is, if you already have a <rewrite> section then place the rules within that, if you don’t then just put in the whole section below anywhere between <System.Webserver> </System.Webserver>

3. Now in your WordPress dashboard go ahead and click on Settings in the top right

4. Now click Permalinks across the middle of the screen

5. Under Common Settings go down to Custom Structure and place the following in the text field:
/%postname%/
If you want to put other variables into the url structure you can find a full list at:
http://codex.wordpress.org/Using_Permalinks under Structure Tags
After you configure your structure click on Save Changes.

6. Now let’s go back to our site home page and click on the default post, you will now see that the url is now http://domainname.com/hello-world/

That’s it, using this will almost certainly increase your search engine visibility along with making your post URLs easier to remember for average users.

WordPress Plugins

One of the best things about WordPress and why it has become so popular is that it allows for great flexibility by allowing the use of plugins. Plugins are at the heart of WordPress’s extensibility because they are for the most part written by the user community. This means that when someone needs some kind of functionality more than likely someone else has needed it and written a plug-in for it.
While I cannot cover all the plugins out there, let me mention some tips if you have any problems with using them on your site. If you try a plugin and have issues take a quick look at the following:

• PHP extension needed – if you kept your PHP installation lean you might not have all the extensions needed and configured. Make sure that you review the requirements for the plug-in and you have the extension loaded.
• File permissions – watch the permissions in the directory that the plug-in is installed.

Here’s where you can learn more about plugins: http://codex.wordpress.org/Plugins
And here’s where you can search the 3,000+ WordPress plugins: http://wordpress.org/extend/plugins/

IIS Authentication for WordPress

WordPress uses its own users and rights system, but there might be a situation where you want to use IIS authentication instead to seamlessly integrating the WordPress blog with the rest of a site. While this is very site specific and I will not go into detail here on how to do it, Mike Volodarsky has a great write-up on it using a plug-in that he wrote.
You can find that information on his site: IIS 7.0 Server-Side.

Summary

You have now installed and configured WordPress on IIS7 and even changed the URL structure to a custom one that will help you grow your blog through increased search engine traffic. Now go look through some plugins and start adding content to your site!

Installing WordPress on IIS 7 – Part 1

In the past few weeks I have been writing a lot about using open source software such as PHP and MySQL on IIS7 to get you ready for today. This article will take the knowledge and experience of those articles and apply them to install one of the most popular open source blogging and CMS software products: WordPress.
WordPress is always being updated but for this article we will be using the 2.6 version. A word about the versions, this article should stay applicable through the usual feature updates, if there is a major code overhaul there might be issues, but as long as you are in 2.x fork you should be good following this article.

WordPress Requirements

As I said, my earlier articles were in preparation for this article so if you have not already done so please go back and follow these earlier articles to make sure your IIS7 server is ready for WordPress.

• Install PHP on Server 2008
• Install MySQL on Server 2008
• Install URL Rewrite Extension on IIS7

Now with those applications and module installed we are ready to move forward!

Download WordPress

Now that we are going to install WordPress let’s download the files and get them on the server. You can either FTP these up to your server or as I am going to do, just download them directly from the server.
You can get the latest files here: http://www.wordpress.org/download. You should see a big download button on the top of the right column, go ahead and start the download.
WordPress is famous for the 5-minute install, which normally is quite correct for Apache servers. Our install might take a little longer, but shouldn’t be too bad.
Now that you have downloaded the files, go ahead and unzip/FTP them to the site directory on the server.
I am going to be installing this under a local domain called wordpresstestinstall.com that is setup to resolve locally for my server. The physical path of the directory is under the directory structure specified in the php.ini.
NOTE: This is a biggie, back in the Install PHP article there was a section that had you modify the php.ini with the top most level of the directory structure that PHP would function within. You MUST have this WordPress install under that directory structure for it to function.

Configure MySQL for WordPress

Now, we have to setup a MySQL database for WordPress to use. There are several ways to do this, especially if you used my Install phpMyAdmin article, you can use that or you can use the MySQL command line interface.
I will actually walk you through both, we will start with phpMyAdmin, but if you want to use the command line sequence instead skip this next section.

