New Security Issues Raised by Server Virtualization

Many organizations are relying on the IT policies, processes and toolsets established in the “pre-virtual” datacenter to manage and protect virtual servers, which makes sense. However, virtualized environments do face the same operational threats and risks as traditional servers. But, there are also some specific server security implications that must be considered.

New Operating System

The virtualization layer, is effectively another operating system in the data center – the first in a long time that brings configuration and patching issues.

The good news is that hypervisors tend to carry a much smaller footprint than a traditional operating system with a correspondingly lower potential for security holes. And you will not find a hypervisor surfing the Internet and downloading code. But at the same time it is still relatively immature product, and vulnerabilities are continually found. These vulnerabilities are usually quickly fixed, but should be monitored and tracked.

The maturity of hypervisor technology also shows in its vetting and certificating infrastructure. Plug-ins and add-ons, for the most part, do not go through the testing and certification processes that we see on standard OS’s which can be problematic.

New Target in the Datacenter

Given its access to multiple Virtual Machines (VMs), the hypervisor is an obvious target for attackers, which if compromised could potentially provide access to a range of servers rather than a single “physical” server. And, you only have to look at the buzz coming out of the Black Hat conferences to understand how much of a target the hypervisor represents.

Intrahost threats

A successful guest breakout, would result in an attacker gain access to all traffic from the virtual machines. This was an attack in a lab, but you can bet these researchers are not the only ones in this race.

Referred to as “Hyperjacking”, an attack like this would lead to a compromised platform, allowing full access to all hosted guests. Malicious software could also disguise its presence from traditional security tools that reside in software layers above the hypervisor.

While from a pragmatic point of view, we have not yet heard of a working prototype or found a virus in the wild that attacks the hypervisor yet; - the writing is on the wall and it is only a matter of time before we do.

Existing Security Tools

The traffic inside the host effectively occurs on a “private LAN”, meaning that traditional network server security tools cannot see it, making it impossible to inspect or protect traffic inside this “dead zone.”

Also, many types of security and monitoring tools need to know what they are protecting and where it is in order to be effective - the mobility of VMS can be problematic here.

Other security technologies like IDS, IPS, Data Leak Prevention and Malware Prevention also can be impacted. The constant change enabled by virtualization can place dynamic demands on any “static” types of security solutions, in even small virtualized infrastructures.

Increased Risk of Sprawl

With virtualization we are now dealing with environments where traditional control systems and processes does not work very well, where IT staff is having to plug the gaps with manual process and tracking, and where new VMs can be deployed in minutes. This means a much higher risk of sprawl in the virtual world than in the physical.

In working with customers we have found that most organizations with reasonable control systems will still have around 30 percent of the VMs in their environment that are unnecessary or obsolete, but it takes an audit to figure out which ones and where they are.

Sprawl also increases complexity. Running more VMs in the environment than you need make it

* More difficult to spot the dangers
* More difficult to maintain configurations, and
* More difficult to troubleshoot

Source: itworld.com/virtualization/59445/new-security-issues-raised-server-virtualization

How To Create an MS-DOS Network Startup Disk in Windows Server 2003

Windows Server 2003 does not contain an equivalent to the Network Client Administrator tool that is included with Microsoft Windows NT Server 4.0. You can use the Network Client Administrator tool to create an MS-DOS network startup disk. You can run the Network Client Administrator tool for the x86 platform in Windows Server 2003.

Set Up the Network Client Administrator Program

• 1. Create a folder that is named Ncadmin in the root folder of drive C.
• 2. Copy the following files from the I386 folder on the Windows NT Server 4.0 CD-ROM to the c:\Ncadmin folder you created in step 1:
• Ncadmin.cn_
• Ncadmin.ex_
• Ncadmin.hl_
• NOTE: You also must have access to the CD-ROM drive letter:\Clients folder on the Windows NT 4.0 CD-ROM.
• 3. At a command prompt, change to the C:\Ncadmin folder.
• 4. Type expand -r ncadmin.*, and then press ENTER.
• 5. Double-click the Ncadmin.exe file in the c:\Ncadmin folder, and then follow the instructions on the screen to create an MS-DOS network startup disk.

