Category:

Datacenter

vCenter Server 6.0 New Features

by Roger Lund February 2, 2015

written by Roger Lund

Today Announces the release of VMware’s vCenter largest release in VMware History. Note. These facts are pre release, thus I will update any changes if necessary, All Facts are direct From VMware.

vCenter Server Features – Enhanced Capabilities

Metric	Windows	Appliance
Hosts per VC	1,000	1,000
Powered-On VMs per VC	10,000	10,000
Hosts per Cluster	64	64
VMs per Cluster	8,000	8,000
Linked Mode	✔	✔

Platform Services Controller

Platform Services Controller includes takes it beyond just Single Sign-On. It groups:

Single Sign-On (SSO)
Licensing
Certificate Authority

Two Deployment Models:

Embedded

vCenter Server and Platform Services Controller in one virtual machine

– Recommended for small deployments where there is less then two SSO integrated solutions

Centralized

vCenter Server and Platform Services Controller in their own virtual machines

– Recommended for most deployments where there are two or more SSO integrated solutions

Linked Mode Comparison

	vSphere 5.5	vSphere 6.0
Windows	Yes	Yes
Appliance	No	Yes
Single Inventory View	Yes	Yes
Single Inventory Search	Yes	Yes
Replication Technology	Microsoft ADAM	Native
•Roles & Permissions	Yes	Yes
•Licenses	Yes	Yes
•Policies	No	Yes
•Tags	No	Yes

Certificate Lifecycle Management for vCenter and ESXi

VMware Certificate Authority (VMCA)

Provisions each ESXi host, each vCenter Server and vCenter Server service with certificates that are signed by VMCA

VMware Endpoint Certificate Service (VECS)

Stores and Certs and Private Keys for vCenter Services

vCenter Server 6.0 – VMCA

Root CA

During installation, VMCA automatically creates a self-signed certificate
This is a CA certificate, capable of issuing other certificates
All solutions and endpoint certificates are created (and trusted) from this self-signed CA certificate

Issuer CA

Can replace the default self-signed CA certificate created during installation
Requires a CSR issued from VMCA to be used in an Enterprise/Commercial CA to generate a new Issuing Certificate
Requires replacement of all issued default certificates after implementation

Certificate Replacement Options for vCenter Server

VMCA Default

Default installed certificates
Self-signed VMCA CA certificate as Root
Possible to regenerate these on demand easily

VMCA Enterprise

Replace VMCA CA certificates with a new CA certificate from the Enterprise PKI
On removal of the old VMCA CA certificate, all old certificates must be regenerated

Custom

Disable VMCA as CA
Provision custom leaf certificates for each solution, user and endpoint
More complicated, for highly security conscious customers

Cross vSwitch vMotion

Transparent operation to the guest OS
Works across different types of virtual switches
vSS to vSS
vSS to vDS
vDS to vDS
Requires L2 network connectivity
Does not change the IP of the VM
Transfers vDS port metadata

Cross vCenter vMotion

Simultaneously changes
Compute
Storage
Network
vCenter
vMotion without shared storage
Increased scale
Pool resources across vCenter servers
Targeted topologies
Local
Metro
Cross-continental

Requirements

vCenter 6.0 and greater
SSO Domain
Same SSO domain to use the UI
Different SSO domain possible if using API
250 Mbps network bandwidth per vMotion operation
L2 network connectivity on VM portgroups
IP addresses are not updated

Features

VM UUID maintained across vCenter server instances

Not the same as MoRef or BIOS UUID

Data Preservation

Events, Alarms, Tasks History

HA/DRS Settings

Affinity/Anti-Affinity Rules

Automation level

Start-up priority

Host isolation response

VM Resource Settings

Shares

Reservations

Limits

MAC Address of virtual NIC

MAC Addresses preserved across vCenters

Always unique within a vCenter

Not reused when VM leaves vCenter

Long Distance vMotion

Cross-continental distances – up to 100ms RTTs
Maintain standard vMotion guarantees
Does not require VVOLs
Use Cases:
Permanent migrations
Disaster avoidance
Multi-site load balancing
Follow the sun

Increased vMotion Network Flexibility

vMotion network will cross L3 boundaries
vMotion can now use it’s own TCP/IP stack

