Security and the Virtualization Layer (esxi)

VMware designed the virtualization layer, or VMkernel, to run virtual machines. It controls the hardware that hosts use and schedules the allocation of hardware resources among the virtual machines. Because the VMkernel is fully dedicated to supporting virtual machines and is not used for other purposes, the interface to the VMkernel is strictly limited to the API required to manage virtual machines.

ESXi provides additional VMkernel protection with the following features:

Memory Hardening

The ESXi kernel, user-mode applications, and executable components such as drivers and libraries are located at random, non-predictable memory addresses. Combined with the non-executable memory protections made available by microprocessors, this provides protection that makes it difficult for malicious code to use memory exploits to take advantage of vulnerabilities.

Kernel Module Integrity

Digital signing ensures the integrity and authenticity of modules, drivers and applications as they are loaded by the VMkernel. Module signing allows ESXi to identify the providers of modules, drivers, or applications and whether they are VMware-certified.

Trusted Platform Module(TPM)

Each time ESXi boots, it measures the VMkernel and a subset of the loaded modules (VIBs) and stores the measurements into Platform Configuration Register (PCR) 20 of the TPM. This behaviour is enabled by default and cannot be disabled. Hardware support for this feature is fully tested and supported by VMware and its OEM partners.

NOTE:-  Not all VIBs are measured as part of this process.

The VMware TPM/TXT feature that leverages the fully tested hardware support is suitable for a proof-of-concept that demonstrates monitoring of certain TPM PCR values, by alerting when any values change from one boot to the next. Third-party solutions could use this feature to detect changes to VIB measurements stored in these PCRs for the following cases:

•   Corruption of the measured images          
•  Unexpected or unauthorized updates, or other types of changes to themeasured images

For more details you can see:-

http://pubs.vmware.com/vsphere-50/topic/com.vmware.ICbase/PDF/vsphere-esxi-vcenter-server-50-security-guide.pdf

New virtual machine capabilities (vSphere 5)  

  

ESXi 5.0 introduces a new generation of virtual hardware with virtual machine hardware version 8, which includes the following new features:- 

• 32-way virtual SMP. ESXi 5.0 supports virtual machines with up to 32 virtual CPUs, which lets you run larger CPU-intensive workloads on the VMware ESXi platform.
• 1TB of virtual machine RAM. You can assign up to 1TB of RAM to ESXi 5.0 virtual machines.
• Software support for 3D graphics to run Windows Aero. ESXi 5.0 supports nonhardware accelerated 3D graphics to run Windows Aero and Basic 3D applications in virtual machines.
• USB 3.0 device support. ESXi 5.0 features support for USB 3.0 devices in virtual machines with Linux guest operating systems. USB 3.0 devices attached to the client computer running the vSphere Web Client or the vSphere Client can be connected to a virtual machine and accessed in it. USB 3.0 devices connected to the ESXi host are not supported.
• UEFI virtual BIOS. Virtual machines running on ESXi 5.0 can boot from and use the Unified Extended Firmware Interface (UEFI).

Resource Pool Management (vSphere5)

You can create, manage and delete the Resource Pool, While you are managing stand-alone host esxi (before adding to vCenter Server). Once you add host to vCenter Server after that Resource pool management is only using vCenter, direct connection to host (esxi) do not allow resource pool management, until you remove host (esxi)  from vCenter inventory.

VMware Certified Associate Level free till 31 Jan 2014 ! Don't Miss !

Wait till next promotion !!

Meanwhile if not yet completed, you can go for VCA (VMware Certified Associate) exams for free !

VMware Certified Associate certification is available now for all the who have attended VMware vSphere Training program, or even who have the vmware product knowledge and want to have some recognition to that, You can go for the VCA certification.

·         VCA-DCV - vSphere: Install, Configure, Manage [5.1] supported by Fundamentals e-Learning - VMware Data Center Virtualization Fundamentals &VMware Data Center Virtualization Fundamentals (Japanese)

·         VCA-WM - Horizon View: ICM AND Horizon Mirage, each supported by Fundamentals e-Learning - VMware Workforce Mobility Fundamentals&VMware Workforce Mobility Fundamentals (Japanese)  

·         VCA-Cloud - vCloud Automation Center: ICM, supported by Fundamentals e-Learning - VMware Cloud Fundamentals & VMware Cloud Fundamentals (Japanese)


So hurry up add some more certification to profile.

Good Luck !

100% free voucher till 31 January 2014

 Promotion Code:-   VMRT8B34585F


Exam Voucher VCP510




So many of you have attended the training for VMware vSphere: Install Configure Manage [5.x], even some of you are already VCP5, so congrates to becoming VCP and welcome to VCP community, those who are yet preparing for exam or not find time to take the exam. There is exam voucher available for VCP510 you can get 25% discount on your exam total cost.

VM029B2D3E3C
This voucher is valid till 31st October 2013

Take the exam soon and become VCP. Good Luck for your exam.

Considerations – Upgrade or Create New (VMFS-5)

While a VMFS-3 which is upgraded to VMFS-5 provides you with most of the capabilities as a newly created VMFS-5, there are some differences. Both upgraded and newly created VMFS-5 support single-extent volumes up to 64TB and both support VMDK sizes of ~2TB, no matter what the VMFS file-block size is. However additional differences, although minor, should be considered when making a decision whether to upgrade to VMFS-5 or create new VMFS-5 volumes.

