Hardware-Assisted Virtual Machine Rootkits

Thanks to www.rootkit.com I learned of a new paper by Michael Myers and Stephen Youndt titled An Introduction to Hardware-Assisted Virtual Machine (HVM) Rootkits. Like most good papers they discuss the underlying technology before explaining how to exploit it. I selected a few choice excerpts.

HVM rootkits, theoretically at least, are not vulnerable to any action the operating system can take since the rootkit runs in a more privileged state than the OS. A hypervisor need not even exist in memory that is accessible to the operating system. When a hypervisor bootstraps itself, it makes any instructions or memory accesses which could betray its existence more privileged than the operating system. When these instructions occur, the processor traps to the hypervisor, allowing it to modify the results. Thus, the hypervisor need not make any changes to the operating system to hide its own presence. The hypervisor can, however, make any such changes with impunity and make them undetectable by the operating system...

Unlike the typical hypervisor which loads before it starts its guest VM, an HVM rootkit loads into an already loaded operating system and turns it into its guest VM. Therefore the rootkit must initialize the hypervisor functionality and dynamically take over as host, turning the running operating system into a guest. This process has been repeatedly referred to as “forking” or “migrating” the OS to a guest state, but these terms are misleading.

The hypervisor and OS do not run concurrently (as they would if they were “forked” in the UNIX sense) nor does the OS need to be altered or moved in any way (“migrated”). The process of installing an HVM hypervisor in a running OS is more like that of installing a “shim,” in the software engineering sense of the word. A shim is a piece of code between two layers, in this case between the CPU and all other software running on the system.

At this stage, the practical detectability of HVM rootkits is still hotly contested. The trend is clear, however. Researchers are continually suggesting new detection methods, and the code required in the HVM rootkit to evade each one is successively layering more and more complexity into the rootkit’s design. Paradoxically, the more complicated an HVM rootkit must be to avoid known detection schemes, the more presence it has within the system to have to work to hide...

[T]he popular consensus has been that HVM rootkits will eventually become too difficult or costly to implement, or even that they are ultimately unfeasible. One might point to the fact that there are no known HVM rootkits in the wild. But neither are there any HVM rootkit detectors to find them if there were...

If detection of an HVM rootkit is difficult and impractical, actually procuring a forensic copy of an active HVM rootkit may very well be impossible. The HVM rootkit only needs to exist in RAM, meaning a forensic examiner is tasked with obtaining a copy of all of physical memory in order to search for the presence of an HVM hypervisor...

There are two common approaches to imaging physical memory. One approach is to run software on the local system which accesses physical memory through an operating system hardware interface layer. In this case, an HVM hypervisor is able to intercept and control access to the physical memory by way of its exception conditions. It could present the pages of memory containing its hypervisor code to appear to contain all zeros or all ones, for instance. This subversion of memory would go unnoticed by the forensic capture process.

The second approach to imaging physical memory is to take advantage of the abilities of certain hardware peripheral devices that can perform Direct Memory Access (DMA), that is, devices which can read and write system memory without intervention by the CPU. Normally, this would be the most reliable and forensically sound method for capturing he contents of physical memory. However, AMD-V introduces a feature to secure the system memory against any unwanted access from DMA devices. (emphasis added)

Two years ago during the rise of the public Windows kernel-mode rootkit, I wrote Rootkits Make NSM More Relevant Than Ever. Several years ago we passed the point where suspected compromised hosts could be trusted to accurately report their own integrity to tools running on the victim. HVM rootkits only sink the problem deeper into the platform.

If you're relying on a host to reliably report its security posture, you are bound to be disappointed. You have to complement that host-centric view with an outside view, like that depicted in my TaoSecurity Enterprise Trust Pyramid. Obviously a look at network traffic will not be 100% conclusive, but it will give you a trustworthy vantage point for very little investment of resources.

