How to Create VMware Templates

VMware vCenter Server allows you to create templates from existing virtual machines. You can use templates to reduce the amount of time spent building and implementing new servers, cutting down the provisioning process to just a few hours.
vCenter Server uses one of two methods to build templates. The first method, Clone to Template, duplicates a virtual machine and changes it to the template format. Unlike Convert to Template, which I’ll cover in just a moment, Clone to Template leaves the original virtual machine intact.
During the cloning process, you’ll have the option to change the format of the virtual disk(s). You can either configure the disk to fill all of the space in the datastore (thus enabling the template to maintain the same level of performance as the source VM), or use the thin provisioned format to compress the disk space so that the template uses only as much of the datastore as it needs.
Of course, when vCenter clones the source virtual machine, it doesn’t just duplicate the virtual disks, but also creates a copy of the .vmx file. The .vmx file holds the data used to configure the VM. Thus, before you run Clone to Template, you should remove any unwanted settings from the .vmx file associated with the source VM.
Convert to Template, the other method used to create templates in vCenter, is much faster than Clone to Template, because it doesn’t create a duplicate of the source VM; instead, it just changes the VM to the template format. Convert to Template is more flexible than Clone to Template because you can change the template back to a virtual machine at any time. For example, software installed to templates created through Clone to Template can’t be updated. With Convert to Template, however, you can temporarily change the template to a virtual machine and install updates to the software, then change the VM back to template when done.

Preparing for Template Creation

Before creating a template in vCenter, you’ll need to install Sysprep to VMware if you intend to clone or convert Windows-based virtual machines. Each release of Windows (including service packs) requires its own version of Sysprep; you can find the appropriate files on the operating system CD/DVD or on the Microsoft Download Center website. Find and double-click deploy.cab, and then extract the contents of the compressed file to the following location:  %allusersprofile%\vmware\vmware virtualcenter\sysprep
If you’re running Windows Server 2003 or below, extract the contents to: %allusersprofile%\application data\vmware\vmware virtualcenter\sysprep
There are also a few things to keep in mind before you create your source virtual machine (the virtual machine on which the template will be based). Components like Active Directory and Microsoft SQL Server should be excluded from the template, as these can interfere with the template creation process or cause problems after the fact. Also, if you’re running VMware Infrastructure 3.5 or later, you can perform a hot clone of a virtual machine using the Clone to Template method. Hot cloning enables you to keep the source VM active during the cloning and conversion process.
Once you’ve installed Sysprep and created the source virtual machine, you can begin building templates.

Creating a Template with Clone to Template

1. Right-click the source virtual machine. Point to “Template,” then select “Clone to Template” from the context menu.

2. Create a name for the template and then choose an Inventory location from the folder list. Click “Next.”

3. Select the ESX host or cluster where the template should be stored. Click “Next.”
4. Select a datastore with enough available space to accommodate the template. Click “Next.”
5. Click “Same as Source” to use the same disk format as the source VM; click “Thin Provisioned” to save space on the datastore; click “Thick” to reserve all of the datastore space for the virtual hard disk. If you select “Thin Provisioned,” make sure to allocate the virtual disk to a VMFS3+ datastore. Click “Next.”

6. Review your selections on the Ready to Complete screen. Click “Finish” to create the new template in VMware vCenter Server.

Create a Template with Convert to Template

1. Power off the source VM. Right-click the virtual machine, and then point to “Template.”
2. Click “Convert to Template.” Select “Home.” Go to VMs and Templates view to locate the new template.

3. Right-click the template and then click “Convert to Virtual Machine” to return the template to its original state whenever necessary.
You can also create new templates from existing templates. Right-click the source template and then click “Clone” to begin the duplication process. The steps in the wizard are identical to those in Clone to Template.

Create a Virtual Machine from a Template

After you finish creating a template, you can run the Deploy Template Wizard to create a new virtual machine.
1. Switch to VM and Templates view. Right-click the template and select “Deploy Virtual Machine from This Template” from the context menu.
2. Name the virtual machine and select a folder location. Click “Next.”
3. Select the ESX host and/or cluster on which the VM will run. Click “Next.”
4. Choose which resource pool the new virtual machine will use. Click “Next.”
5. Select which datastore or datastores will accommodate the virtual machine. Click “Next.”
6. Choose the appropriate disk format and then click “Next.”
7. Click “Do Not Customize,” “Customize Using the Customization Wizard,” or “Customize Using an Existing Customization Specification,” depending on your preferences. You won’t see this screen if you didn’t load Sysprep into vCenter. If you selected the second or third option, follow the on-screen instructions to configure the template.
(Note: If the OS installed to the source virtual machine requires an OEM product code, select option two and then enter the information into the appropriate field when prompted.)

8. Click “Edit Virtual Hardware” to make changes to the VM configuration, if necessary. Click “Finish” to deploy the new virtual machine.

VMware Networking: Configuring and Troubleshooting a vNetwork Part 2

For the second half of the series, I’ll explain how to set up a distributed vNetwork (DVN) with VMware, and how to troubleshoot your vNetwork if problems occur. In part one, I discussed the basics of virtual networks, as well as how to create and configure a standard vNetwork.
Distributed virtual networks use a distributed virtual switch (DvSwitch) to manage data transmission between virtual machines and enable guest systems to connect to physical networks. As I explained in the last post, a DvSwitch works like a global switch; all of the hosts in a datacenter can connect to a single distributed switch. A DvSwitch also enables the use of private virtual local area networks (PVLANs), which divide VLAN domains into smaller sub-domains, enabling multiple hosts to use the same address space, but exist separately, or isolated, from one another.
Like standard virtual switches, distributed virtual switches provide virtual uplinks called distributed virtual uplinks (dvUplinks). Uplinks represent physical network adapters. When creating a DvSwitch, the virtualization platform finds the maximum number of uplinks associated with a host and uses that number as a basis when setting up the dvUplinks on the switch.
DvSwitches offer more ports than do standard virtual switches; the former offers up to 6,000, compared to the latter, which provides up to 4,088. A maximum of 64 hosts can connect to a single DvSwitch and up to 16 distributed switches can be implemented per host.
DvSwitches are stored to the VMkernel, but the settings linked to the DvSwitch are contained in the vCenter database. Therefore, to create a distributed switch in VMware, you must have vCenter installed.