Via: support.microsoft.com

some important features in Windows Server 2008 R2

Microsoft plans to release an R2 edition of Windows Server 2008 in 2009 or 2010. Here are the key features of the R2 release that you need to know.

The most prominent is that Windows Server 2008 will solely be an x64 platform with the R2 release. This will make the upgrade to x64 platforms not really a surprise, as all current server class hardware is capable of 64-bit computing.

There is one last window of time to get a 2008 release of Windows still on a 32-bit platform before R2 is released, so do it now for those difficult applications that don’t seem to play well on x64 platforms.

Beyond the processor changes, here are the other important features Windows Server 2008 R2:

Hyper-V improvements: The Hyper-V is planned to offer Live Migration as an improvement to the initial release of Quick Migration; Hyper-V will measure the migration time in milliseconds. This will be a solid point in the case for Hyper-V compared to VMware's ESX or other hypervisor platforms. Hyper-V will also include support for additional processors and Second Level Translation (SLAT).

PowerShell 2.0: PowerShell 2.0 has been out in a beta release and Customer Technology Preview capacity, but it will be fully baked into Windows Server 2008 R2 upon its release. PowerShell 2.0 includes over 240 new commands, as well as a graphical user interface. Further, PowerShell will be able to be installed on Windows Server Core.

Core parking: This feature of Windows Server 2008 will constantly assess the amount of processing across systems with multiple cores, and under certain configurations, suspend new work being sent to the cores. Then with the core idle, it can be sent to a sleep mode and reduce the overall power consumption of the system.

All of these new features will be welcome and add great functionality to the Windows Server admin. The removal of x86 support is not entirely a surprise, but the process needs to be set in motion now for how to address any legacy applications.

Source:zdnetasia.com/techguide/windows/0,39044904,62048917,00.htm

Windows Server 2008 Evaluation Enterprise Edition and Server Core Virtual Hard Drive Images

The Microsoft VHD format is the common virtualization file format for Virtual PC, Virtual Server 2005 and Hyper-V that provides a uniform product support system, and provides more seamless manageability, security, reliability and cost-efficiency for customers.

This VHD release is available in English only and is for evaluation and testing purposes. Evaluating Windows Server2008 software does not require product activation or entering a product key. Any edition of Windows Server 2008 may be installed without activation and evaluated for an initial 60 days.

If you need more time to evaluate Windows Server 2008, the 60 day evaluation period may be reset (or re-armed) three times, extending the original 60 day evaluation period by up to 180 days for a total possible evaluation time of 240 days. After this time, you will need to uninstall the software or upgrade to a fully-licensed version of Windows Server 2008.

As this installation requires Hyper-V, you will need to have a base install of Windows Server 2008 (64bit edition), running Hyper-V.

Both virtual machines available here are running Windows Server 2008 Enterprise Edition Evaluation. One is the default full installation, and the other has been configured as a default Core installation. For more information on the difference between full and core installation please see the Windows Server 2008 Editions Overview pages. For download options please see the IMAGE SELECTION section in the instructions below.

As both virtual machines do not have anti-virus installed, they should not be connected to any network until it has anti-virus installed. In addition, the operating system and programs installed were patched with all updates as of May 8, 2008.

The following download is for Hyper-V deployments. If you are looking to evaluate Windows Server 2008 on Virtual Server 2005 then please visit: Windows Server 2008 Evaluation VHD Images (for VS2005).

Via:dabcc.com/downloadfile.aspx?id=650

Microsoft updates SMB server line

Microsoft Corp. has updated its all-in-one server for small businesses, and added an additional product to its server line for mid-sized businesses with up to 300 users.

Windows Small Business Server accommodates up to 75 users, while larger businesses now have the option of Windows Essential Business Server 2008, according to Constanza Zalba, product manager for SMB servers for Microsoft Canada.

“Canada is primarily a small and mid-size country,” Zalba said. And Canadian SMBs tend to view IT differently from their American counterparts; while only 30 per cent of U.S. SMBs have an internal IT staff, 60 per cent of Canadia SMBs do, she said.