Read More

Using VMware for Network Security Monitoring

While teaching last week I learned that recent versions of VMware Server (I used 1.0.2) no longer act like a hub. Doing some quick testing this morning with three VMs, I told VM 1 to ping VM 2 while VM 3 watched. I learned VM 3 cannot see VM 1 ping VM 2 when using bridged, host-only, or NAT networking. The host OS can see traffic on the bridged interface, /dev/vmnet1 (host) and /dev/vmnet8 (NAT).

This is important because it means you can't deploy a VMware-only monitoring lab. The only solution appears to be running sensor components on the host OS, watching the bridged interface, /dev/vmnet1 (host) and /dev/vmnet8 (NAT). I noticed that monitoring the physical bridged interface results in double packets, so only watching /dev/vmnet1 or /dev/vmnet8 seem like viable solutions for doing testing with VMs.

Does anyone have an opinion on this? Thank you.

Read More

Must-Read Post on Virtualized Switches

While visiting Hoff's blog I saw his post VMware to Open Development of ESX Virtual Switches to Third Parties...Any Guess Who's First?. You must read this. The question I have, as with all new "features," is this: is visibility built in? Will I have access to a "virtual tap"? Can I trust it? We'll see.

Read More

VMware Server 1.0.2 on Ubuntu 6.10

Previously I documented installing VMware Workstation 6 Beta on my Thinkpad x60s. I decided to uninstall Workstation and install VMware Server 1.0.2. I should have used the vmware-uninstall.pl script but even without using it directly I managed to remove the old Workstation installation without real trouble.

Running Server on Ubuntu 6.10 (desktop) required me to add a few packages. I found Martti Kuparinen's installation guide very helpful. I had to add the following packages to ensure a smooth Server installation.

sudo apt-get install xinetd
sudo apt-get install libX11-dev
sudo apt-get install xlibs-dev

I did not have to install linux-kernel-headers.

I was really impressed that Martti provided a patch for two scripts that did not work correctly out of the box. When I applied the patch I was able to start VMware's Web server and access it via my browser.

richard@neely:/tmp$ wget http://users.piuha.net/martti/comp/ubuntu/httpd.vmware.diff
--13:52:24--  http://users.piuha.net/martti/comp/ubuntu/httpd.vmware.diff
           => `httpd.vmware.diff'
Resolving users.piuha.net... 193.234.218.130
Connecting to users.piuha.net|193.234.218.130|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2,973 (2.9K) [text/plain]

100%[====================================>] 2,973         --.--K/s             

13:52:25 (1.81 MB/s) - `httpd.vmware.diff' saved [2973/2973]

richard@neely:/tmp$ cd /
richard@neely:/$ sudo patch -b -p0 < /tmp/httpd.vmware.diff 
Password:
patching file /etc/init.d/httpd.vmware
patching file /usr/lib/vmware-mui/src/lib/httpd.vmware
richard@neely:/$ sudo netstat -natup | grep vm
tcp        0      0 0.0.0.0:8333            0.0.0.0:*
               LISTEN     5205/httpd.vmware   
tcp        0      0 0.0.0.0:8222            0.0.0.0:*
               LISTEN     5205/httpd.vmware  

Thanks to this guide I made this addition to /etc/xinetd.d/vmware-authd so the vmware console on port 902 TCP didn't listen on all interfaces:

    bind            = 127.0.0.1

To prevent the Web server from starting at boot and potentially listening on a hostile network, I removed the x bit from the script in /etc/init.d so it would not be started at boot. I can start it manually.

richard@neely:~$ sudo chmod -x /etc/init.d/httpd.vmware
richard@neely:~$ sudo sh /etc/init.d/httpd.vmware start
   Starting httpd.vmware:                                              done

I noticed while installing the packages the suggestion to run apt-get autoremove, so I did once everything was installed.

richard@neely:~$ sudo apt-get autoremove
Password:
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libnl1-pre6 network-manager libnm-util0 dhcdbd
The following packages will be REMOVED:
  dhcdbd libnl1-pre6 libnm-util0 network-manager
0 upgraded, 0 newly installed, 4 to remove and 0 not upgraded.
Need to get 0B of archives.
After unpacking 1217kB disk space will be freed.
Do you want to continue [Y/n]? y
(Reading database ... 115360 files and directories currently installed.)
Removing network-manager ...
 * Stopping NetworkManager daemon                                        [ ok ] 
 * Stopping NetworkManager dispatcher                                    [ ok ] 
Removing dhcdbd ...
Removing libnl1-pre6 ...
Removing libnm-util0 ...