Content Library Overview

Simple content management
VM templates
vApps
ISO images
Scripts
Store and manage content
One central location to manage all content
Beyond templates within vCenter
Support for other file types
Share content
Store once, share many times
Publish/Subscribe
vCenter -> vCenter
vCloud Director -> vCenter
Consume content
Deploy templates to a host or a cluster

Client Overview and Web client Changes

Client Comparison

vSphere Client

It’s still here

Direct Access to hosts

VUM remediation

New features in vSphere 5.1 and newer are only available in the web client

Added support for virtual hardware versions 10 and 11 *read only*

vSphere Web Client

Performance

Improved login time

Faster right click menu load

Faster performance charts

Usability

Recent Tasks moved to bottom

Flattened right click menus

Deep lateral linking

Major Performance Improvements

UI

Screen by screen code optimization

Login now 13x faster

Right click menu now 4x faster

Most tasks end to end are 50+% faster

Performance charts

Charts are available and usable in less then half the time

VMRC integration

Advanced virtual machine operations

Usability Improvements

Can get anywhere in one click

Right click menu has been flattened

Recent tasks are back at the bottom

Dockable UI

vCenter Cluster Support

vCenter server is now supported to be ran in a Microsoft Cluster.

That’s all of the changes we were presented with from VMware. What a ton of changes, I will dig into these more soon.

Update: a post vSphere 6 – Clarifying the misinformation has been posted to clairify any changes that have or will happen between beta and this post. I did my best to validate that my information is correct.

Roger L

February 2, 2015 1 comment

Datacenter Storage Virtualization VMware vSphere

vCenter Server 5.5 Update 2d recently released

by Shawn Cannon January 28, 2015

written by Shawn Cannon

On January 27 2015 VMware released an update for vCenter Server 5.5. The release notes are located here. A brief summary of the resolved issues from the release notes are below.

vCenter Single Sign-On

VMware Directory Service consumes excessive memory
Backup and restore of vCenter Single Sign-On database might not replicate the data between primary and secondary nodes correctly
Attempts to logout through the vCloud Automation Center UI might fail

Networking

Network Interface Cards of virtual machines in disconnected state might get ejected during vMotion

vCenter Server, vSphere Client, and vSphere Web Access

Virtual machines on ESXi hosts containing NSX Endpoint virtual machines might not power on
Update to SUSE Linux Enterprise Edition Server in vCenter Server Appliance to address time zone changes
vpxd reports massive logging
Accessing the Storage View tab fails with the error
Scheduled tasks cannot be created for a different time on the same day in vSphere Web Client
The VMware VirtualCenter Server service fails intermittently
HTML console cannot be launched with custom port
Datastore browser in vSphere Web Client does not overwrite existing files
VMware VirtualCenter Server service fails

Virtual Machine Management

Cloning or deploying deploying virtual machines over the network causes performance degradation
Alert event is not triggered when one VM has multiple vNICs with same MAC address

vMotion and Storage vMotion

The default behavior of DRS has been changed to make the feature less aggressive during cluster upgrade

January 28, 2015 0 comments

Datacenter Storage Virtualization VMware vSphere

Initial Configuration of SolarWinds Virtualization Manager v6.1.1

by Shawn Cannon January 25, 2015

written by Shawn Cannon

So now that the Virtualization Manager appliance is installed and powered on we need to configure it. The vBrainstorm lab has DHCP enabled but we are using static IP addresses so we need to change the appliance to use a static IP. To do this, just right-click on the appliance in vCenter and choose to Open Console. To configure a static IP, arrow down and hit enter on Configure Network.

Enter the info as prompted.

After the IP is set just open up a browser and go to the IP via HTTPS. The default username and password is admin.

Once you are logged in you have to accept the license agreement (after you review it of course).

Next is the configuration wizard. Just click begin!

The first screen is going to ask you for your registration info. Enter that information and click Next.

The next screen is used to configure your credentials to access the server(s) you are going to access.

Click on the Add button to add the proper credentials. In our case we are connecting to a vCenter server. Enter the credentials and click Save. Click Next.

The next screen is the data sources screen. This is where you add your servers. Click the Add button.

Choose Virtual Center.

Enter your vCenter server information. Click Save. Click Next.

The next screen lets you select collection schedules. These are used to gather the data needed to populate Virtualization Manager. For this lab setup I enabled both of these tasks. You do that by highlighting the task and clicking thee Enable button. Click Next.

The next screen is where you configure your SMTP settings so that you can receive email alerts. After the info is entered click Next.