Creating a Distributed Virtual Switch

1. In vCenter, select “Home” and then “Networking.” Click the datacenter on which the host or hosts reside.
2. Select from the toolbar the icon to launch the Create vNetwork Distributed Switch wizard. Name the vNetwork. Click “Next.”

3. Select each host to associate with the DvSwitch, and then select which network adapters to use with each ESX/ESXi host. Choose multiple network adapters to create uplink groups and provide load balancing and fault tolerance to a host. Make sure to select the correct network adapters during the creation process, as reassigning the adapters is not a simple process. Click “Next.”

4. Click “Finish” to create the DvSwitch in vCenter.

Configuring DvSwitches and Port Groups

DvSwitches and vSwitches share most of the same options, but distributed switches offer a little bit more control over the operation of the vNetwork. To access the settings, right-click the virtual switch and then select “Edit Settings” from the context menu.
On the General tab are options to change the name of the switch and the number of dvUplinks connected to the vNetwork. On the Advanced tab are options to increase or decrease the maximum transmission unit (MTU), which limits packet size, and enable Cisco Discovery Protocol. In later versions of vSphere, you can also set up features like NetFlow, which analyzes network communications transmitted between virtual machines and physical networks; or port mirroring, which copies packets from one port to another for monitoring purposes.

To configure the port group, right-click it and then click “Edit Settings.” Most of the options match those described in the previous article, with a few exceptions:
General

• Static Binding: Adheres a virtual machine to a port on the DvSwitch that remains active even when the machine is powered off
• Dynamic Binding: Assigns a port to a virtual machine at the time the machine is powered on
• Ephemeral: Allocates a port to a virtual machine when powered on. If the machine reboots, it loses its old port and is assigned a new one

Advanced

• Override Port Policies: Overrides the settings associated with the dvUplinks
• Live Port Moving: Transfer stand-alone port groups to distributed port groups, assigning settings associated with distributed port group to the stand-alone group
• Configure Reset at Disconnect: Port settings are reset when a port is disconnected from a virtual machine
• Port Name Format: Changes the naming convention of a port group

Troubleshooting a vSwitch or DvSwitch

Under ideal circumstances, the vNetwork will work as intended after creating and configuring the virtual switches and port groups — but certain settings can interfere with how the virtual network functions.
A virtual machine uses a port group to communicate across a network. Port groups are associated with a parent switch, so if a machine’s virtual network adapter is not assigned the correct port group, it might not link to the correct distributed or standard switch, either. Furthermore, port group names are case-sensitive, so a group named “Test,” for example, is not the same as a group named “test.”
To confirm that a virtual machine is connected to the correct port group, right-click the virtual machine and then select “Edit Settings” from the context menu. Select the appropriate port group from the drop-down menu.

While in Virtual Machine Properties, also confirm that “Connected” and “Connect at Power On” are checked under the Device Status heading. Click “OK.” Restart the virtual machine or network services if the machine has not been assigned a static IP.
If the settings for the virtual machine are correct, move on to checking the vNetwork settings for the host. Click the Configuration tab after selecting the appropriate ESX/ESXi host and then select the Networking link.
Choose “Virtual Switch” or “Distributed Virtual Switch” from the menu. Click the call-out icon for the correct switch or port group and review the settings shown in the dialog box to confirm that the network configuration is correct.
If you detected a problem with the settings, click the Properties link to make changes to the vSwitch. If you’re working with a distributed switch, follow the instructions in the above sections to change the switch’s properties. To learn more about the options available on these screens, go to the first part of this series and view “Configuring Port vSwitches and Port Groups.”
If you’re working with a vSwitch, make sure that the port group is using the original name assigned to it upon creation. If you’ve changed the name of the port group, you must edit the properties of every virtual machine originally connected to it and select the new name from the drop-down menu under Network Connection.
If your switches and port groups are all in order, the next things to check are the network adapters. If working with a standard switch, select the Network Adapters tab from the vSwitch properties window. If working with a DvSwitch, select “Manage Physical Adapters” from the Networking screen.
Confirm that the adapter is using the correct speed and duplex. If the adapter settings don’t match that of a network component or client, performance or connectivity issues can occur. Click “Edit” to change the adapter settings.

VMware Networking: Configuring and Troubleshooting a vNetwork Part 1

The term vNetwork refers to the technologies that VMware vSphere utilizes to integrate networking and input/output functions on an ESX/ESXi host. vSphere includes a number of features and enhancements to provide administrators thorough control over networking processes and make management of these processes simpler.
Implementing a vNetwork in ESX or ESXi is essential for enabling virtual machines to communicate with one another within a networking environment — but establishing a vNetwork on a host can be a difficult and complicated process if you don’t understand how virtual networking works in vSphere.
A virtual network is made up of virtual machines that run on a single, physical machine and transmit data to and from one another. In vSphere, a virtual switch is called a vSwitch. Virtual machines connect to the virtual ports that make up the vSwitch to create a vNetwork. The vSwitch then routes network traffic between the connected virtual machines. vSwitches can also use physical network adapters, or uplink adapters, to connect to a physical switch and associate the virtual network with a physical network.
In vSphere 4, VMware introduced an enhancement to vNetworks: the distributed virtual switch, or DvSwitch. A DvSwitch acts like a global switch, enabling administrators to associate a single switch with all ESX or ESXi hosts in a datacenter, rather than configure a vSwitch for each individual host.
vSphere separates vSwitches and DvSwitches into smaller groups called port groups. VMware uses port groups to connect virtual machines to a switch and define settings like traffic shaping, NIC teaming, load balancing, and other parameters.

Creating Standard Switches

In vSphere, vSwitches can be mapped to one network adapter or to multiple network adapters. vSwitches that have no associated network adapters can also be implemented as well.
A standard switch that has no associated adapters is called an internal vSwitch. Virtual machines connected to an internal vSwitch cannot communicate with other virtual machines outside of the host. These switches can be used to test virtual machines before mapping them to a production network. A vSwitch that is associated with two or more adapters is called a teamed vSwitch; these switches provide an added layer of protection to a network and are used for fault tolerance and load balancing.
A vSwitch starts out with 56 ports, by default, but can be configured to use up to 4,088 ports, and up to 20 network adapters can be associated with a host.
To create a standard switch in vSphere, follow the instructions below:
1. In vSphere, select the ESX or ESXi host. Click “Configuration.” Select “Networking” from the Hardware box. Click “Add Networking” to run the Add Network Wizard.

