Security is in our DNA at Nutanix. A significant proportion of our business is from sectors of industry that care deeply about security, including Federal Government, State Government, Local Government, Financial Services, Healthcare, Retail and more. This is why we build in security as an automated part of every configuration and deployment and by default it is on, and it is continuously monitored for compliance against the security baselines and Security Technical Implementation Guides. Unlike some vendors in the HCI space Nutanix doesn’t just have a single STIG, we apply multiple STIG’s, automatically, and continuously verify against them. But what is this STIG anyway?

The description of what STIG’s are is available on the Defense Information Systems Agency, Information Assurance Support Environment web site and I quote:

“The Security Technical Implementation Guides (STIGs) are the configuration standards for DOD IA and IA-enabled devices/systems. Since 1998, DISA has played a critical role enhancing the security posture of DoD’s security systems by providing the Security Technical Implementation Guides (STIGs). The STIGs contain technical guidance to “lock down” information systems/software that might otherwise be vulnerable to a malicious computer attack.”

Not only are these used by the US Federal Government and Department of Defense however, they are also the security configuration standard for many industries that are concerned about security. They can be incredibly comprehensive and run to many hundreds of pages of configuration details. Often each item in a STIG needs to be evaluated independently and the combinations of security settings needs to be tested to ensure they apply the correct hardening, but also do not break the required functionality.

When Nutanix decided to develop our STIG frameworks we decided to do everything in machine readable format to make it easy to maintain, and so that our software could automatically configure itself to a hardened standard. Nutanix automates the regular health-checking of the applied STIG, and if it’s not compliant, will reapply the baseline settings. Once the system is deployed it is hardened, it remains so after deployment, reducing the risk of mis-configurations by system admins. This saves our customers from all the manual configuration and potentially months of testing that comes with a manual process. Reducing latency, from deployment to production ready hardened system, is important when you want to have security as well as agility and lower cost of ownership.

Each component of the Nutanix Enterprise Cloud Platform is covered by the relevant STIG’s. This includes Nutanix AHV, as well as the Nutanix Controller VM, Prism Central VM(s) etc.

Let’s first cover the Nutanix Controller VM, Nutanix AHV Hypervisor and Prism Central VM’s. The base STIG that covers all of these main components is the Linux OS SRG or STIG (AHV/AOS up to 5.5). Prior to AHV/AOS 5.5 Nutanix had a more comprehensive custom STIG implementation than standard RedHat Linux v6 due to our user space design. From AHV/AOS 5.5+, Nutanix implements the RedHat Linux v7 STIG, these can be found under the Unix/Linux STIG Index and on the Nutanix Support Portal.

Next the individual components within the above Nutanix components are also covered by individual STIG’s or SRG’s. These include things such as Webserver’s – Apache, Application Server’s – Tomcat (Application Server SRG), and Java/JRE.

A full list of the available STIG’s from A – Z is available here. Sunset product STIG’s and SRG’s are available here.

If you are running VMware as a hypervisor on top of Nutanix you should evaluate the VMware Specific STIG’s, covering vCenter and vSphere. For a Windows vCenter Server you will need to apply the Windows STIG in addition to the vCenter STIG. For the vCenter Database you will need to apply the Windows or Linux STIG, in addition to the database STIG. All STIG’s would need to be applied correctly and tested. Be aware not all VMware products are covered by STIG’s, and not all products comply with the relevant STIG’s. You should seek specific advice from VMware if you have any concerns. If you are running Microsoft Hyper-V on top of Nutanix you should evaluate the Microsoft Windows STIG’s.

Final Word

In the age of increased cyber attacks and data breaches security is critical. You can choose to have manual hardening process and significant testing effort, or you can choose the Nutanix approach with automation, continuous compliance testing and reporting. Vendors should provide secured systems by default so it doesn’t take months to get to a production standard. This is the Nutanix philosophy.

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2017 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

vSphere 6 includes a new certificate authority that issues certificates for all of the different components within your environment to ensure communications are secure. If you want to use VMCA as a Subordinate CA from an Enterprise CA in your environment you need to change the VMCA Root Certificate on the Platform Services Controller (PSC) prior to installing vCenter or adding any new components to the environment. This article covers the steps in brief assuming you have a Windows based PSC and a Windows Enterprise CA (based on Windows 2012 R2).

The following assumes you are executing these commands from a Windows Platform Services Controller with vSphere 6.0. Note: Anywhere you see a single dash on this page it should be two dashes without a space – -. You may get errors if you just copy the text from this page.

Back up and edit “C:\Program Files\VMware\vCenter Server\vmcad\certool.cfg”, the default looks like this:

Country = US
Name= Acme
Organization = AcmeOrg
OrgUnit = AcmeOrg Engineering
State = California
Locality = Palo Alto
IPAddress = 127.0.0.1
Email = email@acme.com
Hostname = server.acme.com

“C:\Program Files\VMware\vCenter Server\vmcad\certool” –initcsr –privkey=privatekey.pem –pubkey=publickey.pem –csrfile=myrequest.csr

Submit the request to your CA, if you’re using a Windows CA (for example 2012 R2), you may be able to use the web interface or the command line tools. Ensure the certificate request is submitted as a Subordinate Certificate Authority request. For the web certificate submission use http://<YourCA>/CertSrv.  In most enterprise environments you would likely send the request to your security team or the team that manages the PKI environment.