No Uniform Block Size

VMFS-5 upgraded from VMFS-3 continues to use the previous file-block size, which may be larger than the unified 1MB file-block size. This can lead to stranded/unused disk space when there are lots of small files on the datastore.

No New Sub-Block Size

VMFS-5 upgraded from VMFS-3 continues to use 64KB sub-blocks and not the new 8KB sub-blocks. This can also lead to stranded/unused disk space. The upgraded VMFS-5 also continues to use the original number of sub-blocks from the VMFS-3.

No Increase to the Maximum Number of Files per Datastore

VMFS-5 upgraded from VMFS-3 continues to have a file limit of 30,720 rather than new file limit of > 100,000 for newly created VMFS-5. This has an impact on the scalability of the file system.

Uses MBR

VMFS-5 upgraded from VMFS-3 continues to use MBR (Master Boot Record) partition type; when the VMFS-5 volume has grown beyond 2TB, it automatically and seamlessly switches from MBR to GPT (GUID Partition Table) with no impact on the running virtual machines.

Starts on Sector 128

VMFS-5 upgraded from VMFS-3 continues to have its partition starting on sector 128. Newly created VMFS-5 partitions will have their partition starting at sector 2048.

For more details you can see the link below:-
http://www.vmware.com/files/pdf/techpaper/VMFS-5_Upgrade_Considerations.pdf

VMFS-5 Enhancements

The following is a complete list of enhancements made in VMFS-5.

New Unified 1MB File Block Size

Earlier versions of VMFS used 1, 2, 4 or 8MB file blocks. These larger blocks were needed to create large files (>256GB). These different file blocks sizes are no longer needed to create large files on VMFS-5. Very large files can now be created on VMFS-5 using the new unified 1MB file blocks. Earlier versions of VMFS will still have to use larger file blocks to create large files.

Large Single Extent Volumes

In earlier versions of VMFS, the largest single extent was 2TB - 512 bytes. An extent is a partition on which one can place a VMFS. To create a 64TB VMFS-5, one needed to create 32 x 2TB extents /partitions and join them together. With VMFS-5, this limit for a single extent/partition has been increased to 64TB. This significantly reduces the management overhead when using very large VMFS volumes.

Smaller Sub-Blocks

VMFS-5 introduces smaller sub-blocks. Sub-blocks are now 8KB rather than 64KB as used in the earlier versions. With VMFS-5, small files (< 8KB, but > 1KB) in size will consume only 8KB rather than 64KB. This will reduce the amount of disk space stranded by small files. Also, there are many more sub-blocks in VMFS-5 than there were in VMFS-3 (32,000 on VMFS-5 compared to approximately 4,000 on VMFS-3).

Small File Support

VMFS-5 introduces support for very small files. For files less than or equal to 1KB, VMFS-5 uses the file descriptor location in the metadata for storage rather than file blocks. When these files grow beyond 1KB, they will then start to use the new 8KB sub-blocks. This will again reduce the amount of disk space stranded by very small files.

Increased File Count

VMFS-5 introduces support for greater than 120,000 files, a four-fold increase when compared to the number of files supported on VMFS-3, which was approximately 30,000.

ATS Enhancement

The Atomic Test & Set (ATS) Hardware Acceleration primitive is now used throughout VMFS-5 for file locking. ATS is a part of VAAI (vSphere Storage APIs for Array Integration). This enhancement improves the file locking performance over earlier versions of VMFS.

GPT

To handle much larger partition sizes, the GUID Partition Table (GPT) format will now be used to create VMFS-5 volumes. Historically, Master Boot Record (MBR) was used; however, this was limited to a maximum partition size of approximately 2TB. GPT overcomes this limitation and allows for much larger partitions to handle single extents up to 64TB (using VMFS-5).

New Starting Sector

VMFS-5 partitions will now have a starting sector of 2048. This is different from VMFS-3 which had a starting sector of 128. Moving to a starting sector of 2048 helps avoid alignment issues.


For more details you can see the link below:-
http://www.vmware.com/files/pdf/techpaper/VMFS-5_Upgrade_Considerations.pdf

Default Location for Sysprep Files on VMware vCenter Server 5.0


If vCenter Server is installed on Windows Server 2008 and above, <directory_path> is %ALLUSERSPROFILE%\VMware\VMware VirtualCenter\Sysprepwhich generally translates to C:\ProgramData\VMware\VMware VirtualCenter\Sysprep by default.

Note: C:\ProgramData may be a hidden folder.
If vCenter Server is installed on any other Windows operating system, <directory_path> is %ALLUSERSPROFILE%\Application Data\VMware\VMware VirtualCenter\Sysprep\ which generally translates to C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\Sysprep\ by default.

if vCenter is appliance then /etc/vmware-vpx/sysprep/

Under above mentioned location as per the vCenter version you have there are folder for Operationg Systems
like for Server 2003 32 bit there is folder svr2003. you need to copy the sysprep files after this while you deploy the VM using template or clone, wizard will offer you the choice to customize the OS...

for more details you can see
 http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1005593