Flip the switch from 'Broken' to 'Fixed'

The key to using KVM: ENABLE VIRTUALIZATION IN THE BIOS

In the words of the famous Homer Simpson- "Doh!"
After doing a bit more research and piecing together why I could boot into Windows, but then everything would come to grinding halt, it occured to me to check the BIOS to ensure that virtualization is enabled, as I was continuously getting an error when starting a VM: "Could not initialize KVM, will disable KVM support".

Seeing as my intel processor supports virtualization (egrep vmx --color=always /proc/cpuinfo), why wouldn't KVM start correctly? Furthermore, modprobe kvm-intel wouldn't load correctly.

After a couple of audible, "huh."s it occured to me to check the BIOS on the HP laptop to ensure CPU virtualization was enabled. SURPRISE! It wasn't. After enabling it in the BIOS and booting, and with a little more confidence, I ran into the same problem, "Could not initialize KVM, will disable KVM support." After a bit of Googling, I found that for whatever reason, a full shutdown and cold boot were necessary for the BIOS setting to take effect. Sure enough, after a reboot and starting my VM:


And with the -CDROM option pointing to my Windows 7 ISO, I made it past the infinite "setup is starting" page, and was able to install Windows 7:



As is usually the case, the issues experienced with KVM were due to user error rather than shoddy development.


So some tasks to complete to ensure that my work laptop will actually facilitate work:

• Ensure I can share files between my RHEL host and KVM guests
• Ensure that USB devices can be used on KVM guests
• Provide my work Windows 7 guest with enough disk space to accomodate all of my work documents

After a bit of consideration, I think my best approach will be to keep my guest OS on a different virtual disk image than my documents. That way I can keep a separate non-OS partition with all of my documents on it and boot my virtual disks with the -hdb option, thus allowing me to easily switch from Windows 7 to Windows XP guests.

Some links I found useful or potentially useful:
How to resize a libvirt image
QEMU Monitor Commands
QEMU USB Handling

RHEL 5 and KVM for Enterprise Notebook

So after finally successfully downloading and burning RHEL 5 Client x86_64 and obtaining a new hard drive for my notebook, I'm ready to install RHEL and test KVM.

The RHEL install was relatively painless, as Anaconda is an amazingly simple installation utility. Unfortunately, the first road bump I ran into was that the RHEL Client installation disk does not come with any virtualization package options (Xen, KVM, etc). No worries though, I was sure I could simply find the packages on the RedHat Network and push them down that way.

Small problem: RHEL didn't recognize my wireless card. After a quick lspci and some grepping:

lspci | grep wireless

I found my card and a nice step-by-step guide to install the necessary firmware to get it working.

After getting wireless up and running, I found that after registering my RH system, it did not appear in my RedHat systems on RHN, therefore I couldn't target packages to be automatically pushed to my laptop. After a bit of research on the RedHat Knowledgebase, I determined that this was because of the way my enterprise evaluation account was set up- my systems would be assigned to the Organization Administrator. Being the impatient person I am, I decided to just pull down the necessary packages manually instead of waiting for a response from my company's RHEL partner contact.

It was a bit of a tedious process, as I had to not only pull down the necessary RPMs, but also their dependencies. Anyone who's had experience working with RedHat, SuSE, or any other RPM-based distro before yum became available knows how frustrating it can be. I actually documented each package I had to pull down and listed them in the original version of this post, however Blogger didn't do a good job of saving the post, so that list has been lost in the series of tubes.

After pulling down all the packages I needed (apparently RHEL only officially supports up to version 83 of KVM) and checking the Guest Support Status, it looked as though I'd be good to go with virtualizing Windows Vista or 7 on KVM.