When your request is approved download the certificate and certificate chain in base 64 encoded format. Download the Root CA Cert also in base 64 encoded format.

Now we have to create the combined VMCA and Root CA certificate chain file in pem format. To do this we copy the VMCA certificate and then the Root CA certificate to a new file.

For example:

type vmcacert.crt >> vmcaroot.pem
type rootcacert.crt >>vmcaroot.pem

This creates the combined pem file with both the VMCA Certificate and the Root CA certificate.

Your should now stop all services and start only those services to do with certificate management:

“C:\Program Files\VMware\vCenter Server\bin\service-control” –stop –all
“C:\Program Files\VMware\vCenter Server\bin\service-control” –start VMWareAfdService
“C:\Program Files\VMware\vCenter Server\bin\service-control” –start VMWareDirectoryService
“C:\Program Files\VMware\vCenter Server\bin\service-control” –start VMWareCertificateService

Now you add the new root VMCA certificate to the Platform Services Controller.

“C:\Program Files\VMware\vCenter Server\vmcad\certool” –rootca –cert=vmcaroot.pem –privkey=privatekey.pem

If you’ve done everything right you should get a message saying Status: Success

Now you can start all of the services again.

“C:\Program Files\VMware\vCenter Server\bin\service-control” –start –all

Note: For those wondering, yes the W in the service names is capital. Whoever wrote these service names didn’t talk to the marketing department about the capatalisation standards.

To verify the new root cert has been applied correctly run the following command:

“C:\Program Files\VMware\vCenter Server\vmcad\certool” –getrootca

If you want to remove the original root certificate then you will have to refresh the Security Token Service (STS) Root Certificate, and replace the VMware Directory Service Certificate.

Final Word

Now your VMCA as part of your PSC will issue certificates with the correct certificate chain and be trusted by any members of your domain. The communications between the components in your VMware vSphere 6 environment will be secure, and you shouldn’t get those annoying warning messages popping up.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com. By Michael Webster +. Copyright © 2012 – 2015 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

I normally bring you information about business critical apps such as Oracle, SAP, Java, SQL Server and the like, and the infrastructure configurations and performance that support them. But if you look at it any Virtual Desktop Infrastructure that is widely deployed to a larger percentage of an organisation, it is a business critical app. I’ve been involved in architecting and troubleshooting a few VDI environments over the last few years, one as big as 6,000 seats using Horizon View, and if we go back a bi,t a much larger environment using Citrix XenApp. I’ve seen many of the challenges, and I’ve seen what it takes to succeed. This is why today’s announcement from Nutanix is exciting, in that it brings all the benefits of VDI to organisations of any size, without all the risk and complexity that might have come along with it. Let’s take a look at the announcement and what an environment and infrastructure to support 10,000 Power Users’ VDI desktops might look like on Nutanix.

Nutanix today announced a major new initiative, coming hot on the heals of the recent patent announcement, that is set to disrupt the VDI market and make it uncompromisingly simple for any organisation to benefit from VDI. In a world first Nutanix launched its VDI Assurance program that takes the guess work and risk out of running a VDI environment of any size. Starting from as little as 150 VDI desktops you can scale up to any number, 10,000+. Now customers have the option of paying per VDI Desktop for their own Desktop as a Service infrastructure on premises, rather than being forced to go to a cloud provider. Purchase options don’t just include perpetual ownership, but also term based ownership of 1, 3 or 5 years. Nutanix termed this “the industry’s most comprehensive VDI solution” in their press release. The Nutanix offering is available for both VMware Horizon View and Citrix XenDesktop environments.

Traditionally VDI projects have struggled to succeed, due to the complexity and cost of legacy solutions, when trying to deliver an acceptable and high performance user experience. By Nutanix taking away the risk and guaranteeing that sufficient hardware will be implemented to meet the end user experience, anyone can implement a VDI solution with confidence. All a customer has to do is select the number and type of user profile they wish to support and Nutanix will take care of the infrastructure at a consistent and predictable price per desktop. This brings the transparency and benefits of Desktop as a Service Cloud offerings to Customers to run on premises. Disrupting and changing for the better traditional VDI business models, not just technology. To find out more about how you can deploy VDI with assurance in your environment in just three easy steps visit the Nutanix per Desktop VDI and Assurance page.

So what might an environment for 10,000 VDI Power Users look like? The image below has an example of what it might look like. This is based on the Power User Profile Nutanix described in the  Nutanix per Desktop VDI and Assurance program and includes all compute, storage, network and management infrastructure to run the complete solution.