2. Select “Virtual Machine” and then click “Next.”

3. Select each network adapter to associate with the vSwitch. To create an internal vSwitch, make sure that all network adapters are deselected.

4. Create a unique name for the port group. Names are case-sensitive. (A couple things to keep mind when naming port groups: one, if the names aren’t consistent from host to host, problems will occur when migrating virtual machines or using VMotion; two, while it’s possible to rename a port group after-the-fact, virtual machines that were connected to that port group will disassociate with the switch. Therefore, to avoid potential complications, it’s best to keep track of port group names and follow a standardized naming convention.)

5. Click “Finish” to create a standard vNetwork.

Configuring vSwitches and Port Groups

After creating a vNetwork in vSphere, you can modify the vSwitch to add additional ports and change network parameters.

Add Port Groups

As I mentioned in “Creating Standard Switches,” vSwitches start out with 56 ports, but administrators can increase the port number up to 4,088. Increasing the number of ports per vSwitch is not recommended unless the operating environment requires it, as the ESX/ESXi host must be restarted after the change, and upping the port number requires additional overhead that will lead to wasted resources.
To increase the number of ports per switch:
1. Select the host and then click the Configuration tab. Click “Networking” from the Hardware box.
2. Select the Properties link. Click “vSwitch.” Click “Edit.”
3. Choose from the drop-down menu the number of ports to use with the standard switch. Click “OK.”

Set Network Policies

You can change the parameters of a vSwitch to apply global policies to the vNetwork. Port groups feature options similar to those available to switches and can be used to add greater flexibility to a virtual network, as the settings associated with the port group can act as exceptions to the global policies. You can access the network settings using the same method as described in the section above.
I’ll provide a brief overview of the options you’ll find on each tab:

Security

• Promiscuous Mode: Enables a network adapter to retrieve and read all network traffic. Used for packet sniffing to troubleshoot and diagnose network issues.
• MAC Address Changes: Allows the virtual MAC address associated with a virtual machine to be changed. Used to create cluster addresses for services like Network Load Balancing, used by Windows Server.
• Forged Transmits: Enables a virtual machine to transmit network traffic even if the MAC address on the guest operating system doesn’t match the MAC address stored to the .vmx file (the file that holds the virtual machine’s configuration information).

Traffic Shaping

Traffic shaping is used to control bandwidth on a vNetwork. Traffic shaping focuses on outbound traffic sent from a virtual machine to the physical network; it doesn’t interfere with inbound traffic. The vast majority of administrators will never need to use this feature, particularly because traffic shaping in the vSphere environment is not dynamic and can hinder network performance.

NIC Teaming

NIC Teaming is used for fault tolerance; you can configure standby adapters to take over when the primary adapter fails.

• Load Balancing: Configures how outgoing traffic is handled across multiple network adapters in a teamed vSwitch.
• Network Failover Detection: Specifies how the host detects network failure.
• Notify Switches: Tells the physical switches to route network traffic from virtual machines to different physical network adapters.
• Failback: Specifies how the failed adapter should operate if it comes online again.

That’s it for configuring standard switches in vSphere. In part two, I’ll explain how to set up a vNetwork that runs on a distributed switch, and how to troubleshoot your vNetwork if problems occur.

Top 5 Most Common VMware Compatibility Issues (and How to Work Around Them)

If a computer is not equipped with the hardware required to run a specific version of VMware ESX or ESXi, a number of errors can occur during or after the installation process. If a machine lacks a compatible BIOS or CPU — equipment central to the operation of the system, in other words — setup will usually fail to initialize or complete. Sometimes, however, the hardware configuration is just enough to get the hypervisor up and running — and that’s where most of the problems occur. Incompatibilities can cause hardware to stop operating or fail to respond, produce error messages when booting a host or virtual machine, and result in poor performance when running VMware vCenter Server or accessing a datastore or virtual network.
Before installing or upgrading to a version of ESX or ESXi, it’s important to confirm that the hardware of the target system is compatible with the hypervisor. Even if a previous version of ESX/ESXi works with the machine, that doesn’t mean a more recent version will work just as well. Review the minimum requirements to confirm that your hardware is supported.
Some hardware issues can be worked around, however, and some errors that seem hardware-related are instead caused simply by misconfigured settings. Below is a list of common compatibility errors or issues you might encounter after installing the hypervisor, configuring resources, or creating a virtual machine, as well as solutions for resolving these problems.

Datastores

ESX/ESXi 4.0 does not support LUNs larger than 2TB in size. If the size of a LUN surpasses 2TB, the host will fail to assign block devices, or storage resources, to the LUN, and prevent VMware from creating a datastore on the device.
You can use extents to work around this limitation. An extent is a partition on a LUN. A datastore can consist of up to 32 extents. Since each LUN is limited to 2TB in size, and a datastore can utilize 32 extents in total, volumes of up to 64TB in size are possible in VMware. In other words, if you need a datastore to be larger than 2TBs, spread the datastore across multiple LUNs to expand the size of the volume.
To expand a datastore in VMware:
1. Select the target host. Click “Configuration” and then select “Storage” from the Hardware pane.

2. Right-click the target datastore and then click “Properties.” Click “Increase.”

3. Select the appropriate LUN from the options and then click “Next.” To create a new extent, select a LUN marked as un-expandable (listed as “No” under the “Expandable” category); to increase the size of an extent, select a LUN marked as expandable. Select the appropriate disk layout and then click “Next.”

4. Check “Maximize Capacity” to use all available disk space, or enter the desired amount in the applicable field. Click “Next.”
5. Review your options on the summary screen and then click “Finish.”

