VMWARE Server 2.02 has been released October 27, 2009. It includes a few important security updates for VMWARE Server. If you are running a Linux server with VMWARE server 2.01, I strongly suggest to upgrade due to the “Directory Traversal Vulnerability” — which may allow for remote retrieval of any file from the host system.

Security Fixes with VMWARE 2.02

• New: Exception handling privilege escalation on Guest Operating System This release addresses a security vulnerability in exception handling. Improper setting of the exception code on page faults might allow for local privilege escalation on the guest. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-2267 to this issue.
• New: Directory Traversal Vulnerability on Linux-based hosts This release addresses a directory traversal vulnerability that is present on host systems and that may allow for remote retrieval of any file from the host system. In order to send a malicious request, the attacker will need to have access to the network on which the host resides. The issue is present on Linux-based hosts only, not on Windows-based hosts. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-3733 to this issue.

There’s a number of workarounds listed in the VMWARE Server 2.02 Release notes

Download the latest version of VMware Server 2

VMWARE has two “free” options to get started into virtualization. VMWARE Server 2.0 and VMWARE ESXi. Each has their own advantages and disadvantages. Notably, VMWARE server will run on many different operating systems (Windows/Linux/etc.) while the VMWARE ESXi is limited to certain hardware since it runs on bare metal (has its own hypervisor). No OS is required to run ESXi.

TIP: From personal experience, I recommend only using local storage as opposed to a home built SAN when dealing with VMs. Do not go cheap on storage. If you can, purchase a Sun SAN or equivalent for maximum uptime. Reliable storage will save lots of unnecessary headaches.

VMWARE ESXi for performance

So, whats the main advantages and disadvantages? Well, first of all, if you want to manage your VM server remotely then ESXi isn’t the best choice. They lock down all the remote administration settings on each of the VMs (including remote console).  Some scenarios that may require console — you can’t SSH into your VM since the service went down or you did an OS upgrade that hosed your network. If this is an issue, then you need to consider purchasing VMWARE ESX.

However, VMWARE ESXi does have significant performance benefit since you don’t have to dedicate memory to the host operating system (e.g. Windows Server 2008, Linux, etc) and it runs on a lean kernel system. Memory is the main bottleneck  since you have to dedicate RAM for each VM.  If Windows Server needs at least 1GB to run and you have only 2GB of RAM, then ESXi would be a better choice. ESXi only uses 32 MB. There are some minor drawbacks to the ESXi system. The VM disk files are locked in ESXi, which can be a liability if your VMX files somehow get corrupted. There is also no support for software RAID, so you need to have a hardware RAID based configuration thats supported by VMWARE. This also means ESXi does not support LVM (common w/ RedHat installs) See my link at the end of the post for more information. In conclusion, ESXi is a great way to start learning how to use enterprise VMWARE. They intentionally removed a lot of the features so you can eventually upgrade to a paid version of VMWARE.

VMWARE Server for remote administration

If you want to remotely administer the VM, then either upgrade to the vCenter or take the performance hit and use VMWARE Server instead. In one of my production environments, I have a VMWARE Server 2.0 running on a Windows Server. Its rock solid. VMWARE Server supports a lot more hardware compared to ESXi, so thats something to consider as well. I can control a lot of settings with VMWARE server such as migrating VMX files between multiple servers, console access to all my VMs, and excellent GUI user interface. They made huge upgrades in version 2! My VMWARE server has 16GB of RAM, so I’m willing to take some performance/memory overhead for convenience.

VMWARE hardware compatibility guide
http://www.vmware.com/resources/compatibility/search.php

Why install VMWARE Tools?
Improved display support with SVGA driver
Cut and paste from host onto the VMWare guest
Automation of guest operating system commands
Sync time
Shrinking disk space
Startup and shutdown scripts

In order to install VMWARE tools on Debian, you will need to make sure you have the package “linux-headers-[kernel version]” installed.

If not, you will get a prompt during the configuration asking for the path of the C header files.

To find the version of your kernel, type in:
uname -a

It should say something like Linux infomine 2.6.26-2-amd64 (with your current CPU architecture at the end)

****
NOTE: Do this at your own risk. If you put the wrong version of the kernel header files, things will break.
****

After identifying what kernel you are using, then add the linux header files
apt-get install linux-headers-[kernel version]
For instance,  apt-get install linux-headers-2.6.26-2-amd64

Then follow the Vmware documentation on installing VMWARE Tools:
http://www.vmware.com/support/gsx3/doc/tools_install_lin_gsx.html

Ever change the Network MAC address setting in VMWARE and you can’t get the network to work?

Here’s a quick how-to on changing the MAC address on a Linux VM. This is useful if you want to clone an existing machine and want to have both machines running with network at the same time. I am using VMWARE Server 2.0. (free version)

1) Power down the VM that you want to change the MAC address on. (e.g. cloned computer)
2) On the VMWARE console, select your (cloned) VM machine on the left side. In the Summary tab, click on “Edit” in the Network adapter section. The MAC address needs to be set the “Manual”. In the textbox, set the MAC address. It will need to start with 00:50:56 and end with XX:XX:XX to a value between 00:00:00 and FF:FF:FF. For instance, you can use 00:50:56:FF:FF:FF as a MAC address.  Click on OK.

3) If you are using Static IP address. Follow this step: On your VM console, click on the Summary Tab for the VM you changed the settings on. On the Network Adapter 1, click on “Edit”. Uncheck the box that says “Connect at power on”  Click on OK.

Turn on Debian box. Login as root. If you are using static IP, you will first need to change the IP to a new one. Edit the “/etc/network/interfaces” file. On the “address” line of your network adapter (eth0, … eth5)  change the IP.  Shutdown computer. Go to VMWARE console, edit Network Adapter 1, check the network box that says “Connect at power on”.

4) Power on the VM. Login as root.

5) Go to /etc/udev/rules.d/

6) There should be a file called “70-persistent-net.rules”. Backup the file. Edit this file. Find the line that matches the MAC address that you entered in step 3.  If you can’t find it (that maybe the problem), edit the last network device on the list. In the “ATTRS{address}==” section, enter the MAC address that you added. Note what NAME it is.  It should be something like “eth0″ or “eth….”  Save the file.

7) Now edit /etc/network/interfaces file. Your will need to make sure the “eth” matches the NAME of the hardware device in step 8. For instance, if the name is eth0 — make sure the name of the interfaces is eth0 and the allow-hotplug line is eth0 as well.

Run the command “ifup [NAME]” for instance ifup eth0. You should get a status message whether the network works.  If you get a conflict error, you are either using a MAC address that is on another VM or a static IP address of another computer. If its a conflict of IP, change the IP in step 3. To troubleshoot network device not working, stop the VM machine — look in the Network adapter field. Write down the MAC address. Go back to step 6.