As you can see from the above diagram you can achieve 10,000 Power Users in 4 racks, with the small management infrastructure footprint in a 5th rack and plenty of room for expansion. But this isn’t the limit by any means. Due to the way that Nutanix infrastructure linearly scales out you can keep growing the environment to meet whatever your business needs are.  You can start from as little as 150 VDI users and scale up as much as you like without reducing performance, or running out of capacity, and all without changing your architecture or design significantly. Now this really is uncompromisingly simple VDI. Note: This diagram is my creation and the assumptions I used to create it may be different to the Nutanix VDI Assurance Program architecture, your architecture and requirements might be different, this is an example and provided for informational purposes only without any warranty of any kind.

Final Word

The assumptions I used to create the diagram above is a Power User Desktop each consisting of 2 vCPU, 4GB RAM, 60 IOPS and 80GB raw storage (specifications according to the Nutanix VDI Assurance program). This works out to 56 persistent desktops per VDI host (23 hosts) plus 1 host failover and maintenance, 1288 desktops per VDI Cluster, 2576 desktops per rack.  I based the diagram on the Nutanix 3060 platform with an N+1 cluster resiliency architecture with 24 nodes per VDI cluster and 48 nodes per Nutanix cluster. There are 2 VDI Clusters per rack and one Nutanix cluster per rack. There is a vCenter Server managing each rack, which is located in the management cluster. The networking assumes a leaf-spine architecture with L2 leaf top of rack switches per rack connected to each of the L3 spine switches, two in this example.

—

This post appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2014 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

Another year has flown by, and what a year it was, and now we’re in a new year and I’m a year older and hopefully a little wiser, we never learn less. The great thing about being in the IT industry and especially being involved with Virtualization, Cloud and Software Defined Datacenters, there is always so a lot to learn and things are changing at an ever faster pace. All the time the economics and customers benefits are rapidly increasing all the time. I mean we don’t just do things because they are cool and technically interesting, there has to be an ROI for our customers, partners and customers organizations. It was great for me to personally be involved in revolutionizing many customers economics of delivering IT infrastructure and applications services throughout 2013, especially with the many Unix to VMware migration projects I was involved with. So this article will reflect on some of the highlights of 2013.

Firstly and most importantly I would like to thank all of you for taking the time to visit my blog and being part of the discussion, longwhiteclouds.com was viewed over 310,000 times during 2013. This is a big jump on the 2012 numbers. You can see the full 2013 report and number crunching thanks to jetpack in my Long White Virtual Clouds 2013 Year In Blogging Annual Report. It’s your feedback and being able to make a valuable contribution to the VMware and virtualization / cloud community that keeps me going. Here is a photo of the Long White Cloud (although a physical one) taken from the top of my street.

A very big thank you to my sponsors for supporting me and enabling me to bring you this content. Some sponsors have come and gone but Unitrends in particular has stuck with me pretty much all year. I want to thank them for their contribution to the VMware and virtualization community. I would also like to thank Cloud Physics for their ongoing support of the VMware community and for sponsoring this blog. Other sponsors throughout the year, which I also thank for their contributions are Nutanix (you’ll be reading a lot more about them this year), and Veeam. There are many other organisations that sponsor peer blogs in the virtualization and cloud community and I’d like to thank them for supporting the community that has been built up. Even though there were only 310K views on longwhiteclouds.com my sponsors received close to 500K impressions.

2013 Year in Review – Highlights

There were a number of highlights throughout the year but here are some that I think were the most memorable.

In early 2013 longwhiteclouds.com was voted by you into the list of Top Virtualization Blogs on vSphere-Land.com. It’s first entry into the list was in the top 25 (#21) out of 243 blogs that you voted from. Thank you so much for your support and I hope to do better next time around. Eric Siebert of vSphere-Land.com has recently released a history of the top blog voting over the years, it’s worth a read.

I was fortunate during 2013 to attend a number of conference events around the world including VMware PEX, HP Discover, VMworld, and vForum’s. At VMware’s Partner Exchange (PEX) I was involved in presenting bootcamps on virtualizing Business Critical Application, and also on the VCDX panels, which I qualified as a panelist for VCDX-DCV. I was very fortunate to be invited to attend HP Discover, which I wrote about in my articles Discovering HP Technology in Las Vegas and HP Discover 2013 Las Vegas Wrap Up. It was a great event and I and the other bloggers enjoyed it very much.

VMworld US was very special this year being the 10th annual event, it was also where we definitely bought back the Monster VM’s and Business Critical Apps in a big way and in the context of a Software Defined Datacenter.  You can see a recording of the VMworld Monster VM Design Panel VAPP4679, which was voted in the top 10 sessions of VMworld. Definitely a great highlight of 2013 to get one of my sessions into the top 10 at VMworld. Big thanks to my co-presenters (also VCDX) who made it happen – Frank Denneman, Andrew Mitchell, Mostafa Khalil and Mark Achtemichuk. This theme of Monster VM’s continued at VMworld in Barcelona and the vForums, where I was joined there by Melvin the Monster VM.

Above are a selection of some of the photos from this years VMworld and vForum events. From left to right. 1. Nutanix VCDX Cluster (we’ll be growing the size of this cluster shortly). 2. Melvin Monster VM with GeekFest DJ. 3. Melvin Monster VM Twins with John Troyer interview. 4. Melvin Monster VM running on a Nutanix block with Bas Raayman. 5. Melvin Monster VM with Cormac Hogan, Ken Werneburg and I. 6. Melvin Monster VM with Martin Casado and Paul Strong.