I have VMware Server running well on Ubuntu now.

Read More

Latest Laptop Recommendations

It's been over a year since my last request for comments on a new laptop. I had a scare using my almost 7-year-old Thinkpad a20p today while teaching a private class. I wanted to run VMware Server using a VM configured to need 192 MB RAM. The laptop has 512 MB of physical RAM. When I started the VM, VMware Server complained it didn't have sufficient free RAM. Puzzled, I checked my Windows hardware properties and saw only 256 MB RAM reported! Oh oh.

I guessed that maybe one of the two 256 MB RAM sticks in my laptop had been loosened on the trip to the class site. Using a grounding wrist band thoughtfully provided by my class, I removed my laptop's RAM and reseated it. After booting, I saw all 512 MB again. Whew.< This experience made me again consider buying a new laptop. I am going to buy a Thinkpad, probably something in the T series like a T60p. However, I'm considering a new OS strategy. Currently I dual boot Windows 2000 Professional and FreeBSD 6.x. For my next laptop, I'm thinking of installing an OS fully supported by VMware Server, like Ubuntu, with VMware Server over it. I won't install anything else in Ubuntu. I'll do all my work inside VMware, with one VM running FreeBSD for daily work and another running some version of Windows for Office-like tasks.

I've avoided relying on VMware in the past as a primary work environment because I thought I would regularly need hardware-level access to run wireless assessment tools. This hasn't turned out to be a real need, and I think I would just turn to a live CD like BackTrack that has figured out all the Linux kernel voodoo needed for the cooler wireless tools.

Is anyone else doing this? What has been your experience?

Read More

FreeBSD VMware Interfaces

A site hosting news on FreeBSD 7.0 also included several great tips for FreeBSD under VMware. One tip talked about the lnc network interface standard under VMware.

You can see lnc0 in this sample VM. Here's dmesg output:

lnc0: <PCNet/PCI Ethernet adapter> port 0x1400-0x147f
 irq 18 at device 17.0 on pci0
lnc0: Attaching PCNet/PCI Ethernet adapter
lnc0: [GIANT-LOCKED]
lnc0: Ethernet address: 00:0c:29:38:7d:ea
lnc0: if_start running deferred for Giant
lnc0: PCnet-PCI

This is what the interface looks like in VMware:

taosecurity:/root# ifconfig lnc0
lnc0: flags=108843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,
 NEEDSGIANT> mtu 1500
        inet6 fe80::20c:29ff:fe38:7dea%lnc0 prefixlen 64 scopeid 0x1
        inet 198.18.153.167 netmask 0xffff0000 broadcast 198.18.255.255
        ether 00:0c:29:38:7d:ea

The fact that lnc is GIANT-locked is bad for network performance. Furthermore, lnc is deprecated in FreeBSD 7.0, replaced by le.

The site included a tip to replace the lnc0 driver with an emulated em0 driver. I modified my .vmx file by adding the second line.

Ethernet0.present = "TRUE"
ethernet0.virtualDev="e1000" 

With that option, I see em0 in dmesg output:

em0: <Intel(R) PRO/1000 Network Connection Version - 3.2.18>
 port 0x1070-0x1077
mem 0xec820000-0xec83ffff,0xec800000-0xec80ffff irq 18
 at device 17.0 on pci0
em0: Memory Access and/or Bus Master bits were not set!
em0: Ethernet address: 00:0c:29:fd:f6:1d

Here is the device in ifconfig output:

kbld:/root# ifconfig em0
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=b<RXCSUM,TXCSUM,VLAN_MTU>
        inet6 fe80::20c:29ff:fefd:f61d%em0 prefixlen 64 scopeid 0x1
        inet 198.18.152.169 netmask 0xffff0000 broadcast 198.18.255.255
        ether 00:0c:29:fd:f6:1d
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active

That's really cool, especially since em0 doesn't need the GIANT lock. Performance should be improved. The site I mentioned said this with respect to replacing lnc with le:

le is still a SIMPLEX device but at least it's not GIANT-locked.