The first thing I tried was to convert the VMWare VMDK virtual image of my Windows Vista laptop into qemu's qcow2 format, as outlined in a link from my previous post. I quickly discovered, however, that RHEL does not natively support reading/writing to NTFS filesystems. What!? What is this, 1998? After a bit of Googling, I found this NTFS support in RHEL 5 blog post outlining the basic packages needed. One thing to note is that the dev package (kmdl) is not necessary and will generate a compile-time error if your kernel is not 2.6.18. I went ahead and just skipped installing it and was able to mount ntfs file systems fine. I figured I'd try configuring the automounter later, after I got my converted Vista image converted:

qemu-img convert Vista.vmdk -O qcow2 /home//virtual_machines/Vista.qcow2

The conversion appeared to complete successfully, however it did take a good bit of time (roughly 30 minutes).

kvm -hda Ubuntu-copy.qcow2 -net nic -net user -m 512

Upon attempting to boot this image, I received a blank screen with no indication of the guestOS trying to boot. After a couple more attempts, I did get the "Windows failed to start properly" menu and tried booting into safe mode, however this too failed. No sweat, there's a chance that my virtual image didn't convert well in the P2V, and I haven't yet tested it on VMWare, so I figured why not start from scratch with a brand new Windows 7 image?

qemu-kvm -hda win7.img -cdrom win27.iso -m 1024 -boot d

Success! (at least initially...) The Win7 ISO booted up beautifully and actually relatively quickly. I was able to run through the initial steps to install Windows 7- selecting time zone settings, user settings, etc. That was until I got to the "Setup is Starting" screen and where I was left in indefinite purgatory. I did a bit of googling and found this bugzilla report outlining the same issue I was experiencing, but with no resolution. Tracing duplicate bugs led to no where, and thus again I was stymied.

Alright, well I don't really need Windows 7, why not just use XP Professional? Being an older OS, perhaps it would install more cleanly on KVM. As before, the ISO booted great, I ran through all the OS options, and it actually started to install... only to later hang just as its younger brother did before. After a few repeated attempts (one allowed to run overnight), it was obvious that there was little I could do to get a Windows OS up and running on this version of KVM.

Alright, well maybe the version packages I chose to install KVM were incomplete or still unstable. Afterall, the kvm-qemu package was listed as in Beta. So I decided to scrap my RHEL client idea and go for the real deal: RHEL 5 Server, whose installation media actually contains virtualization packages. Despite this more by-the-book (and probably more officially supported) attempt, I ran into identical problems as noted above

So the conclusion: KVM has potential as an alternative to a baremetal hypervisor, perhaps just not version 83. RedHat is striving to make RHEV (RedHat's implementation of KVM) a market contender for a low-cost virtualization solution, however it seems this may be a bit premature. Maybe they should give their internal developers a bit more time to design and test before selling that horse.

While the battle may be lost, the war is far from over- next attempt: the more tried and true Xen!

Packages: kvm-qemu-img

Links:
HowTos/KVM - CentOS
RHEL Virtualization Guide
(dev package not required- complains if kernel is different)

P2V of Vista machine failed

Managing Windows Bitlocker Drive Encryption (BDE)

A quick and easy way to manage Windows Bitlocker Drive Encryption (BDE).

C:\Users\user>manage-bde.wsf -help

Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

manage-bde[.wsf] -parameter [arguments]

Description:
Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
-status Provides information about BitLocker-capable volumes.
-on Encrypts the volume and turns BitLocker protection on.
-off Decrypts the volume and turns BitLocker protection off.
-pause Pauses encryption or decryption.
-resume Resumes encryption or decryption.
-lock Prevents access to BitLocker-encrypted data.
-unlock Allows access to BitLocker-encrypted data.
-autounlock Manages automatic unlocking of data volumes.
-protectors Manages protection methods for the encryption key.
-tpm Configures the computer's Trusted Platform Module (TPM).
-ForceRecovery or -fr
Forces a BitLocker-protected OS to recover on restarts.
-ComputerName or -cn
Runs on another computer. Examples: "ComputerX", "127.0.0.1"
-? or /? Displays brief help. Example: "-ParameterSet -?"
-Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
manage-bde -status
manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Making it much easier to image and P2V a machine. This will come in handy when I P2V Windows to run on virtualized hardware, so I can finally make the switch to all open source OS (read: Linux)!