“Technology takes on a much more strategic importance in the company (in Canada),” she said.

Steve Tong, manager of information systems for Toronto Grace Hospital, said the hospital had been running the 2003 version of Small Business Server. The central management window for SQL, Exchange and SharePoint servers “made the difference” in the decision to go to EBS.

“It almost gives me a dashboard view in the morning” of the status of the network, Tong said. Using the single server package means a 30 to 40 per cent savings, and a reduction from seven servers to three.

Grace’s IT staff of three – supporting 275 users on about 100 machines -- had only a week to migrate the system onto the new platform, but since it has a similar look and feel to SBS 2003, they were confident they’d be able to go live on time, Tong said. The migration took place in 10 to 12 hours over a weekend.

An included migration tool checks for active directory and DNS issues and the like, then graphically designs the new network, saving the design as an XML file.

The server was deployed on an Intel Modular 5000 server with an integrated storage area network donated by Intel Corp.

Via:itworldcanada.com/a/Daily-News/6eaf3a92-63af-4191-98f9-b26ca224a050.html

Microsoft Demos Windows Server 2008 R2

Bill Laing, vice president of Windows Server and Solutions, and Rob Williams, Microsoft's senior program manager, presented and demonstrated Windows Server 2008 from the small business to the enterprise. Specifically, they presented Windows Server 2008 R2, which will tentatively be released in 2010.

The keynote started with a presentation of 24 categories of Windows Server 2008, from home server up to enterprise class server flavors.

The first product presented was the upcoming Small Business Server and Essential Business server updates to Windows Server 2008. These will be presented on November 12 on the Microsoft Web site, hedreamserver.com. Essential Business Server is aimed at small- and medium-sized businesses that need server functionality but don't already have a server.

The meat of the presentation was several demos of the upcoming Windows Server 2008 R2. R2 is currently in pre-beta, and the full beta is expected next year. As previously announced, R2 will be 64-bit only, with support for x64 and Itanium. R2's features include streamlined management tools, integration with Windows 7, an enterprise class foundation, and enhancements for virtualization and consolidation.

Windows 7 support will include the seamless integration of Windows 7 PCs with the corporate environment, whether that PC is on the corporate LAN or on the Internet.

Laing and Williams demoed a Windows 7 PC that was connected to the Internet and the Microsoft corporate network, even though the PC is physically in Los Angeles and the corporate LAN is in Redmond, Wash. The PC connected seamlessly without the need for extra VPN software. The Windows 7 PC was also subject to corporate group policy updates, in this case a mandate that external USB drives be encrypted with BitLocker.

They also demoed enterprise-class scaling with a SQL server running 192 logical cores (combination of "real" silicon and HyperThreading). R2 will be scalable up to 256 logical cores, up from the current 64 core support in Windows Server 2008.

Last but not least, there was a demo of Hyper-V, the latest in Windows Server virtualization. Hyper-V was shown running instances of Vista, Windows Server 2003 with multi-core and 64-bit support, and Linux. The last demo was when Williams moved a running VM from one physical node to another, without any hiccups or having to reboot the VM. To the end user, this would've seemed like nothing had happened.

Source:pcmag.com/article2/0,2817,2334055,00.asp

Microsoft announces Windows Server 2008 R2

Microsoft has released details of the upcoming second release of its Windows Server 2008 operating system at its Professional Developers Conference in Los Angeles this week.

The updated OS includes a range of new features, including support for web applications, better virtualisation and improved scalability and reliability.

Virtualisation will be a key feature of the new OS, with Microsoft announcing that Server 2008 R2 will include 'Live Migration', a feature which allows users to move a virtual machine between two computers running Microsoft's Hyper-V hypervisor. Microsoft said that the new version of Hyper-V shipped with Server 2008 R2 will include better management features.

Microsoft also said that Server 2008 R2 has many features specifically designed to work with client computers running the upcoming Windows 7, including better usability and accessibility.

According to the reviewer's guide published on Microsoft's website, Server 2008 R2 will be available exclusively as a 64-bit OS.

Source: zdnet