The final wizard screen is for integration with Storage Manager. In our lab we are not using Storage Manager at this time. Click Finish.

The Configuration Summary screen will appear. A configuration status bar will show in the middle of the screen under Active Data Collection Jobs.

That’s it! Virtualization Manager has been configured for the vCenter instance in our lab! The next blog post will go over the different screens in the software after data has been collected for a few days.

January 25, 2015 0 comments

Datacenter Storage VMware

Installing SolarWinds Virtualization Manager v6.1.1 in a vSphere 5.x environment

by Shawn Cannon January 23, 2015

written by Shawn Cannon

Today I am installing SolarWinds Virtualization Manager v6.1.1 in our lab here at vBrainstorm. If you are not sure what Virtualization Manager is, here is a quick blurb from the Solarwinds website:

Virtualization Manager
Comprehensive Virtualization Management for VMware ® & Hyper-V ® – From VM to Storage

Real-time dashboards simplify identification & troubleshooting of performance, capacity & configuration problems

Identifies VM sprawl, helps you reclaim & optimize space, and reduces licensing costs

Integration with Server & Application Monitor provides complete visibility of the application stack – from app to VM to datastore

All the functionality & more of other leading virtualization management tools – at a fraction of the cost

Easy to download, deploy & use – start monitoring your VMs in less than an hour

I will be installing this in a vSphere 5.x environment. This is installed as a virtual appliance download from the Solarwinds web site. The virtual appliance requirements are shown below:

CPU
2 GHz quad-core

Virtual CPUs
4 vCPUs

Memory
8 GB or more

Disk Space
200 GB or more

Virtual NIC
1 Gigabit vNIC

The download file for version 6.1.1 is approx 1479 MB. After the file is downloaded, extract the ZIP file and then open up your vSphere client and log into your Virtual Center server.

To install the virtual appliance click on File – Deploy OVF Template.

Choose the OVA file from the unzipped contents.

Review the template details and click Next.

Give the appliance a name and choose its location in your inventory. Click Next.

Choose the storage to place the appliance on. In our lab we are using Nexenta for the storage. Click Next.

Choose the disk format. In our lab Thin is the only choice so this screen is greyed out. Click Next.

Choose the network mapping for the appliance and click Next.

Choose how the appliance will get an IP address. In our lab we are using static IPs so I chose Fixed. Click Next.
(UPDATE: Choosing static gave me an error on starting up the VM. The error basically said “Cannot initialize property ‘vami.DNS0.SolarWinds_Virtualization_Manager’. Choose DHCP and the VM will boot up. You can change to a static IP via the console on the VM)

Since I chose fixed I need to enter a valid IP address on this screen and then click Next.

Finally I am presented with a summary screen. Review it to make sure everything is correct and then click Finish.

The appliance will be deployed.

Power it up and the appliance is installed! The next post will go into how to configure the appliance and connect it to your vCenter server.

January 23, 2015 0 comments

Datacenter Software Storage

Veeam 8.0 Patch 1

by Roger Lund December 30, 2014

written by Roger Lund

I’ve been working on getting Veeam 8.0 up in my lab, I am planning on doing a series of write up’s on the technology. I Noticed that they have released a Patch. I wanted to share this.

Release Notes for Veeam Backup & Replication 8.0 Patch 1

KB ID: 1982
Products: Veeam Backup & Replication
Version: 8.0.0.917
Published: 2014-12-25
Created: 2014-12-25

They have added a slew of new features.

“

New Features and Enhancements

General

Retention policy for replication jobs is now processed concurrently for multiple VMs in the job, as opposed to one by one, reducing the overall job run time.

Added email notification about File to Tape and Backup to Tape jobs waiting for user interaction (for example, when a tape medium needs to be inserted by the user)

VMware Tools quiescence should now log an informational event when VMware Tools are outdated, as opposed to a warning event.

Independent virtual disks which are explicitly excluded from processing in the job settings should no longer log a warning during the first time when the given VM is being backed up.

Virtual Lab proxy appliance was upgraded to virtual hardware version 7 to allow for it to manage more networks out of box.

Jobs should no longer appear to “hang doing nothing” in some circumstances, with the duration not ticking for any event in the job log.

Cloud Connect

Cloud backup repository size limit of 63TB has been removed

Linux support enhancements

Added support for file level recovery from XFS volumes (default file system in Red Hat Enterprise Linux and CentOS distributions starting from version 7.0)

Added support for file level recovery from Btfrs volumes (default file system in SUSE Linux Enterprise Server starting from version 12.0).