Central Processing Unit

While older versions of the hypervisor, such as ESX/ESXi 3.5, can run without issue on 32-bit processors, ESX/ESXi 4.0 and ESXi 5.0 both require 64-bit CPUs. ESXi 5.0 has additional hardware requirements above what ESX 4.0 and ESXi 4.0 require, as well: the latest version of the hypervisor must run off, at minimum, a dual-core CPU that supports SAHF and LAHF (instructions that control which flags are loaded into the upper half of the AX register, the latter of which is used to gather the results from arithmetic and logic calculations). Chip manufacturers didn’t begin integrating SAHF and LAHF into the 64-bit instruction set until 2005, however, so even if you’re running a 64-bit multi-core CPU, it still might not work with ESXi 5.0. If the CPU isn’t compatible with the hypervisor, installing/upgrading ESX/ESXi will fail.
Even if the host is able to run off the processor, however, certain virtual machines might not. As to be expected, a 64-bit guest operating system utilizes a 64-bit CPU. However, just having a processor with a 64-bit instruction set isn’t enough to run a 64-bit virtual machine; the CPU also must have virtualization technology enabled.
If VT is disabled, the following error is likely to appear when attempting to run a 64-bit guest OS in VMware: “Host CPU is incompatible with the virtual machine’s requirements at CPUID level.” Enabling Intel VT-x or AMD-V in the BIOS should resolve the above error, allowing the virtual machine to boot. Since the BIOS varies based on the make and model of the motherboard or computer, consult the documentation for your machine to determine how to enable virtualization technology.

Optical Drive

When performing a cold migration, the error “Incompatible device backing specified for device” will appear if the optical disc drive is misconfigured. To reconfigure the drive in vSphere:
1. Right-click the virtual machine and then click “Edit Settings.”

2. Select the CD- or DVD-ROM from the Hardware tab. Choose “Client Device” as the device type and then click “OK.”

If the above steps fail to resolve the error, check the VMX file associated with the virtual machine to see if the optical device is connected in the configuration data. If the file indicates that the optical device is connected, remove and then re-add the CD- or DVD-ROM from the same window.

TEAC DV-28 series DVD-ROM drives can also cause, at random, an ESX or ESXi 4.0 host to stop responding in vCenter Server or refuse connections from VMware vSphere. While certain models are incompatible with ESX/ESXi altogether, upgrading the outdated firmware on some devices will resolve the issue and restore function to the host. (Some manufacturers, such as Dell, provide firmware flash upgrades for certain TEAC DV-28 series models.)

Virtual Disks

When attempting to run a virtual machine created in another VMware virtualization platform, such as VMware Workstation, the VM will fail to start and the message “Unsupported and/or invalid disk type” will appear. This error occurs because the virtual disk formats associated with the different virtualization platforms are incompatible with ESX/ESXi.
You can use VMware vCenter Converter to convert the disk and import the virtual machine into vSphere. This is a called a cold migration in ESXi (V2V).
Running the following command from the server console will also convert the virtual disk to a format that ESX/ESXi can understand:

vmkfstools -i <original file>.vmdk <new file>.vmdk

Networking

VMware vSphere can run virtual standard switches (vSwitches), which apply to a single host, or virtual distributed switches (vDS), which span across multiple hosts. If the license is incompatible with the vDS feature, vCenter Server will fail when creating a distributed switch. To work around this error in vSphere 5, you must upgrade each host to the Enterprise Plus license.

Conclusions

It’s important to keep in mind although there are workarounds for some compatibility issues, if a critical hardware device isn’t supported by the hypervisor, there’s little recourse. For example, if the hypervisor requires a 64-bit CPU but your system only includes a 32-bit processor, you have no choice but to upgrade the hardware or stick with an older version of ESX/ESXi.

How to Protect Yourself from the “Flame” Virus

Recently, reports have been circulating that a virus, called “Flame,” has been infecting users in the Middle East, particularly Iran. This has led many to conclude it is the work of Israel’s engineers. Experts also suggest there is more evidence to suggest this including the links of this malware with previous malware targeting Iran. The official name for Flame is W32.Flamer because it targets 32bit Windows PC users.

The “Flame” Virus Looks to be the Work of Professionals

According to the USA Today, the reason for the suspicion existing about Israel being pinned as the culprit is that Iran has been particularly affected by it. This led Kaspersky Lab to conclude engineers in Israel should claim responsibility as there is distrust and animosity between the two nations.
Another virus launched last November, called Stuxnet, that targeted nuclear centrifuges in Iran and Flame. It shares a lot of similarity to Flame, according to reports. It has been speculated for quite a while now that engineers from Israel created Stuxnet.
The New York Times reported last November, the virus was precisely created to disrupt Iran’s nuclear program. It caused nuclear centrifuges to be sent out of control.
The Russian anti-virus company, Kaspersky Lab, also claims responsibility for the discovery of its existence, as reported by a company news brief. However, other anti-virus companies have also been analyzing it and trying to address its reach as well.
According to USA Today, a unit within Iran’s communication and information technology ministry claimed it has anti-virus software capable of identifying and removing it:
“Tehran has not said whether it lost any data to the virus, but a unit of the Iranian communications and information technology ministry said it had produced an anti-virus capable of identifying and removing Flame from its computers.”
When Israel’s Vice Premier Moshe Yaalon didn’t outright dismiss Israel’s responsibility for it when asked about its significance. This leads to further conclusion Israel’s hands were at work here.
“Israel is blessed with high technology, and we boast tools that open all sorts of opportunities for us,” he said.

What Makes “Flame” Stand Out Among Malware

Flame is particularly alarming in terms of the security concerns it poses for users on the recipient end of it. It really shows just how exposed anyone of us can be online if we do not take precautions. Examples of damage it can do include allowing its creators to take screenshots, log keystrokes, and even steal data from mobile devices via Bluetooth.
“It can be used to spy on everything that a user is doing,” said researcher Roel Schouwenberg in the USA Today report.
I recently spoke to the director of Norton’s Star Program, Kevin Haley, about the threat and what risks it poses for end users.
Besides its ability to spy on users; take screenshots of user activity and send it back for analysis; and steal files, it can also be improved upon or patched.
Haley said that its creators can write modules adding functionality to it over time. This means they do not have to create new malware but simply modify Flame for added functionality end threats.
“It was clearly built so it could be added upon again and again.”
He also pointed out its complexity when analyzing it and looking at its size. The actual file size is about 200MB, which makes it much larger in scope than most other malware. It also makes Flame harder to detect in many cases due to users thinking it is a legitimate application or program.
“It is like 20 times as large as Stuxnet. It is bigger and more modular, Haley said. “It is build like multiple people worked on it and didn’t know what other people were doing.”
What he meant by calling its engineering modular was that multiple groups of professional engineers were probably contracted to create it in different steps. Then their work was put together into what is now known as Flame.
Haley also indicated that in his opinion it probably took about 6 months to create and it will take Norton months to fully comprehend it. Norton has only been analyzing it for the last few days although there are indications it was around for at least two years in one shape or form.