2013 was the year that Apps loved VMware even more, even low latency apps, business critical apps on VMware exploded with even more monstrous VM’s, and HPC. This was largely because of the release of vSphere 5.5. vSphere 5.5 has been an incredibly solid release and a great platform for all types of business critical apps. Amongst the highlights of vSphere 5.5 we see Record Breaking Network Performance, Microsoft Failover Clustering Enhancements and Jumbo VMDK’s.

During the past year Unix to VMware migrations have become much more common and in 2014 this momentum is likely to continue and gain even more pace. It’s no surprise that Unix system revenues continue to decline by double digit percentages. The economics of migrating Unix applications to VMware and Hyperconverged platforms such as the Nutanix Virtual Computing Platform make total sense. The Intel / x86 platforms have matured to the point where you do not have to compromise on availability, performance or service levels for the most demanding applications.

I continued my campaign of Fighting the FUD around Oracle Support and Licensing in a vSphere environment. I wrote a number of articles that can be found on my Oracle Page. This is a resource for you if you want to know anything about virtualizing Oracle Databases on vSphere. The articles include some very good stories from the field from both customers and partners. It definitely makes for interesting reading.

Late in 2012 based on frustation with the complexity and effort involved in improving security in vSphere environments with SSL Certificates I kicked off a project with VSS Labs, a VMware partner based in Singapore, to provide a solution. The goal, which the solution achieved, was to provide better vSphere platform security for the masses at an affordable price. This involved a complete SSL Certificate lifecycle and compliance tool, which turned into vCert Manager. vCert Manager went GA during 2013 and VSS Labs had a booth at VMworld. The solution provides a simple and automated way of keeping all the SSL certificates in a VMware environment up to date, including integration directly with the Certificate Authorities, as well as reporting on ongoing compliance. It also understands VMware concepts such as Lockdown Mode, Maintenance Mode and Auto Deploy. The demo VSS Labs showed at VMworld is included in my article VMworld USA 2013 by the Numbers.

VMware and SAP were shaking up enterprise apps during 2013 with their announcements around not only running SAP ERP applications in VMware clouds (public/private/hybrid), but also running HANA in VMware clouds, and putting ERP and HANA software on the VMware price book in a pay as you grow by the month subscription licensing model. The subscription based licensing model along really changes the game for enterprise software and especially for it’s consumption in cloud environments. Although these announcements were made in 2013 not all of the component pieces are yet in place. But when everything is delivered it will be one heck of a powerful combination. Throughout 2014 you’ll also see how SAP can be levered in Hyperconverged environments, including on the Nutanix Virtual Computing Platform. So watch this space.

At VMworld USA 2013 we saw Cloud morphed into SDDC. After a few years of experimentation with Cloud VMware decided that it’s for service providers and for enterprises what is actually needed is a Software Defined Datacenter, and all the declarative, automated, policy driven goodness that goes with it, while allowing for hybrid cloud models at the same time. This was the inspiration for my article titled vCloud Director is Dead, Long Live vCloud Director. There are still a lot of use cases for vCloud Director and at the moment vCloud Director is a great way of enabling components of the Software Defined Datacenter vision, while the other components are bedded down a bit more and become more mature. VMware’s NSX, which was a real highlight of VMworld will also play a big part in the SDDC vision of the future. Abstract, Pool, Automate all with service and policy defined up front and easily consumable.

Converged become Hyperconverged, even for business critical apps. Over the last few years there has been a lot of talk about converged infrastructure. Some vendors did a better job of it than others. Some completely missed the boat all together and instead of converged just delivered pre-assembled. It’s not the same thing. Even so, throughout 2013 Hyperconverged technologies, such as the Nutanix Virtual Computing Platform, which combine compute and storage into a single and simple solution, really started to accelerate. There are other solutions in the Hyperconverged category but Nutanix is clearly the leader in this space. Next year this market will go supersonic. Primarily driven not by just convergence of different components, but by the sheer radical simplicity of deploying, managing and scaling the platforms.

Instead of a hodge-podge of pre-certified and pre-assembled components, you get one beautifully elegant, completely integrated solution in a single small package, which is still flexible and capable. This is not only going to go supersonic next year (more so than it did this year), it’s going to swallow business critical apps, including Unix systems. It’s not however going to replace all of the scale up platforms, as they will still be needed for a percentage of workloads, but anything that can work on a scale out platform virtualized computing platform (majority of systems) will be fair game. The units of scale will also keep increasing.

If you don’t believe me here’s proof. Melvin Monster VM running on a Nutanix 3450 block in my lab :).

With all these trends and opportunities it’s no wonder that I joined Nutanix as an employee in late November 2013. The opportunities around virtualizing business critical apps and Unix to VMware migrations on the Nutanix Virtual Computing Platform are monstrous. You’ll see a lot more discussion on the architectural considerations as we move into 2014 and I begin to publish reference architectures and white papers on it. Till then you can review my Nutanix articles here and here.