Added support for file level recovery from VMs with more than 10 LVMs.

Improved Linux guest file system indexing performance for incremental backup job runs.

FTP access mode of the file level recovery helper appliance now also displays friendly LVM volume names introduced in v8.

To enable identity verification of the remote server, SSH key fingerprint is now displayed to a user when registering the new Linux server. Accepted SSH keys are stored in the configuration database to protect from MITM attack.

Performance enhancements

Added experimental support for direct data movers communication when both are running on the same server (for example, when backing up to a local storage on backup proxy server). If your local backup jobs report Network as the bottleneck, and you see high load on some backup proxy server NICs when the data was supposed to stay local to the server, you are likely to benefit from this behavior modifier. To enable alternative data exchange path, create the DataMoverLocalFastPath (DWORD) registry value under HKLMSOFTWAREVeeamVeeam Backup and Replication, and set it to the following values:

0: Default behavior (no optimizations)1: Data exchange through TCP socket on the loopback interface (faster)2: Data exchange through shared memory (fastest) EMC Data Domain integration

Synthetic full backup creation and transformation performance has been improved significantly.

HP 3PAR StoreServ integration

Remote Copy snapshots are now automatically excluded from rescan, both speeding up the rescan process and reducing storage load.

NetApp integration

Added support for NetApp Data ONTAP 8.3.

Added support for HA Pair 7-mode configuration.

Added support for vFiler DR configuration.

“

And even more Fixes.

Resolved Issues

General

Restored incremental backup job performance back to v7 levels by removing unnecessary metadata queries from previous backup files.

Multiple issues when parallel processing is disabled (high CPU usage on backup server, wrong task processing order, reversed incremental backup jobs with disk excluded failing to access backup files).

Automatic network traffic encryption (based on public IP address presence) is enabled even when both data movers are running on the same computer, reducing job’s processing performance.

Quick Backup operation triggers jobs chained to the job it uses.

Loss password recovery option does not function correctly when Enterprise Manager has multiple backup server registered.

Under rare circumstances, backup job with encryption enabled may fail with the “Cannot resize block data is encrypted” error.

When multiple network traffic rules having the same source and target ranges are set up, changing settings to one of the rules also updates all other rules.

vSphere

In vSphere 5.5, enabling virtual disk updates redirection to the VMFS datastore in Instant VM Recovery settings, and then migrating a recovered VM to the same datastore with Storage vMotion causes data loss of data generated by the running VM.

Full VM restore process puts all virtual disks to the datastore selected for VM configuration file,ignoring virtual disks placement settings specified in the wizard.

In certain environments, jobs fail to process VMs in Direct SAN Access mode with the “Failed to create processing task for VM Error: Disk not found” error.

Dismounting processed virtual disks from backup proxy server takes longer than expected in the Virtual Appliance (hot add) processing mode.

Rescan of vCenter server containing hosts without HBA and SCSI adaptors fails with the “Object Reference not set to an instance of an object” error.

Replication jobs to a cluster fail with the “The operation is not allowed in the current state” error if chosen cluster host is in the maintenance mode.

Under rare circumstances, jobs with Backup I/O Control enabled may occasionally log the “Operation is RetrievePropertiesOperation” related errors.

Enabling Backup I/O Control limits snapshot removal tasks to one per datastore regardless of datastore latency levels.

VM Copy jobs always fail over to the Network (NBD) processing mode.

VMs with virtual disks having the same names but with different capitalization, and located on the same datastore cannot be backed up.

Backing up vCloud Director vApp to a CIFS share may fail with the “Object Reference not set to an instance of an object” error.

Snapshot Hunter ignores backup window specified in the corresponding job.

vCloud Director VMs created from linked clone template and with a user snapshot present incorrectly trigger Snapshot Hunter.

Hyper-V

CBT does not track changes correctly on VHDX disks files larger than 2 TB.

CBT may return incorrect changed blocks information for differential disks, when parent and child disks have the same name.

Large amount of unmapped VHDX blocks may cause the job to failover to full scan incremental backup with the “Failed to update unaccounted changes for disk. Change tracking is disabled” error.

Existing Hyper-V backup and replication jobs processing VM with SCSI disks start to consume x2 space on target storage after upgrade to v8.