A Disguised File

Haley said that its creators found clever ways to hide it inside systems it infects. Because of its large size, it may trick users into thinking it is harmless, but also in the way it runs on machines without showing indications of its approach.
“It tries to hide itself inside other applications to disguise itself,” he said. “It also hides itself inside another process inside the computer.
“If you weren’t examining it closely, you would think it is doing things that are harmless. It has functionality that normal programs have to make users think it is not doing anything not unique.”

Command-and-Control Server

The way its authors use Flame is through a command-and-control server (C&C). Its authors give it instructions through this structure to accomplish certain tasks.
“Typically once it gets on a machine it will report back to CMC server and wait for instructions,” haley said. “The author gives commands like show what documents they are and these are the ones I want you to copy.”
By the way, Symantec has provided further analysis of the virus in a blog posting on the company’s website titled “Painting a Picture of @32.Flamer.” This analysis points out that Flame is actually a whole platform and not just a file with a single function. It includes a Web server, a database server, and secure shell communications. It also includes a scripting editor.

How to Protect Yourself from the “Flame” Threat

What makes Flame such a threat is that it may have the potential of infecting users who have great firewalls or are not even connected online. Malware can, for instance, be infected from a USB drive.
However, Haley said that anyone with an updated version of Norton’s or Symantec’s anti-malware programs should be safe (these two product lines are linked to the same company, but Symantec is geared for enterprise users while Norton is geared for regular computing users). It should automatically detect and remove Flame. He even pointed out that competitor products are also able to remove it now. It is the users who are not protected that should make sure their system is safe.
Haley described how in 2011 alone there were over 400 million unique threats and he expects 2012 to show greater figures.
He thinks that a layered approach is needed with anti-virus software, firewalls, and other tools. He described one of these tools, which Norton uses, as the intrusion prevention systems (IPS).
“IPS intrusion prevention systems looks for patterns in network traffic,” Haley said. “It will detect malware unlike firewall that just blocks it.”
Despite Haley’s enthusiasm for anti-virus software being able to remove it, keep in mind that he did also say its creators have the ability to modify it and add functionality to it. Take that as you will, but it may mean that it still can pose a danger to any user.

Conclusion

Viruses like Flame show the challenges users and companies face every day when targeted by calculating and skillful threats. However, do not expect the average hacker to be able to create something this sophisticated. A group like Anonymous may have the potential over time so do not rule the idea out. However, this was most likely the work of engineers being hired full time to work on it over a period of numerous months as Haley pointed out.

Installing WordPress on IIS7 – Part 2

Now that we’ve installed and setup a WordPress blog on IIS 7 let’s get into the details and enhance it a bit.
First we’ll set up search engine friendly URLs for our WordPress on IIS 7 to increase SEO. Then we’ll learn how to take advantage of the many WordPress plugins. And finally I’ll talk about setting up IIS Authentication for our WordPress site.
If you missed it, here’s Part 1 of Installing WordPress on IIS 7.

Search Engine Friendly URLs for WordPress on IIS7

Now if you’re interested in getting free and highly targeted traffic to your website, you can’t do much better than the search engines. As of this writing most search engines put a good deal of weight on having friendly URLs that include what the page is about.
For example, in our current install if you click on the default post you will notice that the url is:

http://domainname/?p=1

This doesn’t really tell the search engines anything about the page so they will not use it in their ranking weight. Now what if this was changed to something like:

http://domainname/hello-world

The search engines would accord more ranking weight for the keywords "Hello World" that are in the url. This is the reason I had you install the URL Rewrite module, because there is a little code you can include to help make the URLs friendly to both search engines and users.
1. Browse to the directory you have installed WordPress in and create/open the web.config file in Notepad.

2. Now navigate to the <System.Webserver> element and copy the code below into it and save it.
<rewrite>
          <rules>
                   <rule name="Main Rule" stopProcessing="true">
                   <match url=".*" />
                   <conditions logicalGrouping="MatchAll">
                   <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                   <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                   </conditions>
                   <action type="Rewrite" url="index.php" />
                   </rule>
          </rules>
</rewrite>
NOTE: Your web.config file might look very different from mine due to any other options that are installed on your server. The main thing is, if you already have a <rewrite> section then place the rules within that, if you don’t then just put in the whole section below anywhere between <System.Webserver> </System.Webserver>

3. Now in your WordPress dashboard go ahead and click on Settings in the top right

4. Now click Permalinks across the middle of the screen

5. Under Common Settings go down to Custom Structure and place the following in the text field:
/%postname%/
If you want to put other variables into the url structure you can find a full list at:
http://codex.wordpress.org/Using_Permalinks under Structure Tags
After you configure your structure click on Save Changes.

6. Now let’s go back to our site home page and click on the default post, you will now see that the url is now http://domainname.com/hello-world/

That’s it, using this will almost certainly increase your search engine visibility along with making your post URLs easier to remember for average users.

WordPress Plugins

One of the best things about WordPress and why it has become so popular is that it allows for great flexibility by allowing the use of plugins. Plugins are at the heart of WordPress’s extensibility because they are for the most part written by the user community. This means that when someone needs some kind of functionality more than likely someone else has needed it and written a plug-in for it.
While I cannot cover all the plugins out there, let me mention some tips if you have any problems with using them on your site. If you try a plugin and have issues take a quick look at the following:

• PHP extension needed – if you kept your PHP installation lean you might not have all the extensions needed and configured. Make sure that you review the requirements for the plug-in and you have the extension loaded.
• File permissions – watch the permissions in the directory that the plug-in is installed.

Here’s where you can learn more about plugins: http://codex.wordpress.org/Plugins
And here’s where you can search the 3,000+ WordPress plugins: http://wordpress.org/extend/plugins/

IIS Authentication for WordPress

WordPress uses its own users and rights system, but there might be a situation where you want to use IIS authentication instead to seamlessly integrating the WordPress blog with the rest of a site. While this is very site specific and I will not go into detail here on how to do it, Mike Volodarsky has a great write-up on it using a plug-in that he wrote.
You can find that information on his site: IIS 7.0 Server-Side.

Summary

You have now installed and configured WordPress on IIS7 and even changed the URL structure to a custom one that will help you grow your blog through increased search engine traffic. Now go look through some plugins and start adding content to your site!

