RHEL 5 and KVM for Enterprise Notebook

So after finally successfully downloading and burning RHEL 5 Client x86_64 and obtaining a new hard drive for my notebook, I'm ready to install RHEL and test KVM.

The RHEL install was relatively painless, as Anaconda is an amazingly simple installation utility. Unfortunately, the first road bump I ran into was that the RHEL Client installation disk does not come with any virtualization package options (Xen, KVM, etc). No worries though, I was sure I could simply find the packages on the RedHat Network and push them down that way.

Small problem: RHEL didn't recognize my wireless card. After a quick lspci and some grepping:

lspci | grep wireless

I found my card and a nice step-by-step guide to install the necessary firmware to get it working.

After getting wireless up and running, I found that after registering my RH system, it did not appear in my RedHat systems on RHN, therefore I couldn't target packages to be automatically pushed to my laptop. After a bit of research on the RedHat Knowledgebase, I determined that this was because of the way my enterprise evaluation account was set up- my systems would be assigned to the Organization Administrator. Being the impatient person I am, I decided to just pull down the necessary packages manually instead of waiting for a response from my company's RHEL partner contact.

It was a bit of a tedious process, as I had to not only pull down the necessary RPMs, but also their dependencies. Anyone who's had experience working with RedHat, SuSE, or any other RPM-based distro before yum became available knows how frustrating it can be. I actually documented each package I had to pull down and listed them in the original version of this post, however Blogger didn't do a good job of saving the post, so that list has been lost in the series of tubes.

After pulling down all the packages I needed (apparently RHEL only officially supports up to version 83 of KVM) and checking the Guest Support Status, it looked as though I'd be good to go with virtualizing Windows Vista or 7 on KVM.

The first thing I tried was to convert the VMWare VMDK virtual image of my Windows Vista laptop into qemu's qcow2 format, as outlined in a link from my previous post. I quickly discovered, however, that RHEL does not natively support reading/writing to NTFS filesystems. What!? What is this, 1998? After a bit of Googling, I found this NTFS support in RHEL 5 blog post outlining the basic packages needed. One thing to note is that the dev package (kmdl) is not necessary and will generate a compile-time error if your kernel is not 2.6.18. I went ahead and just skipped installing it and was able to mount ntfs file systems fine. I figured I'd try configuring the automounter later, after I got my converted Vista image converted:

qemu-img convert Vista.vmdk -O qcow2 /home//virtual_machines/Vista.qcow2

The conversion appeared to complete successfully, however it did take a good bit of time (roughly 30 minutes).

kvm -hda Ubuntu-copy.qcow2 -net nic -net user -m 512

Upon attempting to boot this image, I received a blank screen with no indication of the guestOS trying to boot. After a couple more attempts, I did get the "Windows failed to start properly" menu and tried booting into safe mode, however this too failed. No sweat, there's a chance that my virtual image didn't convert well in the P2V, and I haven't yet tested it on VMWare, so I figured why not start from scratch with a brand new Windows 7 image?

qemu-kvm -hda win7.img -cdrom win27.iso -m 1024 -boot d

Success! (at least initially...) The Win7 ISO booted up beautifully and actually relatively quickly. I was able to run through the initial steps to install Windows 7- selecting time zone settings, user settings, etc. That was until I got to the "Setup is Starting" screen and where I was left in indefinite purgatory. I did a bit of googling and found this bugzilla report outlining the same issue I was experiencing, but with no resolution. Tracing duplicate bugs led to no where, and thus again I was stymied.

Alright, well I don't really need Windows 7, why not just use XP Professional? Being an older OS, perhaps it would install more cleanly on KVM. As before, the ISO booted great, I ran through all the OS options, and it actually started to install... only to later hang just as its younger brother did before. After a few repeated attempts (one allowed to run overnight), it was obvious that there was little I could do to get a Windows OS up and running on this version of KVM.