Setup MySQL Database with phpMyAdmin

If you read my earlier articles then you know that phpMyAdmin can be used to create and manage MySQL databases in a somewhat easy to use GUI. If you have installed phpMyAdmin let’s go ahead and use that first, by opening it in your web browser.
1. First login with your MySQL username and password.
Unless you have setup other high level users this will almost certainly have the username of root and whatever password you used to install MySQL then hit Go.

2. On this page you can type the name of the database into the field under Create new database.
For this demo I am just going to use wordpress, but you may want to use something a little less generic. After typing in the name, click on Create.

3. Now we are going to create a user for the wordpress database, go ahead and click Privileges

4. Now click on Add a new User

5. Now fill in the details for your new user. For my demo I am using the following information:
User name: wpuser
Host: Any host
Password: password
re-type: password
The rest of the settings I am going to leave at the default and then click Go at the bottom of the screen.

6. After creation scroll down to the section Database-specific privileges and in the dropdown choose the database you created earlier. In this instance it is wordpress.
Once you scroll down you will see the page load up all the possible privileges for that database. Since I want this user to have full rights on this database I am going to select Check All and then click Go.

7. Ok that’s it, you should now have the following information available for your WordPress install:
Database Name: wordpress
Database User: wpuser
DB User Password: password

Use MySQL Command Line Interface

This section is only if you didn’t use the phpMyAdmin interface to setup your MySQL database. We are going to setup the exact same database as before — just without phpMyAdmin.
1. Go to the start menu and open up the MySQL program folder and click on MySQL Command Line Client

2. You will need to enter the root password and hit Enter

3. At the prompt type in: CREATE DATABASE wordpress; then hit Enter.

4. Now we will create and assign the user:
GRANT ALL PRIVILEGES ON databasename.* TO "wpuser"@"localhost"
IDENTIFIED BY "password";
then hit Enter
Note: To go to a second line just hit Enter without a ";" at the end of a line. The ";" signals the end of the command.

5. Now type the following:
FLUSH PRIVILEGES;
then hit Enter
6. Type Exit
7. Ok that’s it, you should now have the following information available for your WordPress install:
Database Name: wordpress
Database User: wpuser
DB User Password: password

Run the WordPress Install Script

Ok the moment of truth is upon us. First we are going to modify the wp-config-sample.php file with some information.
1. Navigate to the directory you placed your files and find the file named wp-config-sample.php and open it with Notepad.

2. You need to modify the following fields in the file. Please note I am using my values in the screenshot, replace them with your specific information.
DB_NAME: wordpress
DB_USER: wpuser
DB_PASSWORD: password
In the next section replace ‘put your unique phrase here’ with a different random phase for each, you don’t have to remember them so just make it up.

3. Save the file as wp-config.php
4. Type in the following to start the script replacing wordpresstestinstall.com with your domain.
http://wordpresstestinstall.com/wp-admin/install.php
You will find that the WordPress welcome screen is now shown. You can now configure the following — use your own info:
Blog Title: WordPress Test Install
Your E-mail: email
Click Install WordPress after you are done.

5. You should now see a screen that says Success! with your username (always admin) and a random password you can change later.
Make sure you write down or copy the password. There is also a small button at the bottom that says Log In, go ahead and click that button.

6. You will now be asked for your username and password that was given on the last page (I told you to write it down). So fill those in and click Log In

7. Now if you login and see a 403 error screen, more than likely it means your default document isn’t setup for index.php in IIS Manager.
If you are seeing the WordPress dashboard, then skip to the next step. For those that need to, do the following:

1. Open IIS Manager
2. Click on the site you are working with
3. In the center content area click on Default Documents
4. Once in Default Documents click on Add… in the right pane
5. In the Add Default Document Box type Index.php
6. Click OK
7. Close IIS Manager
8. Refresh your browser or login again to http://domainname.com/wp-admin/

8. Congratulations, you should now be in the WordPress Dashboard! You can also click the little button that says Visit Site and you will see the default post and theme loaded on your site.

Installing WordPress on IIS 7 – Part 2

Ok, now we have a WordPress blog setup and running on IIS7, with the core basic functionality. In my next article we’ll go a little further and enhance it a bit. In Installing WordPress on IIS 7 – Part 2 I’ll show you how to:

• Set up search engine friendly URLs for WordPress on IIS7 to increase your SEO
• Take advantage of the many WordPress plugins
• Set up IIS Authentication for WordPress