Installing WordPress on IIS 7 – Part 1

In the past few weeks I have been writing a lot about using open source software such as PHP and MySQL on IIS7 to get you ready for today. This article will take the knowledge and experience of those articles and apply them to install one of the most popular open source blogging and CMS software products: WordPress.
WordPress is always being updated but for this article we will be using the 2.6 version. A word about the versions, this article should stay applicable through the usual feature updates, if there is a major code overhaul there might be issues, but as long as you are in 2.x fork you should be good following this article.

WordPress Requirements

As I said, my earlier articles were in preparation for this article so if you have not already done so please go back and follow these earlier articles to make sure your IIS7 server is ready for WordPress.

• Install PHP on Server 2008
• Install MySQL on Server 2008
• Install URL Rewrite Extension on IIS7

Now with those applications and module installed we are ready to move forward!

Download WordPress

Now that we are going to install WordPress let’s download the files and get them on the server. You can either FTP these up to your server or as I am going to do, just download them directly from the server.
You can get the latest files here: http://www.wordpress.org/download. You should see a big download button on the top of the right column, go ahead and start the download.
WordPress is famous for the 5-minute install, which normally is quite correct for Apache servers. Our install might take a little longer, but shouldn’t be too bad.
Now that you have downloaded the files, go ahead and unzip/FTP them to the site directory on the server.
I am going to be installing this under a local domain called wordpresstestinstall.com that is setup to resolve locally for my server. The physical path of the directory is under the directory structure specified in the php.ini.
NOTE: This is a biggie, back in the Install PHP article there was a section that had you modify the php.ini with the top most level of the directory structure that PHP would function within. You MUST have this WordPress install under that directory structure for it to function.

Configure MySQL for WordPress

Now, we have to setup a MySQL database for WordPress to use. There are several ways to do this, especially if you used my Install phpMyAdmin article, you can use that or you can use the MySQL command line interface.
I will actually walk you through both, we will start with phpMyAdmin, but if you want to use the command line sequence instead skip this next section.

Setup MySQL Database with phpMyAdmin

If you read my earlier articles then you know that phpMyAdmin can be used to create and manage MySQL databases in a somewhat easy to use GUI. If you have installed phpMyAdmin let’s go ahead and use that first, by opening it in your web browser.
1. First login with your MySQL username and password.
Unless you have setup other high level users this will almost certainly have the username of root and whatever password you used to install MySQL then hit Go.

2. On this page you can type the name of the database into the field under Create new database.
For this demo I am just going to use wordpress, but you may want to use something a little less generic. After typing in the name, click on Create.

3. Now we are going to create a user for the wordpress database, go ahead and click Privileges

4. Now click on Add a new User

5. Now fill in the details for your new user. For my demo I am using the following information:
User name: wpuser
Host: Any host
Password: password
re-type: password
The rest of the settings I am going to leave at the default and then click Go at the bottom of the screen.

6. After creation scroll down to the section Database-specific privileges and in the dropdown choose the database you created earlier. In this instance it is wordpress.
Once you scroll down you will see the page load up all the possible privileges for that database. Since I want this user to have full rights on this database I am going to select Check All and then click Go.

7. Ok that’s it, you should now have the following information available for your WordPress install:
Database Name: wordpress
Database User: wpuser
DB User Password: password

Use MySQL Command Line Interface

This section is only if you didn’t use the phpMyAdmin interface to setup your MySQL database. We are going to setup the exact same database as before — just without phpMyAdmin.
1. Go to the start menu and open up the MySQL program folder and click on MySQL Command Line Client

2. You will need to enter the root password and hit Enter

3. At the prompt type in: CREATE DATABASE wordpress; then hit Enter.

4. Now we will create and assign the user:
GRANT ALL PRIVILEGES ON databasename.* TO "wpuser"@"localhost"
IDENTIFIED BY "password";
then hit Enter
Note: To go to a second line just hit Enter without a ";" at the end of a line. The ";" signals the end of the command.

5. Now type the following:
FLUSH PRIVILEGES;
then hit Enter
6. Type Exit
7. Ok that’s it, you should now have the following information available for your WordPress install:
Database Name: wordpress
Database User: wpuser
DB User Password: password

Run the WordPress Install Script

Ok the moment of truth is upon us. First we are going to modify the wp-config-sample.php file with some information.
1. Navigate to the directory you placed your files and find the file named wp-config-sample.php and open it with Notepad.

2. You need to modify the following fields in the file. Please note I am using my values in the screenshot, replace them with your specific information.
DB_NAME: wordpress
DB_USER: wpuser
DB_PASSWORD: password
In the next section replace ‘put your unique phrase here’ with a different random phase for each, you don’t have to remember them so just make it up.

3. Save the file as wp-config.php
4. Type in the following to start the script replacing wordpresstestinstall.com with your domain.
http://wordpresstestinstall.com/wp-admin/install.php
You will find that the WordPress welcome screen is now shown. You can now configure the following — use your own info:
Blog Title: WordPress Test Install
Your E-mail: email
Click Install WordPress after you are done.

5. You should now see a screen that says Success! with your username (always admin) and a random password you can change later.
Make sure you write down or copy the password. There is also a small button at the bottom that says Log In, go ahead and click that button.

6. You will now be asked for your username and password that was given on the last page (I told you to write it down). So fill those in and click Log In

7. Now if you login and see a 403 error screen, more than likely it means your default document isn’t setup for index.php in IIS Manager.
If you are seeing the WordPress dashboard, then skip to the next step. For those that need to, do the following:

1. Open IIS Manager
2. Click on the site you are working with
3. In the center content area click on Default Documents
4. Once in Default Documents click on Add… in the right pane
5. In the Add Default Document Box type Index.php
6. Click OK
7. Close IIS Manager
8. Refresh your browser or login again to http://domainname.com/wp-admin/

8. Congratulations, you should now be in the WordPress Dashboard! You can also click the little button that says Visit Site and you will see the default post and theme loaded on your site.