Late in 2013 I had the pleasure of being invited to join other industry experts, such as futurist Paul Saffo and one of VMware’s CTO’s,  in a Google Plus Hangout on the Future of IT. If you didn’t catch the event you can watch the recording on YouTube. Check out my article on this here. This looks at a lot further out than just 2014. But I think you’ll agree there is some interesting things on the horizon.

There are still some unanswered questions about 2013, such as, was it the year of the desktop? Was 2013 the year of flash storage? Well the jury is still out on that. But if 2013 wasn’t either of those things you can be sure that 2014 has a good chance of being both. I would predict both will become pervasive in 2014. End User Computing and Mobility and Flash Storage. Brining flash closer to applications, through Hyperconvergence (i.e. Nutanix) most likely, or through other means. Both support each other, and both are dependant on each other for economies of scale. Again, watch this space.

Final Word 

Last but my no means least I have to look back over 2013 and be thankful that I have a wonderful wife and family that support everything I do. If it wasn’t for their support I would not be able to continue this blog or contribute to the community at large. They put up with my late nights and with my travel schedule. Speaking of which I was only in my home country of New Zealand for 10 weeks during 2013. 2014 will be much more balanced. You know the saying happy wife, happy life, well it’s true. Here is a photo taken shortly after my return from VMworld Barcelona. Thanks to Shiv Diddee, one of VMware’s Super TAM’s from the UAE for the Dubai T-Shirts they made me very popular and we’re getting good use out of them. From left to right, Sebastian (6), Bradley (3), Susanne, Benjamin (1). We’re expecting our 4th boy in April 2014.

—

This post appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2014 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

If you’re upgrading from vSphere 5.1 to vSphere 5.5 and you ARE NOT using Custom CA SSL Certificates then you might run into an error. The error will be encountered during the upgrade of SSO, and specifically the Lookup Service, and only occurs in specific conditions, such as when using the default VMware Self-Signed Certificates. If you run into this problem your upgrade process will roll back, but leave behind some upgrade files that need to be cleaned up. This article will briefly touch on the recommended solution to this problem.

Many of you will recall the many articles that I wrote regarding updating the default self-signed SSL Certificates in vSphere 5.0 and 5.1 to Custom CA Certificates. If you haven’t seen these articles and you’re interested in SSL Security you can check out Updating CA SSL Certificates in vSphere 5.1 and Updating CA SSL Certificates in vSphere 5. To make the process of updating certificates easier VMware created the VMware Certificate Automation Tool and VMware Partner VSS Labs created vCert Manager.  If you’re using CA Signed Certificates for your SSL communications between the various vCenter components then you won’t strike the problem I described above. So now might be a good time to review my previous articles and/or use one of the automation solutions that are available.

This issue during the upgrade from vCenter 5.1 to vCenter 5.5 is described in the VMware KB Article – Upgrade from vSphere 5.1 to vSphere 5.5 rolls back after importing Lookup Service data (2060511). You will likely see an error such as “Warning 25000. Please verify that the SSL certificate for your vCenter Single Sign-On 5.1 SSL is not expired. If it did expire, please replace it with a valid certificate before upgrading to vCenter Single Sign-On 5.5.” or the vCenter Upgrade will simply fail and roll back. In the vim-sso-msi.log you will see an error message like the following:

“Action 10:06:03: PostInstallScripts. Importing Lookupservice data…
CustomAction DoUpdateAndMigrateTasks returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)”

As described in the VMware KB this issue does not affect you if:

• You are using custom certificates (recommended)
• You are using the vCenter Server Virtual Appliance (only applies to the Windows version of vCenter Server)
• You are performing a fresh install of vCenter Server 5.5
• You are upgrading from:
  • vCenter Server 5.0
  • vCenter Server 4.x
  • a fresh install of vCenter Server 5.1 Update 1a or later

For the recommended fix please refer to the VMware KB – Upgrade from vSphere 5.1 to vSphere 5.5 rolls back after importing Lookup Service data (2060511). The fix will require modifying the Windows Registry. Before any upgrade of vCenter is attempted it is recommended that you take a backup and potentially have a snapshot in place for the vCenter Database and the vCenter Server system itself so you have a point you can roll back to. This should be standard practice in most VMware environments, as should testing the upgrade process, as should upgrading test environments and management environments before upgrading production. Given that this impacts environments that have self-signed certificates it has the potential to impact a large number of customers, however as it only impacts customers upgrading from vCenter 5.1 prior to version Update 1a to vCenter 5.5, the number of impacted customers is reduced.

Final Word

The easiest way to get around this problem if you’re using vCenter 5.1 would be to either run through the registry fix described in the KB article. Upgrading to vCenter 5.1 U1b will not correct the issue as it doesn’t correct the certificate. You may also choose to completely rebuild your vCenter with a fresh install of vCenter 5.5 against your existing database. Alternatively you may choose to update your vCenter Server to use CA Signed Certificates, which will also improve the security of your critical management infrastructure. Regardless of the option you choose make sure you have a backup of the vCenter Database and vCenter so you can roll back if needed.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

VSS Labs will be showcasing its latest offerings at the New Innovator Pavilion at Booth 2035 at VMworld USA 2013. The two offerings include it’s globally successful and VMware exclusive Cloud Migration Portal and it’s new SSL Certificate lifecycle management product vCert Manager. Lets have a look at what these two products are all about to give you a glimpse of what you might find out at their booth at VMworld USA.

