vmtools, a Qemu virtual machines manager, is now available

vmtools is a Qemu virtual machines manager which strives to be easy, versatile and modular while adhering to the principle of least privileges, to respect users’ freedom and security.

Easy: Just vmup anything which can be booted, from a local disk image file to remote URLs including .ova archives and devices files. No complex parameters to set or remember, just boots the damn thing.

Virtual machine settings are saved in short and clean plain-text files. No XML, no unneeded settings, only the non-default values specific to the virtual machine, easily readable and editable with any text editor.
Versatile: Use it how you want, vmtools does as few assumptions as possible. No imposed directory structure, no imposed work-flow.

Saved virtual machines are standard directories and files which can be moved, copied or renamed at will, but can also be freely forked and merged to match even advanced work-flows.

vmtools commands offer a wide range of options, with an in-line documentation available through the common -h parameter and more details including concrete examples available in the man pages.
Modular: vmtools relies on a plugin and templating system allowing to fully customize how virtual machines are created, started and cloned.

Moreover vmtools is entirely developed in POSIX Shell script, making the inspection and modification easier.
Principle of least privileges: vmtools does not require to install a service running as root, in fact it doesn’t require to install any service and doesn’t require any super-user privilege.

Qemu/KVM already makes hardware-assisted emulation available to unprivileged users, adding a service running as root on top of this creates unneeded security weaknesses.

More information can be found in the section dedicated to this tool: vmtools.

vmtools guided tour, part 2: manage virtual machines

Still with me? In this second part of the vmtools guided tour (read the first part first!), we will now enter in the core of the subject and learn how to manage virtual machines, and in particular how virtual machines forks and merges work.

As before, if anything seems unclear or would warrant more explanation, feel free to contact me.

Use `vmcreate` to create virtual machines

Create a virtual machine from an installation ISO image

vmup is useful to boot a virtual disk image, but it doesn’t save the virtual machine settings and does not provide access to vmtools more advanced features.

In vmtools, a virtual machine is a standard directory gathering a few files. To create a new virtual machine, the most common way is to provide the path to the ISO image of an installation disk and the name of a new directory to create:

user@host …

Continue

vmtools guided tour, part 1: introduction and basic usage

This the first of a short series of posts introducing vmtools main features. We will start in a gentle way by focusing on a single but central command: vmup.

Feel free to contact me if anything seems unclear or would warrant more explanation.

vmtools installation and uninstallation

Use the provided install.sh script to install vmtools on your system. The default is to install it system-wide:

sudo sh ./install.sh

To install it as unprivileged user, create a ~/.local directory and use it as installation prefix:

sh ./install.sh -p ~/.local

To uninstall vmtools, use the provided uninstall.sh script.

Centralized configuration file

System-wide settings are stored in the file /etc/vmtools/vmtools.conf, this file is optional and must be manually created.

This file lets you centrally configure the default settings to apply to all your virtual machines.

Here is an example file:

# Use VNC as the default display …

Continue

Common issues when using virtual machines

Qemu issues

Send the Ctrl-Alt-Del key sequence to the guest

The Ctrl-Alt-Del is a special key sequence intercepted by he operating system. Windows use it as a security¹ measure to unlock its screen, but in the case of virtualized system an alternative is necessary as the key sequence would be intercepted by the host instead of being sent to the guest.

If you are using VNC display, press F8, you should get a menu proposing to send the Ctrl-Alt-Del sequence to the guest.
If accessibility tools are available, enable the on-screen keyboard, press Ctrl-Alt on your physical keyboard and click Del on the on-screen keyboard.
If accessibility tools are not available, on Windows systems press the Shift key at least five times in a row, you should get a pop-up allowing to enable sticky keys. Now successively press the Ctrl, the Alt …

Continue

How to build a virtual pentest lab

Standalone virtual machines are both a cheaper and more practical solution to test systems as they doesn’t need to dedicate hardware and are easier to handle than physical installation (actions such as cloning, doing a snapshot or a rollback become trivial).

Network virtualization goes a step further and apply the same system to a whole network, including workstations, servers, and all networking devices such as switches, routers and firewalls. A virtual network can be of any size and topology, and can mimic any real-life situation such as Active Directory domains, remote-access or site-to-site VPNs or test protocols of every network plane.

Such virtual network can be either fully isolated or have one or several link to physical devices and networks, its all up to you to decide.

Hardware

Prerequisites

The goal of a virtual lab is to be able to quickly setup the environment which will allow you to …

Continue

How to run a CAM table overflow attack in GNS3

Knowing where difference with real gears lies

For performance reasons, a lot of switch things are actually not part of the IOS code but are implemented in hardware. This includes the ARL, or Address Resolution Logic, which provides all the methods to add, remove and lookup entries in the MAC address table.

Therefore, for the NM-16ESW module to work in GNS3, Dynamips had to reimplement all these normally hardware provided services, or at least push this far enough to allow an unmodified IOS to run on it correctly.

The sad thing is indeed that this is unfinished work, as stated in this module’s source code header:

/*
 * Cisco router simulation platform.
 * Copyright (c) 2006 Christophe Fillot (cf@utc.fr)
 *
 * NM-16ESW ethernet switch module (experimental!)
 *
 * It's an attempt of proof of concept, so not optimized at all at this …

Continue

Popular tags ^{see all}

WhiteWinterWolf Practical IT security, *nix systems & networking