Installing WordPress on IIS 7 – Part 2

Ok, now we have a WordPress blog setup and running on IIS7, with the core basic functionality. In my next article we’ll go a little further and enhance it a bit. In Installing WordPress on IIS 7 – Part 2 I’ll show you how to:

• Set up search engine friendly URLs for WordPress on IIS7 to increase your SEO
• Take advantage of the many WordPress plugins
• Set up IIS Authentication for WordPress

How to Configure and Manage OWA on Exchange Server 2007

Mobile messaging has become widely used since the release of Exchange Server 2003 Service Pack 2 (SP2), which provided much needed functionality. SP2 has been able to offer remote access users much of the same functionality as users working within the network.
Outlook Web Access (OWA) provides remote users access to their messaging system via any compliant web browser, making mobile messaging universally accessible to any user with a browser enabled device.


The release of Outlook Web Access 2007 further increases the functions available to the remote user, including:

• Out of office messaging
• Scheduling assistant
• Access to SharePoint documents within the browser
• Web-ready document viewing within the browser
• Access to managed e-mail folders
• Voice and fax access via UM
• Search access to GAL
• Access to RSS feeds

Configuration and Management Tools

OWA is made available via the Exchange Server, deployed in the client access server role. There are five tools available to manage and configure OWA:

• the Exchange Management Console graphic interface
• the IIS Manager
• direct registry configuration settings using the Registry Editor
• the Outlook Web Access Web Administration tool
• the Exchange Management Shell which provides command line and automated plug-ins

Some settings are only configurable via certain tools; settings, such as the PublicClientTimeout, TrustedClientTimeout, and SSLOffloaded values can only be configured by using the Registry Editor.

Configuring the Virtual Directories

When you install the client server access role on the Exchange Server, four default virtual directories are created to be used by Outlook Web Access. The directories are:

• /owa – which is used for mailbox access
• /Public – used to access public folders
• /Exchange – used to access mailboxes and provide backwards compatibility
• /Exadmin – which provides access for administrative settings and properties

These directories are usually sufficient for most deployments, but you can create additional virtual directories if you require them using the New-OWAVirtualDirectory command. Note that the forms based auth and secure socket layer encryption enabled by default in the /owa virtual directory will not apply to the new directory and these security services must be enabled manually.

Simplifying the OWA URL

Users like simplicity and simplicity reduces the need for tech support from the IT helpdesk. The URL that users use to access their mailbox via OWA can be simplified using the IIS manager. The process simply employs an http redirect and you can also set the IIS web page to automatically send the user to the secure http URL.
Simply create the html redirect code to URL=https://servername/exchange, open the IIS manager and program the redirect in the properties of the default web site.

Modifying Attachment Handling Settings

A new service introduced in Exchange Server 2007 is Web Ready Document Viewing, which allows users accessing the messaging servers via OWA to view certain types of common documents rendered within the browser.
The document types include Word, PDF, Excel and PowerPoint. You can use either the Exchange Management Console or the Set-OwaVirtualDirectory command under the manager shell. In the console, the settings are located under Web Ready Document Viewing settings under the OWA properties in the server properties Client Access settings.
Public and private file access can be configured to either allow access, block access, or force save the file to the client’s device before viewing. All attached files with either a default or a known file extension, are by default set to one of these three options.
You can also choose one of the options for unkown file extensions. Again, you can either use the Exchange Management Console or the Set-OwaVirtualDirectory command under the manager shell.
In the console you can set the file name extensions in the allow, block or force save list under the Direct File Access settings page. To modify the list you must select Customize direct file access and Direct file access must be enabled. There are two sets of settings, one for public file access and one for private file access.
Available only in Outlook Web Access Premium client, SharePoint and Windows File Share (UNC) integration provides read-only access to documents. Administrators can configure OWA to allow or block access on individual servers, allow or block access from private or public computers, create a list of remote servers to be treated as internal (only documents on internal host can be accessed via OWA), and allow or block access using segmentation.
To set access to individual servers simply add the host name to the block or allow list under Remote File Servers in the OWA configuration settings. You can also use the Set-OwaVirtualDirectory command in the manager shell.
To allow or block private or public computers, enable or disable the Windows SharePoint Services or Windows File Shares under the OWA setting. You can also enable or disable via the command shell using the Set-OwaVirtualDirectory command.
To add a domain suffix to be treated as internal, simply add the suffix to the list of domain suffixes to be treated as internal under the Remote File Server tab in OWA settings. To set access to individual virtual directories or to individual users you must use the command shell commands Set-OwaVirtualDirectory and Set-CASMailbox respectively.
Other configuration and management tasks for OWA include: configuring authentication methods, modifying language and character handling settings, configuring Gzip compression settings and disabling Web Beacons.
But we’ll save these for another time …

Top 10 New Features in Exchange Server 2010

It’s difficult to read any technical journal or website today without finding stories on cloud computing. In an effort to reduce costs and network complexity, some organizations are opting to move at least some software or services to the cloud.
In response to this need, Microsoft released the first new version of Microsoft Exchange since 2006.
Exchange 2010 has a lot to offer including more flexibility, a better user experience, simplified administration, and much more.

What’s New in Microsoft Exchange Server 2010

Exchange has been known for its extensive feature list, including: email, calendars, contacts, and storage management.
With the 2010 update, they have addressed a few long standing issues and included additional functionality to help solve a crop of new, modern business problems.
The benefits? Unification, lowered costs, higher availability, and improved security.
Let’s review the top 10 new features.

1. Webmail

The new outlook web access (OWA) webmail client allows for delegation of administrative tasks. It also includes updated self-help options, intended to reduce help desk calls and ultimately, costs.
The Exchange Control Panel allows users to set their own email rule-set, create distribution groups, and track message delivery. And, if you lose your phone, you can remote wipe from your browser.
Another import feature is the inclusion of support for Firefox and Safari as well as Internet Explorer.

2. Legal Hold

By now, most corporate employees are aware that email should not be considered private. In fact, email has been subpoenaed for court cases.
But corporate policies that outline conflicting message retention dictates make balancing legal requirements against increasing storage costs, a challenge. In response, Exchange now has a legal hold feature that allows for the retention of email, even if archived or deleted.

3. Multi-Mailbox Search

As a tie-in to the legal hold feature, the multi-mailbox search function will allow for searches spanning multiple users’ inboxes. This feature will prove useful for enterprises that need to search their entire systems, perhaps based off a few keywords.

4. Exchange Control Panel

The Exchange Management Console and Exchange Management Shell have been joined by the Exchange Control Panel. This is a new, user-level and administrator management tool that lets users perform basic tasks, and allows admins to perform tasks remotely, using a web interface.
The more an end user is able to accomplish with help desk intervention, should translate to lower costs.