Alright, well maybe the version packages I chose to install KVM were incomplete or still unstable. Afterall, the kvm-qemu package was listed as in Beta. So I decided to scrap my RHEL client idea and go for the real deal: RHEL 5 Server, whose installation media actually contains virtualization packages. Despite this more by-the-book (and probably more officially supported) attempt, I ran into identical problems as noted above

So the conclusion: KVM has potential as an alternative to a baremetal hypervisor, perhaps just not version 83. RedHat is striving to make RHEV (RedHat's implementation of KVM) a market contender for a low-cost virtualization solution, however it seems this may be a bit premature. Maybe they should give their internal developers a bit more time to design and test before selling that horse.

While the battle may be lost, the war is far from over- next attempt: the more tried and true Xen!

Packages: kvm-qemu-img

Links:
HowTos/KVM - CentOS
RHEL Virtualization Guide
(dev package not required- complains if kernel is different)

P2V of Vista machine failed

P2V for KVM

Some resources I plan on using when trying to P2V a Windows Vista laptop to use on either RHEL or CentOS KVM.

• How to convert vmware vdk image to kvm
• Windows XP p2v conversion with KVM

Right now, the best solution looks to be to convert the physical box to a VM using VMWare vCenter Converter

I haven't ruled out using Xen, but my initial research indicates this may be easier to do on KVM then Xen. KVM appears to be more similar to Solaris Containers, whereas Xen uses paravirtualization. I've had limited experience with Xen, and no experience with KVM, so this should be a good learning exercise. Here's some more resources for reference:

• Xen vs KVM
• Xen vs KVM and KVM Migration
  

Managing Windows Bitlocker Drive Encryption (BDE)

A quick and easy way to manage Windows Bitlocker Drive Encryption (BDE).

C:\Users\user>manage-bde.wsf -help

Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

manage-bde[.wsf] -parameter [arguments]

Description:
Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
-status Provides information about BitLocker-capable volumes.
-on Encrypts the volume and turns BitLocker protection on.
-off Decrypts the volume and turns BitLocker protection off.
-pause Pauses encryption or decryption.
-resume Resumes encryption or decryption.
-lock Prevents access to BitLocker-encrypted data.
-unlock Allows access to BitLocker-encrypted data.
-autounlock Manages automatic unlocking of data volumes.
-protectors Manages protection methods for the encryption key.
-tpm Configures the computer's Trusted Platform Module (TPM).
-ForceRecovery or -fr
Forces a BitLocker-protected OS to recover on restarts.
-ComputerName or -cn
Runs on another computer. Examples: "ComputerX", "127.0.0.1"
-? or /? Displays brief help. Example: "-ParameterSet -?"
-Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
manage-bde -status
manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Making it much easier to image and P2V a machine. This will come in handy when I P2V Windows to run on virtualized hardware, so I can finally make the switch to all open source OS (read: Linux)!

Deploying an EXE patch using GPO

Recently at my client site, we needed to push a Microsoft Patch that we couldn't push using our update solution. The ideal solution would be to wrap the executable up into an MSI and just push the MSI using a GPO. After trying this using a 3rd party MSI wrapper utility, we created an MSI and pushed it to all workstations, where the wrapper itself installed, but the executable failed to run. In the interest of time, we needed to engineer a solution quickly to push our patch to ensure that users would be able to continue to access certain resources within our infrastructure. I know that you can create a Setup package by using Visual Studio .NET (another tutorial here), but we didn't have the time to sit down and hammer out a solution and test it.