Removing a node from a cluster does not remove the corresponding node from the cluster on the Backup Infrastructure tab of the management tree until the next periodic infrastructure rescan (in up to 4 hours).

Replication from backup fails with the “Virtual Hard Disk file not found[fusion_builder_container hundred_percent=”yes” overflow=”visible”][fusion_builder_row][/id” error if backup job that created this backup had one or more disks excluded from processing.

Under rare circumstances, legacy replicas using non-default block size may fail with the “[fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][i]FIB block points to block located outside the patched FIB” or “Block offset [] does not match block ID []” error messages.

Offhost backup from Windows Server 2012 R2 fails with the “Exception of type ‘Veeam.Backup.AgentProvider.AgentClosedException’ was thrown” error when processing a VM that can only be backed up in Saved or Crash-Consistent states, and native Hyper-V quiescence is enabled in the job settings.

If a Hyper-V cluster node goes offline during backup from shared volume snapshot, and does not recover until the Veeam job fails, CSV volume backup infrastructure resource will not be released by the scheduler. As the result, other jobs waiting to process VMs from the same volume may remain hanging in the “Resource not ready: Snapshot” state.

Replication job fails with the “Cannot assign the specified number of processors for virtual machine” error for VMs with core count larger than the one of the target Hyper-V host. Legacy replication job works fine in the same circumstances, however VM failover is not possible.

Application-aware processing

VeeamGuestHelper process crashes when backing up Windows 2003 SP2 VM running Oracle.

Application-aware processing hangs for extended time when processing a Windows VM containing one or more Oracle databases in the suspended state.

Certain advanced guest processing settings lead to VM processing failing with the “Unknown indexing mode ‘None’ ” error.

Multi-OS File Level Recovery

Restore to original location does not work in certain LVM configurations.

Enterprise Manager

Under certain circumstances, Enterprise Manager data collection may fail with the “Cannot insert the value NULL into column ‘guest_os’ ” error.

Restore scope rebuild operation tries to reach out to the hosts already removed from the corresponding backup server, resulting in login errors.

Built-in WAN Acceleration

WAN accelerators fail to detect and populate global cache Windows Server 2012 R2 and Windows 8.1 OS data, which may result in reduced data reduction ratios.

Cloud Connect

The Decompress backup data blocks before storing backup repository option is ignored for Cloud Connect backend repositories.

Backup Copy jobs with encryption enabled fail with the “Attempted to compress encrypted data-block” error if backend repository has the Decompress backup data blocks before storing option enabled.

Veeam Backup Service crashes with the “An existing connection was forcibly closed by the remote host” if network connection fails immediately upon establishing the initial connection to the Cloud Gateway.

Cloud Connect quotas are rounded incorrectly in the service provider’s interface.

Tenant statistics data such as data sent/received is only shown for the last 24 hours.

Veeam Explorer for Active Directory

“This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms” error is displayed if Use FIPS compliant algorithms for encryption, hashing, and signing Group Policy setting is enabled.

Attempting to open single label domain’s AD database fails with the “No writable domain found” error.

Attempting to open third level domain’s AD database fails with the “No writable domain found” error.

Under certain circumstances, object restore may fail with the “Unable to cast object of type ‘System.String’ to type ‘System.Byte[]’ “error.

Veeam Explorer for Exchange

Process of exporting email messages cannot be stopped.

Copying or saving attachments from multiple different emails always copies or saves attachment from the first email for which this operation was performed.

Opening public folder’s mailbox fails with the “Unable to find wastebasket” error.

Veeam Explorer for SQL Server

Restoring to SQL instance with case sensitive collation enabled fails with the “The multi-part identifier “a.database_id” could not be bound” error.

Backup from Storage Snapshots

Backup jobs from storage snapshots on iSCSI SAN take too long to initialize when large amount of iSCSI targets are configured on the backup proxy server.

Under certain circumstances, backup jobs from storage snapshots on FC SAN may fail with the “Unable to find volume with Node WWN and LUN ID” error.

HP 3PAR integration

Rescan of 3PAR array with empty host sets fails with the “Object reference not set to an instance of an object” error.

NetApp integration

Under certain circumstances, storage rescan process may leave temporary storage snapshots behind.

Tape

Backup to Tape jobs may appear to run slower after upgrading to v8 because of copying unnecessary backup files (VRB) to tape when source backup job uses reversed incremental backup mode.