5. Database Availability Groups

Exchange 2010 introduces the concept of database availability groups. The idea is to allow you to designate multiple servers to host copies of individual databases. This is a feature designed to provide for a type of automatic backup. If one database fails, data can easily be restored from one of the availability groups.
This will definitely prove to be an essential tool for business critical email.

6. Database-Level Failover

In previous Exchange versions, a failure would affect an entire cluster. But with the 2010 update, a database failure will be contained to only that database.

7. Voice Mail Transcription

Instead of storing email messages only as sometimes difficult to access attachments, Exchange 2010 now has a speech recognition engine that will automatically transcribe voice mail messages.
The message will still appear as an attachment, which will allow for indexing, but will include a written text preview of the message.

8. Call answering rules

At some point, we’ve all encountered an automated attendant, directing us to press an option on our keypads to handle call routing. This nifty feature has found its way to the end user.
Call Answering Rules allows employees to setup their own call routing rules. For instance, they can send certain calls to voice mail, to their cell or home phones, or to ring through to their desks.

9. Personal Archive

Users in this version of Exchange have a new tool to help manage often unruly inboxes.
Personal archive allows for essentially two mailboxes — a primary mailbox and an archive mailbox. The archive is as readily available and easily browsed as the primary inbox.

10. Retention Policies

With the new retention policies in Exchange 2010, users can determine when messages should expire. This can be done at the folder or individual message level.
Permissions can be tricky and determining resources access requirements can be a time-consuming activity. However, using role-based access control greatly simplifies this process.
Rather than assigning permissions, an administrator can indicate tasks that a resource will perform. The appropriate permissions will then be assigned automatically.

Try Exchange Server 2010

If you think this sounds like an impressive feature list, you’re not alone. An Azaleos survey finds that 44% of enterprises plan to migrate to Exchange Server 2010 within 18 months. Which means that you must be ready for Exchange 2010 if you want to be a part of the action.
Microsoft is providing you with three ways to try Exchange 2010 for free:

• 120 day software trial download
• 60 day web-based test drive
• 30 day online trial

Cloud Computing 101: Private vs Public Cloud

The “cloud” is a term with a debatable meaning. Even in the enterprise, surveys have revealed that there are some who have yet to develop a clear understanding of cloud computing. A recent survey by Virtacore Systems published in this CompTIA SmartBrief estimates that 48% of IT professionals at mid-sized companies don’t understand what the term actually means.
Perhaps some of the confusion comes from the fact that there are two types of clouds: public and private. Let’s take a closer look at what the main differences are between private and public clouds and later, what you should take into consideration when looking for a cloud computing provider.

Private vs Public Clouds

A public cloud is one in which a service provider serves customers, with functionality like applications, infrastructure, and storage. These services are available to businesses and individuals over the Internet. Public cloud services may be free or offered on a pay-per-usage model; sometimes it’s referred to with the -aaS acronym, meaning “as a Service” as in IaaS (Infrastructure as a Service), PaaS (Platform as a Service) and SaaS (Software as a Service). More on this here: What Cloud Computing Really Is.
This is a scalable service provided by a vendor, designed to be easier to setup and administer with less cost, in addition to reducing waste from lesser used data center resources.
The idea is to eliminate physical location from the data and system access equation. Data from several corporate or individual clients are segmented but do share server space — called, co-location.

The private cloud describes an internal computing model and architecture which provides hosted services similar to those of the public cloud, but reserved for corporate users and those that are approved; essentially, a private cloud is not open to the public and us usually setup behind a firewall. In a sense, this turns the IT department into the service provider or vendor for cloud resources. For those interested in reaping the benefits of virtualized cloud architecture, yet needing more control and security, this is a popular option.
Virtualization and data center automation allows for the scalability, maximizing hardware usage, and flexibility to support internal corporate clients. And, if your organization is so inclined, metering also allows you to charge departments based on their usage.

Top 5 Things to Look for In A Cloud Computing Provider

For many organizations, the benefits of the public cloud outweigh the risks. But before making a decision on shifting an application or service to the cloud, there are a few things to consider. The first question is whether or not the intended application is suitable for use in a cloud-based setting.
Assuming your application has been deemed a good candidate for the cloud, the second consideration is who to trust with your data.
So here are the top 5 things you should consider when selecting a public cloud vendor.

#1 Is the company viable?

Before handing over your critical applications and data, an important first step is to assess the financial viability of the company. Find out how long the company has been in business. Given the relative immaturity of this market, it may be unlikely to find vendors with several decades of presence, but you almost certainly don’t want a company that has just set up shop either. In addition, look for any indicators of past or future economic issues, along with frequent leadership changes.

#2 Are service level agreements offered?

For organizations entrusting mission critical data to a vendor, you’ll want to ensure that your systems will not suffer from frequent or extended outage periods. Downtime can have disastrous consequences both in terms of financial loss and damage to company reputation. For this reason, a service level agreement with negotiable terms, should be available. This agreement should outline provisions for everything from server or software issues, to more detailed disaster recovery plans.

#3 Is customer service a priority?

One guarantee with corporate networks is that something often can and will go wrong. In these instances, it is imperative that the vendor respond quickly, efficiently, and professionally. You should determine things like: response times, dedicated vs. general support, and phone/email/chat availability. Depending on the nature of the application that the vendor hosts, you may find that a dedicated support engineer, with 24×7 availability better suits your needs than calling a general help line and waiting in a call queue.

#4 Will my customers have the same level of performance?

Another issue cited with cloud services is the perceived negative performance impact. Customers and employees have an expectation that no matter where data is housed, they will enjoy the same level of performance. The cloud provider should be able to define how they measure performance and be able to provide real-time and ongoing measurements and statistics to back this up.

#5 How is security handled?

Perhaps the most frequent reason cited for not pursuing cloud computing is security. Many organizations have invested considerable financial and human resources in order to secure their network environments and the thought of abandoning that level of control and comfort to an unknown entity can seem like an unnecessary gamble. Any reputable vendor should be able to outline their security practices and modify them based on your requirements, particularly as it relates to any industry-specific regulatory requirements you have.

Summary

The decision to pursue cloud computing is one that many organization have or will make as this technology grows and matures. But this decision need not be one fraught with uncertainty. With a little due diligence, and answering a few key questions, you can ensure that your cloud vendor selection is a sound one.