Instead, I suggested that we push the executable using a GPO and simple VB script. The trick is we'd have to build into the script a way to check to make sure the executable hasn't already been installed- otherwise every computer getting the GPO will run the executable every time it boots (something we don't want). After a bit of Googling, I wrote the following VB script, which does the following:

# Pseudo Code
Check if a reg key exists
If the reg key does not exist, execute the executable installer with switches to make it a passive installer
Once the executable complete, create a registry key marking that the install has completed

'Reg key to create. Doesn't have to be this key, but since this is technically a patch, put it in Windows Update
sRegKey="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
sExePath = "\\path\to\executable"
sSwitches = "/passive /warnrestart:45" 'Check available flags on Executable for options here

' Suppress error in case values do not exist
On Error Resume Next

' Check for the Reg Key Marker
sRegMarkerValue = "" ' initial value
sRegMarkerValue = oShell.RegRead( sRegKey & "\WindowsXP-KBXXXXX-x86-ENU.exe")
On Error Goto 0

' To ensure update is only installed once, test the reg key marker
If sRegMarkerValue <> "yes" then

'Run the executable with switches
oShell.Run Chr(34) & sExePath & Chr(34) & " " & sSwitches, 1, True

' Create the Reg Key marker
oShell.RegWrite sRegKey & "\WindowsXP-KBXXXXX-x86-ENU.exe", "yes"
End If

After applying the GPO, we rebooted all of the workstations, and our patch was successfully applied!

Windows Batch Scripting and Win2k8 AD GPO Functionality

Created this script and saved it as a .bat file to loop through values stored in a comma-delimited file to reboot specific machines:

FOR /F %%A IN (filename.csv) DO (
ECHO. %%A >> result.txt %1
shutdown -m \\%%A -r -f -t 10 -c "Your workstation will reboot in 10 seconds for scheduled maintenance" >>result.txt %1
)

And some cool functionality that you can do using GPOs in AD 2008:

• Set/Change Local User Passwords on all workstations in the domain
• Map network drives without using vb scripts/batch files
• Map printers without using vb scripts/batch files
• Disable USB storage devices using REG keys
• Disable specific hardware devices (CDROM drives, imaging devices, etc)
  

RedHat Certified Technician

I am officially a RedHat Certified Technician! Although I'm not gaining any experience in RedHat on my current project, I managed to get RedHat training approved by my firm, and took the RH133 course last week. The course was great- I learned a good deal of administration tips and tricks and it really helped fill in some crucial voids in my Linux repertoire.

I'm hoping to continue on the Red Hat path to obtain my RHCE in the next year, hopefully in October if possible. Admittedly, Gentoo still holds a special place in my heart, but in terms of usability and enterprise server-grade Linux, Red Hat has gained a lot of points in my book, particularly with its implementation yum and system configuration tools.

The class also inspired me to take a closer look at Xen and KVM virtualization. I'm hoping to P2V my Windows 7 box at home, and instead use RHEL (or CentOS) as a hypervisor and run Windows 7 as a VM.

RH courses I'm hoping to attend (and gain certification in) in the coming months include:

• RH253 - Red Hat Linux Network and Security Administration
• RH318 - Red Hat Virtualization Administration

Fast Forward 8 Months

So again, I have criminally lapsed in my posts on this blog. Since that September post, I left my previous job at the University of Georgia, had a nice 2-week backpacking trip through Europe away from computers and familiar faces, and returned in mid October to begin work for the man a large technology consulting firm, based out of the Atlanta office.

I'm currently on a 6-month 10-month project for a federal government client, spending 4-5 days of the week in the greater DC area, working as, to my dismay, a "Windows Desktop Engineer." I've been able to grab a few server tasks on the side, and the role has afforded me some valuable experience with Windows Server 2008 and Active Directory, however I find myself a good distance away from where my true interests lie: Linux servers and virtualization technologies.

At work, I've learned a good bit about GPO authoring, Active Directory 2008 configuration and management, Ghost Suite 2.5, Windows Server 2008 implementation of DHCP and DNS, enterprise-level IT, and the nature of consulting.

In what little time I have at home every few weekends (I tend to spend weekends in different cities or staying in DC), I've been playing around with Windows Server 2008 and Active Directory architecture in a virtual environment. Since leaving UGA, I had to forfeit my VMWare Workstation license, and thus have been learning to use Sun's VirtualBox. Aside from the networking, I've found that many of the standard features are comparable to VMWare Workstation.

In the coming weeks, I hope to have the opportunity to play around with Xen virtualization and KVM in Linux. More on that later!