On standalone drives, tape jobs configured to eject tape upon completion fail the “Object reference not set to an instance of an object” error after 10 minutes of waiting for the user to insert tape.

Tape job configured to use full and incremental media pools hosted by the different standalone tape drives fails when processing incremental backup with the “Value cannot be null” error. Tapes are formatted with the block size of tape medium, as opposed to the default block size of the tape drive.

Tape job configured to use full and incremental media pools hosted by the different tape libraries fails while waiting for an incremental pool’s tape with the “Tape not exchanged” error

Tape jobs fail with the “GetTapeHeader failed” error on IBM TS3100 tape library with Path failover feature disabled.

PowerShell

Objects obtained with Find-VBRViFolder cmdlet have incorrect Path attribute.

Get-VBRTapeJob cmdlet fails to obtain job object for tape jobs with incremental processing disabled.

Get-VBRTapeLibrary cmdlet fails with the Standard Edition license.

All built-in WAN accelerator management cmdlets have been made available in all paid product editions

“

To download the patch. http://www.veeam.com/download_add_packs/vmware-esx-backup/8.0patch1/ note you must be logged into Veeam’s website.

Enjoy

Roger Lund [/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]

December 30, 2014 0 comments

Datacenter Software Storage

Pass The Hash (No Really Don’t)

by Philip Sellers December 23, 2014

written by Philip Sellers

I attended TechEd 2014 back in May of this year and there was one session that I wanted to share called “TWC: Pass-the-Hash and Credential Theft Mitigation Architectures”. The part from the session that I wanted to focus on was regarding administrative privileges. Credential theft has become a serious problem in today’s world where everyone is doing business online. While the internet has allowed us the ability to be more connected it also puts us at the risk of becoming a victim of cybercrime.

Being an administrator in today’s corporate world you have to make sure that you are doing everything you can to protect your company’s digital assets. You have to defend against every possible intrusion while an attacker only has to be successful at finding a vulnerability one time. The TechEd session provided some good ways of how you can lower your chance of becoming a victim of credential theft.

First, let me give you some background on what Pass-The-Hash is about. The “Pass-the-Hash” phrase comes from the ability to steal a password hash and reuse it to connect to other computers. A hash is created based off your password and is used for authenticating you across the network. It will only change when you change your password. The password hash gets stored in memory and allows you to access other resources on the network without having to type in your credentials every time. If someone is able to obtain this hash then they can potentially authenticate as you.

This becomes extremely dangerous when we are talking about local or domain administrator accounts. If you use the same password for the local administrator account on all your computers then an attacker only has to steal the password hash one time and can then use it to access other computers on the network. A password hash can only be used for a network login. It will not work for an interactive login.

In order for an attacker to steal your password hash using the Pass-The-Hash method, they will have to gain local administrative rights on your computer. If they cannot gain administrator equivalent access then they will not be able use this technique. You should use the method of least privilege and never allow users to have administrative rights if possible. A user can be easily tricked into downloading a piece of malware that can allow an attacker to have access to your network. A domain admin account should never log into a standard workstation that accesses the internet or email. If your domain administrator credentials are captured then you have given the attacker the keys to the kingdom. Don’t make it easier for someone to take control over your network.

Removing admin rights can be a challenging task within a corporate environment. Users most of the time think that you do not trust them or that you are trying to exercise your power. Corporate politics can also sometimes influence security decisions. It is our duty as systems administrators to make our users and management understand the importance of restricting administrative rights. You might not be the most liked person but it is better to know that you are doing what is needed to protect your company or organization.

The presentation broke down computers and accounts into three different tiers. You have Tier 0 at the top which would be your core servers like domain controllers and domain admin accounts. This would be the most restrictive tier. Tier 1 would be your application servers and contain your server admin user accounts. Finally, Tier 2 would be your workstations and users that have access to internet and e-mail. You should never login with an account on a lower tier that has access to a higher tier. For example, an account with access to servers or domain controllers should not login to a workstation that has access to the internet. Microsoft also recommends having separate admin workstations that do not access the internet or e-mail for your domain admin account. This will help prevent your admin machine from becoming compromised.

Microsoft has created a document that discusses credential theft using Pass-The-Hash and ways to mitigate it. Please visit the links below to see more detail since I will not be able to cover everything from the presentation and whitepapers. It is well worth the time to learn more about this problem and ways to address it. They also mentioned in the presentation that this is not a flaw or vulnerability that can be addressed with a patch. Most operating systems rely on password hashes and we as administrators must take the steps to make them as secure as possible.