Windows Batch Scripting and Win2k8 AD GPO Functionality

Created this script and saved it as a .bat file to loop through values stored in a comma-delimited file to reboot specific machines:

FOR /F %%A IN (filename.csv) DO (
ECHO. %%A >> result.txt %1
shutdown -m \\%%A -r -f -t 10 -c "Your workstation will reboot in 10 seconds for scheduled maintenance" >>result.txt %1
)

And some cool functionality that you can do using GPOs in AD 2008:

• Set/Change Local User Passwords on all workstations in the domain
• Map network drives without using vb scripts/batch files
• Map printers without using vb scripts/batch files
• Disable USB storage devices using REG keys
• Disable specific hardware devices (CDROM drives, imaging devices, etc)
  

Fast Forward 8 Months

So again, I have criminally lapsed in my posts on this blog. Since that September post, I left my previous job at the University of Georgia, had a nice 2-week backpacking trip through Europe away from computers and familiar faces, and returned in mid October to begin work for the man a large technology consulting firm, based out of the Atlanta office.

I'm currently on a 6-month 10-month project for a federal government client, spending 4-5 days of the week in the greater DC area, working as, to my dismay, a "Windows Desktop Engineer." I've been able to grab a few server tasks on the side, and the role has afforded me some valuable experience with Windows Server 2008 and Active Directory, however I find myself a good distance away from where my true interests lie: Linux servers and virtualization technologies.

At work, I've learned a good bit about GPO authoring, Active Directory 2008 configuration and management, Ghost Suite 2.5, Windows Server 2008 implementation of DHCP and DNS, enterprise-level IT, and the nature of consulting.

In what little time I have at home every few weekends (I tend to spend weekends in different cities or staying in DC), I've been playing around with Windows Server 2008 and Active Directory architecture in a virtual environment. Since leaving UGA, I had to forfeit my VMWare Workstation license, and thus have been learning to use Sun's VirtualBox. Aside from the networking, I've found that many of the standard features are comparable to VMWare Workstation.

In the coming weeks, I hope to have the opportunity to play around with Xen virtualization and KVM in Linux. More on that later!

VMWare NAT on Windows 7

While I would never dream of switching my home workstation to a new version of Windows within its first few months on the market, particularly when it is still only in RTM, at work is a different story.

I could probably still get by using XP Pro on my workstation, and put Windows 7 in a VM, I find self-immersion to be the best method to fully learn a new OS, as it forces me to get it set up completely, otherwise I can't do work.

While I've run into a few annoyances thus far (no Daemon Tools or PowerISO, urg), nothing yet has been a show stopper... until I tried accessing the internet in my XP Active Directory administration virtual machine in VMWare using NAT.

Apparently Windows 7's new compartmentalized network security breaks VMWare's NATing ability. Note in the below screen shot how the VMWare Network adapter is identified by Windows as being on a public network, thereby disabling its connection.


I was able to still use Bridged networking within VMWare, but this was not practical at work since we have to specific each connected machine's MAC address in our DHCP tables to assign it an IP- a bit overkill for an only occasionally non-critical VM.

So after some digging and a bit of troubleshooting, I found a workable solution thanks, in part to this article, using Win7's Internet Connection Sharing (ICS). One important caveat to note is that Win7's networking has changed in a few minor ways that require a bit of deviation from the article. Below is a summary of steps:

1. Run the Virtual Network Editor as Admin
2. Go to Host Virtual Adapters tab, remove all VMNet instances (default are VMNet1 and VMNet8)
3. Click Apply
4. Click Add, select VMnet1
5. Click Apply
6. Go to the Host Virtual Networking tab
7. Click the > next to VMnet1 and change the address and subnet to use the Win7 ICS network (192.168.137.0 / 255.255.255.0) <- note how this deviates from the article
8. Click Apply
9. Go the NAT tab and select VMNet1
10. Click Edit and change the Gateway to the ICS gateway IP (192.168.137.1)
11. Click Apply and restart the NAT service
12. Go to the DHCP tab
13. Add VMNet1 and remove all others
14. Click Apply
15. Select Properties of VMNet1 in DHCP Tab
16. Enter a Start and End Address for DHCP (I used 192.168.137.50 to 192.168.137.75)
17. Click OK then Apply