Cloud Migration Portal Takes The Manual Out of Migrating To The Cloud

Automated migration of workloads from physical to virtual, virtual to virtual and now a new prototype that shows the automated migration from Amazon’s AWS to VMware’s vCHS.  VSS Labs will be showing an early prototype of a solution to fully automate migration of workloads from Amazon’s AWS (Amazon Web Services) to VMware’s new vCHS offering – VMware vCloud Hybrid Services. This prototype is expected to be fully integrated into the VSS Labs Cloud Migration Portal (CMP) by Q4, 2013. CMP is a fully automated solution that manages and automates large scale any to VMware vSphere environment migration projects. It has deep integration with the VMware stack and cuts down migration times by a factor of 5x or more. VMware has exclusively licensed CMP from VSS Labs for use at no charge by its partners, clients and internal professional services organizations and has used this with great success in a number of migration projects now. This latest addition will no doubt create huge value for the burgeoning interest in vCHS.

VSS Labs Brings You The Big Red Easy Button for VMware SSL Certificate Lifecycle Management

VSS Labs have just announced the GA release of vCert Manager, their fully automated lifecycle management solution for managing SSL certificates in a VMware environment. This is the culmination of almost a full years development, testing and feedback in a collaborative way with many of the worlds largest organisations and the VMware community.

Security and compliance requirements now force VMware’s large customers including the largest banks to implement trusted SSL Certificates and they can’t use the default self-signed certs that ship with off the shelf products any longer. Moreover, all US government organizations will be required to have certificates of greater than 2048 bit strength by the end of 2013. vCert Manager provides an automated solution to these issues and can scale from handling small environments to those containing dozens of vCenters and thousands of hosts.

The GA release of vCert Manager follows an extensive beta program that VSS Labs ran with a number of large enterprises and incorporates several features and enhancements that resulted from feedback from this program. vCert Manager 1.0 includes the ability to update and manage SSL certificates for vCenter Server (including multi-located SSO and other vCenter components), ESX/ESXi host certificate, with the ability to automatically change revoked certificates, do bulk certificate import, export of certificate signing requests, early warning and replacement of expired certificates and a number of other features. Derek Seaman covered the vCert Manager capabilities well in his article VMware SSL Pain? vCert Manager to the Rescue.

One of the best things about vCert Manager is that VSS Labs will be providing a FREE limited edition for home lab use. If you want to use vCert Manager in a home lab you’ll be able to get a license to use it on up to 1 vCenter and 5 hosts. If you’re a VMware vExpert there is a special edition license for you that will allow you to use vCert Manaer on up to 2 vCenters and 10 hosts. This is a great way for VSS Labs to show its support for the VMware Community that was so instrumental in the development of the vCert Manager solution.

Where can I get it!? 

To learn more about both these offerings or to request for an evaluation version, go to www.vsslabs.com, or contact Luisa Juaton deGuzman using the form at the bottom of this post.

Final Word

To make large scale cloud migration and secure management of the environments afterward possible you need great automation tools. VSS Labs and VMware bring you such levels of automation. It’s great to see the two companies working together in partnership to deliver such great value to customers. If you are going to VMworld USA I would strongly encourage you to check out the new Innovator Pavilion at Booth 2035 and stop by the VSS Labs area to get a full demo of both of these products. Remember if you want to request an evaluation or find out more about the products above from VSS Labs you can use the contact form below. Don’t forget to check out Derek Seaman article on vCert Manager – VMware SSL Pain? vCert Manager to the Rescue.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

One of the most important documents for any vSphere administrator or architect has been released. The vSphere 5.1 Hardening Guide is now available. The guide was announced on the vSphere Blog by Mike Foley – vSphere 5.1 Hardening Guide – Official Release. I’d like to thank Mike and the rest of the VMware Security Team that was involved in putting this invaluable resource together. It has been reformatted from the previous version to make it easier to use. I think you’ll all like the new improvements.

This is an essential resource for enterprise and secure environments. I also hope that all VMware customers take the time to review this as a lot of the recommendations can be easily implemented and greatly improve the security of your environments. Of course this isn’t the only measure you need to take to protect your environment, keeping up to date with patches of your VMware software is also important as part of your overall security strategy.

Please bare in mind that the guide has been created to be applicable to all VMware environments, but that not all settings or recommendations will be relevant to all environments or all customers. You should review the settings and make a determination as to which settings are applicable to you. VMware has made this process easy by defining different profiles within the guide. So you should look at the profile (explained on the intro page of the guide) that best fits your environment and then review the settings that fit into that profile.