Link to the presentation:
http://channel9.msdn.com/Events/TechEd/NorthAmerica/2014/DCIM-B213#fbid=

Link to document discussing Pass-the-Hash attacks:
http://www.microsoft.com/en-us/download/details.aspx?id=36036

December 23, 2014 0 comments

Compute Datacenter

ProLiant servers getting RESTful API for management

by Philip Sellers December 3, 2014

written by Philip Sellers

ProLiant servers are getting some REST – a RESTful API. One of the innovations HP is showing off on the HP Discover showroom floor is a new RESTful interface packaged as part of the iLO management chips on ProLiant servers. With the RESTful API, HP hopes to deliver future generations of ProLiant that can be easily provisioned and controlled from tools like HP OneView. RESTful interfaces are becoming the go-to standard within HP for interoperability between their products.

HP RESTful API is a management interface can be used to perform configuration, inventory, and monitoring. The RESTful API is available on Gen8 and Gen9 hardware with iLO firmware 2.0 and greater. On Gen9 and future hardware, the interface will be able to configure both BIOS and iLO settings on the server. On Gen8 servers, the RESTful API will only expose the capabilities inside of the iLO.

According to HP, a REST client will send HTTPS operations to the iLO web server and there are three modes that can be used – command line interface, file based and JSON-formatted data. The use of HTTPS is a big security plus versus many other remote management interfaces that are often

The folks at HP are working with other vendors in the market to establish a standard that they call the Redfish Specification. Redfish is supposed to create a standardized interface for IP Management Interfaces on servers to allow uniform control and reporting across multi-vendor server environments. The standardization should allow the same management software to be able to manage heterogeneous servers. Redfish is corporately sponsored by Dell, Intel, HP and Emerson.

For more information, see http://www.hp.com/go/restfulapi.

Disclaimer: HP invited and paid for my trip to attend HP Discover EMEA. The views and opinions I’ve written were not dictated or approved by HP and are my own.

December 3, 2014 0 comments

Datacenter Storage

HP brings native filer capabilities to the 3PAR line

by Philip Sellers December 3, 2014

written by Philip Sellers

Today, HP announced new file and cloud object storage capabilities native to the 3PAR storage line. The 3PAR File Persona software suite brings native file share and Object API file capabilities to the 3PAR arrays. Powered by a new set of controllers, the File Persona is available on HP’s new 3PAR StoreServ 7200c, 7400c, 7440c and 7550c models. The new ‘c’ designation is a sign of a new controller on the 3PAR arrays, still based on the same ASIC as the previous 7200 and 7400 models, but with increased cache to handle the File Persona’s demands.

The 3PAR StoreServ 7440c is a new hybrid array that features all the same performance as the all-flash 3PAR StoreServ 7450 array, including over 900,000 IOPS of performance. The 7440c features 16Gb Fiber Channel capabilities and up to 3.5 Petabytes of storage in a combination of flash and spinning disk.

The 3PAR File Persona software suite allows CIFS, NFS and object storage natively within the 3PAR OS and no longer requires a separate server fronting the array to provide the file store capabilities. File, block and object storage can all be managed from a unified management interface and from a single storage pool, offering advantages for customers over competitor’s arrays, according to David Scott, Senior Vice President and General Manager for Storage at HP.

From checking with HP folks, existing 3PAR 7000 customers will require new controllers or a new array to make use of the File Persona software suite.

Disclaimer: HP invited and paid for my trip to attend HP Discover EMEA. The views and opinions I’ve written were not dictated or approved by HP and are my own.

December 3, 2014 0 comments

Datacenter Storage

3PAR StoreServ gets new management console

by Philip Sellers December 2, 2014

written by Philip Sellers

HP is showing off a the new StoreServ Management Console (SSMC) this week at HP Discover EMEA. The new management console is a complete rewrite of 3PAR management that adopts many of the UI concepts that HP OneView introduced. It is HTML5 interface that is extremely responsive, but is a markedly different view for 3PAR administrators. SSMC can connect to and manage up to 16 3PAR StoreServ arrays running at least 3.1.3 firmware, although the 3.2.1 firmware will provide the best experience.