19. Go to Network Connections in the Windows 7 Control Panel
20. Right Click on your Local Area Connection > Properties
21. Go to Share Tab and check both boxes (Allow other network users to connect through this computer's Internet connection and Allow other network users to control or disable the shared Internet Connection [optional])
22. Click OK

23. On each VM, go to Network settings and select Host Only Networking for every VM that needs to NAT out to the network

Done! Seemed to do the trick on my XP SP3 VMs, and now I can administer our AD tree and group policy!

IT Humor, RAIDing USB Drives, Windows 7 Deployment

No posts for a while, been keeping busy at work, haven't been motivated to come home and spend more time tinkering on my computers after spending 8 hours on my workstation... I guess sometimes even a geek needs a break. In lieu of actually working on my computers, I've been watching a lot of the British sitcom IT Crowd on Netflix, combining British humor with a little esoteric IT humor thrown in.



As I spend more time in my full time position here in our IT Office, not only am I gaining a lot of enterprise-level IT technical experience, I'm also learning a lot of the ins and outs of dealing with our clientele. Its been an eye opening experience to say the least, dealing with all different sorts of characters with different technical competencies. I hope to post more on this subject later, as it has sometimes provided good humor here in the office, as well as some definite frustrations.

I've recently stumbled across a potential need to RAID USB drives for mirroring (RAID 1). My roommate uses an external USB harddrive to store photos taken for her work. Unfortunately, it seems that only after using the drive for a month, it has already bitten the dust (although I still have yet to take a look at it). It occurred to me that a USB RAID array could be very useful, particularly in this situation, but according to Jason Khors of Big Bruin, this can't be done using Windows. Not surprisingly it can be done using Linux, using the LVM (oh what can't you do, Linux?).

But there still may be hope, seeing as my roommate uses OS X (which I've grown to dislike more and more since working with it in an LDAP enterprise environment). Apparently OSX can use external drives for RAID arrays, at least according to this article. Assuming my roommate doesn't mind me hacking away at her MacBook, maybe I can set this up for her, and learn something in the process.

On an unrelated note, here in the office we've gotten our copies of Windows 7 RTM, so we're mired in documents and manuals dealing with Windows 7 deployment tools- WAIK tools, Sysprep, WinPE, imageX, and SCCM just to name a few. While SCCM is a beast in-of-itself, a good resource for general 7 deployment can be found here. We're hoping to start using Windows 7's VHD capabilities for deployment as well.

X is Dead

Just a quick update:

After being away from my systems for a week because I'm in the process of moving, I set up my workstations in the new house, along with two new toys. I had the opportunity to throw Windows 7 up on a VM, but haven't had much time to play with it. So far, I'm more impressed with Win7 than I was with Vista, in terms of usability, notification handling, and its more enterprise-friendly configuration options.

For the past week I've been working on getting my system back up and running- since upgrading to kernel 2.6.29 and a newer intel driver, X no longer starts correctly- basically everything I've experienced is documented in this gentoo bug report. I now have an intimate understanding on configuring Xorg-server, using masked packages, and installing X11-drivers on gentoo. I'm still struggling to get X to work properly, but so far am still having issues with it starting then freezing. As of right now, I have recompiled x11-drivers as well as followed the steps in this Gentoo how-to.

At work, I've finally been granted some Active Directory privileges, so I'm trying to take a crash course in AD group policy. I have learned basic AD administration, such as user and computer creation, managing organizational units, and user privileges. Right now, I'm working on creating group policy to implement auto logoff and something along the lines of Windows SteadyState. I'm also in the process of configuring Mac OSX to authenticate users using the University's LDAP tree. I've also had the opportunity to toy a bit with SmartDeploy, but have yet to actually start deploying workstations with it.

That's it for now, hopefully I'll be able to post a bit more frequently now that my move is almost complete.