The guide itself is available here. The change log is available here. The central location for all of the VMware hardening guides is http://vmware.com/go/securityguides and this will be the permanent home for the vSphere 5.1 hardening guide also.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

Want to be able to change the SSL Certificates on your vCenter Servers and vSphere Hosts to properly signed CA certificates at the click of a button? Want to be able to automatically apply certificates to Auto Deployed Hosts? Need a solution that covers vSphere 4.0 through to 5.1? Can detect and alert you to expiring or revoked certificates and change them for you? Something that provides complete SSL Certificate lifecycle management for your vSphere environment with all the reporting, alerting and audit logs you’d expect? Then vCert Manager might be the tool for you and I’ve got a demo of the beta version to wet your appetite.

I wrote an article regarding a few months ago titled vCert Manager – Changing VMware SSL Certs Made Easy, which included a demo of a very early prototype that I presented at VMworld USA in August 2012. The prototype showed how in concept vCert Manager could automatically replace SSL Certificates in vSphere environments with integration back to a windows CA. A few months on now and VSS Labs, who is the company developing the solution, has released a demo of the beta version. The beta is now being tested by select customers who have signed up to the early adopter program. Check out this demo to see how the product has progressed and get an idea of it’s capabilities.

I think you’ll agree that the vCert Manager Beta has come a long way since the very early prototype I presented at VMworld and wrote about previously. The work is not over though. There is still a little way to go to get everything feature complete and enterprise ready and before it is ready to be generally available. The work is progressing well. The demo below is only 16 minutes long, so won’t take up much of your time.

Final Word

I know how much pain changing SSL certificates is and the goal of vCert Manager is to take this pain away and provide a solution that makes it affordable for all vSphere environments to become more secure. I’d greatly appreciate your feedback on the vCert Manager beta demo. Your suggestions and feedback will help VSS Labs make vCert Manager a great product.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

I was upgrading my VMware View environment recently from 5.0 to 5.1 and wrote about some initial problems in my article Trouble Recomposing View 5.x Desktops After Upgrade to vSphere 5.0 U2. After I had resolved those initial problems I needed to load my internal Root CA certificate onto all my company’s iPhone’s and iPad’s. This is because one of the big changes or improvements in View 5.1 is with security and you now need trusted certificates in order to connect to any of the desktops. Fortunately there is no need to purchase expensive public certificates if you have an internal corporate PKI / CA’s already configured, unless you want to. This article will show you how you can easily get your iPhones or iPad’s to trust your corporate CA certificates for use with VMware View.

I’ve included images here to explain the process as I think it’s easier to follow. I used one of my iPhones to keep the images reasonably small. To be honest you’re much more likely to be doing this on an iPad. But iPhones are perfectly usable in my opinion provided  you have the iPhone to VGA adapters and a Bluetooth Keyboard.

Trying to Connect Without Trusting the Certificate

If you try to connect to a VMware View 5.1 environment using the iOS View Client without first trusting the CA certificate you will receive a message as per the image below:

If you click on View Certificate you will see some details about the untrusted certificate:

There is no way to set your device to trust your CA certificate from this screen. In order for you to get your iPhone or iPad to trust the certificate you will need to follow the process below.

Getting Your iPhone or iPad to Trust Your CA Certificate

1. Obtain a copy of the CA Certs (Root CA and Intermediate CA if used) and email them to your device, such as in the following image:

You’ll notice the attachment in the image above shows a certificate type icon.

2. You now need to tap on the attachment. You will be presented with the following screen:

At this point before continuing  to the next step you should click on More Details. You should verify that it is indeed the certificate that you were expecting, it’s form your corporate CA, and that it is valid and should be trusted. Once you are satisfied this is indeed a legitimate certificate that you should trust you continue.

3. Tap Install.  You will see the following warning image displayed on the screen:

Because your corporate CA is not a trusted public CA it is not automatically in the trusted list for your devices. This is the reason this warning is being displayed. Provided you are happy with the checks you’ve done in the previous step, after reading this warning you can continue to the next step.

4. Tap Install. You will see the following image displayed on screen:

At this point you need to enter your passcode so that the certificate can be loaded into your devices trust store and be trusted. Once you have entered your passcode successfully you will automatically be at the next step.

5. You have successfully loaded your corporate CA certificate into your devices trust store. You will see the following image displayed on the screen:

Now when you connect using the VMware View Client your Connection Servers certificates, which were signed by your corporate CA, will be trusted and your connections will be successful. If you have  more than one CA that needs to be trusted you need to complete these steps for each of the certificates. You can now Tap Done and go back to the VMware View Client and test the connections.

6. Now when connecting to your VMware View Connection Servers or Security Servers an image similar to the following will be displayed on screen:

You can see by the tick on the padlock and the text https being displayed in green that the certificate and connection are trusted. If the connections weren’t trusted you wouldn’t have been able to connect. Enter your username and password and then tap done or go.

7. You will receive the list of entitled desktops similar to the image below and you can no proceed to use your desktops as per normal. This process is complete!

Removing a Certificate From Your iPhone or iPad Trust Store 

If for some reason you find out that a certificate has become invalid or has been revoked you will need to remove it from the trust store on your iDevice. To do this is very simple.

1. Tap Settings.

2. Tap General. You will see on the screen something similar to the following:

You can see the profile listed and the name of the CA in this example.