First up, the SSMC has a high level dashboard view that intends to highlight problems and overall performance for an administrator in a quick, clean, graphical view, shown in the screenshot below.

StoreServ Management Console

Beyond the dashboard, all the normal administrative tasks are logically grouped by 3PAR Systems, Hosts, Virtual Volumes, and Virtual Volume Sets. Existing objects display in a brief view that can be expanded to include additional information in list view. Select any one of the objects and you get management and full reporting for the object. All actions are organized under an Action button, matching OneView’s UI to allow for a cohesive management between products.

Even better than having to manually find what you’re looking for, the new 3PAR SSMC includes native search capabilities. When you begin a search, it defaults to searching in the area you’re currently managing in the console (like search defaults to Virtual Volumes if you’re in the Virtual Volumes area) but allows you to toggle to an Everywhere search to find any object in the SSMC managed systems that matches your search term. This allows you to quickly locate virtual volumes or a host no matter which 3PAR array it may be provisioned from.

Relationships between storage objects are important and the SSMC has a great maps view that highlight relationships between defined hosts and 3PAR systems and the virtual volumes and exports assigned to hosts. The map views are powerful to quickly traverse objects in the 3PAR universe with the help of search. If you find yourself on an export or snapshot, maps lets you quickly open management for the associated object you actually wanted in the map views.

SSMC gives System Reporter a major makeover, too. SSMC relies heavily on the data stored in the 3PAR controllers and not an external database, in a change over the previous System Reporter software. The existing reports are easily accessible from a Create Report button and the data of the reports is rendered quickly with the ability to highlight and drill into specific time frames and data points. The UI of SSMC provides a big leap in usability for reports on your 3PAR arrays.

SSMC will be freely available in a few weeks to customers, according to HP employees on the show floor. SSMC is installable on Windows or Linux and a virtual appliance seems to be a logical expectation, too. SSMC may be used in simultaneously with the 3PAR Command Line Interface and the 3PAR InServ Management Console (IMC).

Unfortunately, the initial release of SSMC does not allow management of Peer Persistence configuration for 3PAR but will be included in a future release.

Disclaimer: HP invited and paid for my trip to HP Discover EMEA. All viewpoints are my own and were not dictated by HP.

December 2, 2014 2 comments

Datacenter Storage

HP announces new Flat Backup direct from 3PAR to StoreOnce

by Philip Sellers December 2, 2014

written by Philip Sellers

Today, at HP Discover EMEA, HP announced new flat backup capabilities allowing 3PAR snapshots to be directly backed up to StoreOnce deduplicated backup arrays. The new capability is called Express Protect and allows for direct backup without third party backup software for VMware vSphere deployments. Snapshots taken on 3PAR arrays can be initially moved to StoreOnce for long term retention, eliminating several layers of software currently required to protect the same workloads.

To enable the feature, a virtual appliance called the StoreOnce Recovery Manager Central is deployed which connects to vCenter, StoreOnce and 3PAR arrays allowing for array-based snapshots with application aware consistency using Microsoft’s VSS technology. Recovery Manager Central integrates directly with VMware vCenter allowing administrators to control flat backups from their familiar vCenter view. In addition, administrators may also initiate flat backups from the StoreOnce RMC console. StoreOnce RMC allows users to restore a snapshots stored on StoreOnce to the original or a third party 3PAR array. The backups occur at the LUN level for the array and would backup all virtual machines in the LUN.

The StoreOnce RMC does not allow for file level restoration in the way that traditional backup software does, so it may not be a complete backup replacement, but it should allow for better and more flexible backups for VMware environments. For static servers whose data is kept in a database, this solution may become a great fit by eliminating multiple layers of software currently used for the same protection. Realistically, third party software and StoreOnce Recovery Manager Central will need to coexist to fully protect environments, but StoreOnce RMC may allow for faster protection on more frequent intervals than third party backups for many virtual machines.

StoreOnce RMC is licensed on a per rack basis with prices starting at $2500 for the VMware solution. StoreOnce RMC also requires a Catalyst license on the StoreOnce arrays. (I incorrectly reported that StoreOnce RMC was freely available. I apologize for this error.)

In the initial release, the StoreOnce Recovery Manager Central is limited to VMware vSphere but the capability is planned to expand to other software in the future.

Disclaimer: HP invited and paid for my trip to attend HP Discover EMEA. The views and opinions I’ve written were not dictated or approved by HP and are my own.

December 2, 2014 2 comments