3. Tap Profile. You will see on the screen something similar to the following:

4. Tap  Remove. You will see a warning displayed similar to the following:

5. Tap Remove. You will see the passcode dialog box displayed as per the image below.

6. Enter your passcode. You will be returned to the settings screen and you’ll notice as per the image below that the profile has now gone.

You have now completely removed the certificate from your devices trust store. When the new certificates are issued you can go back and follow the process to install them again.

Final Word

As you would expect Apple has made it fairly painless to get this all working. However when it comes to security and trusting certificates great care needs to be taken. You must verify that the certificates that are being sent to you for use are genuine and can be trusted. If for some reason the certificates expire, are revoked or for some other reason invalidated then you need to follow the process to remove the certificates from the trust store and then install the new ones. I hope this has been helpful and that you get hours of productivity out of your VMware View 5.1 vDesktops from your favourite iDevices.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2013 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.

Microsoft recently issued a security advisory and a patch that blocks any certificates with a key length less than 1024 bits. This has impacted a wide variety of systems including VMware Site Recovery Manager 5.0 and below. This article will provide you a way to quickly regenerate the self-signed SRM certificates.

Background

The Microsoft Advisory and related information can be found in Microsoft Support KB 2661254. I would encourage you to read this article as the impact is wider than just VMware SRM and other VMware products.

Although I’m going to show you a way of generating self-signed certificates here for the use with SRM I would recommend using trusted CA certificates if possible to reduce the risk of man in the middle attacks. However the effort required to set up a CA and issue the certificates is far more than what I’m about to explain. This is the quick way to work around this problem until you come up with a better solution, which may include getting CA issued certificates.

Note: This process is not officially supported by VMware and says as much in the output of the command. So use this at your own risk and I would encourage you to test it in an isolated environment prior to applying this to any production system. Always take a backup of existing certificates before making any modifications. These instructions should work for any versions of SRM 5.1 and prior.

Generate New Self Signed SSL Certificates for SRM

There is a file called CertGenUtil.exe that is shipped with SRM and used by the installer to create the default self-signed SSL certificates. The version included in 5.0 and prior only generates 512 bit keys, which are not sufficiently strong after you’ve applied the MS patch. The MS patch requires 1024 bit keys or higher. Fortunately the version of CertGenUtil.exe shipped with SRM 5.1 generates 2048 bit keys and can be used to re-generate the certificates for use with versions of SRM include 5.0 and prior. You may need to use this if you are upgrading from SRM 5.0 to 5.1 also as the certificates are not generally replaced during an upgrade process. I have not yet tested the upgrade process of SRM 5.0 to 5.1 to see if it’s any different to previous versions with regards to the update of the certificates.

To use CertGenUtil.exe you will need to create a short config XML file so that it will generate the SSL Certs Correctly. The following is an example:

<config>

<DR_CERT_SERVER>SRMSERVERIP</DR_CERT_SERVER>

<DR_CERT_ORG>YOURCO</DR_CERT_ORG>

<DR_CERT_ORG_UNIT>YOURORG</DR_CERT_ORG_UNIT>

</config>

Replace SRMSERVERIP with the IP Address of your SRM Server, YOURCO with your company and YOURORG with your OU. Save the config file in an easily accessible location on the server where you’ll install SRM 5.1, such as c:\ or c:\temp, in the example below I’ve saved the file as srm-certcfg.xml in c:\temp. Note: you only need to install SRM 5.1 to get the CertGenUtil.exe, you are not required to upgrade your environment to SRM 5.1. So it would pay to do this in a test environment with a SQL Express instance and a test VC.

By default the CertGentUtil.exe file is located in c:\Program Files\VMware\VMware vCenter Site Recovery Manager\bin

On a server installed with SRM 5.1 or that contains the SRM 5.1 CertGenUtil.exe file execute the following command:

c:\Program Files\VMware\VMware vCenter Site Recovery Manager\bin\CertGenUtil.exe -cfg c:\temp\srm-certcfg.xml

You will notice this line appears immediately:

VMware internal use only. This program is intended for use only by the SRM installer.

Follow the on screen messages that are displayed.

Installing The New Self Signed SSL Certificates

After the certs are generated you need to install them in the trusted certs store of both SRM Server and also both of the vCenter Servers (Protected and Recovery Sites). This is as simple as logging into the systems as administrator coping the new Cert file across and double clicking it to install it in the cert store (Follow the wizard). You will need to go through SRM and do a ‘Modify’ install and use your new certs in .p12 format. You may need to restart the SRM Services on both SRM Servers before the new certificates will be loaded into memory.

Final Word

I hope this helps if you quickly need to regenerate the default self-signed SRM Certificates for 4.x and 5.x to be compliant with the new MS patch. I would recommend that you use CA signed certificates to improve security and reduce the risk of man in the middle attacks, so this should be viewed as a temporary measure. This should allow you to continue to run your existing systems till you are able to upgrade to SRM 5.1.

—

This post first appeared on the Long White Virtual Clouds blog at longwhiteclouds.com, by Michael Webster +. Copyright © 2012 – IT Solutions 2000 Ltd and Michael Webster +. All rights reserved. Not to be reproduced for commercial purposes without written permission.