It's true that le is not GIANT locked, but I think SIMPLEX is really irrelevant. You'll see SIMPLEX everywhere, like in the above em0 output. As I mentioned here, SIMPLEX "has nothing to do with half or full duplex. SIMPLEX refers to the NIC not being able to transmit and receive while operating on true CSMA/CD Ethernet, which is really not the case with switched networks."

On a related note, you don't have to recompile your kernel to use le. You can load it as a kernel module during boot by entering if_le_load="YES" in /boot/loader.conf as noted in the le man page. In my tests this did not result in using the le driver instead of lnc however, so those wishing to use an lnc0 replacement should use em0.

I also concur with the recommendation to use kern.hz="100" in /boot/loader.conf to deal with VMware timing issues. That helps immensely and doesn't require VMware Tools installation.

Read More

Christmas Wish: VMware FreeBSD Host Support

I noticed this BSD News story mentioned a long-running VMTN thread showing requests for FreeBSD to be supported as a VMware host OS. This means you could run VMware on FreeBSD, instead of Windows, Linux, or (soon) Mac OS X.

If you share this interest, please post to the VMTN thread and let your desire be known. Thank you.

Read More

Latest Sguil Scripts

I last talked about installing Sguil in March 2006. Over the last few weeks I've worked on the scripts I use for FreeBSD platforms, mainly as a response to changes in the various libraries and components. For example, Snort 2.6.0.2 is now available, replacing the Snort 2.4.x line.

The idea behind these scripts is to replace an English-text description of what to install where with a computer syntax version. If properly configured, these commands can set up everything you need for Sguil -- sensor, database, server, and client.

One of the major problems I've encountered is making good choices about libraries and components. The various Tcl libraries are on the fringes of support, compared to more popular packages. This makes it difficult to provide scripts that work without any real user modification. I decided the best I can do for the "run-it-without-looking" crowd is to let the scripts install (by default) packages shipped with FreeBSD 6.1 RELEASE, assuming you're running 6.1. If you know how to install using newer packages, you're free to set the right environment variable in the script and deal with the consequences.

The scripts I finished today are available at www.bejtlich.net/sguil_scripts_18sep06b.tar.gz.

They include:

• sguil_sensor_install.sh: Set up Sguil sensor components.


• snort_pkg_install.sh or snort_src_install.sh: Run one or the other. These set up Snort and Barnyard.


• sguil_sensor_install_patch.sh: This patches configuration files that you should modify as listed in the README, namely sensor_agent.conf.patch, snort.conf.patch, barnyard.conf.patch, sancp.conf.patch, and log_packets.sh.patch.


• sguil_database_install_pt1.sh: Set up MySQL database, part 1.


• sguil_database_install_pt2.sh: Set up MySQL database, part 2.


• sguil_server_install.sh: Set up Sguil server.


• sguil_client_install.sh: Set up Sguil client.

If you are careful you can choose which scripts to run in order to have an all-in-one distribution or a separate box for every component (sensor, database, server, and client).

These are the prerequisites for the sensor and server.

• Register at Snort.org to download snortrules-snapshot-CURRENT.tar.gz and put them in /tmp on your sensor.
  

The client box should be installed with the X packages. Otherwise, you can add the following manually:

# pkg_add -r xorg-server
# pkg_add -r xorg-clients
# pkg_add -r bitstream-vera
# pkg_add -r perl
# pkg_add -r xorg-fonts-100dpi
# pkg_add -r xorg-fonts-75dpi
# pkg_add -r xorg-fonts-miscbitmaps

All systems should have a user sguil and a user analyst to support the components.

The smoothest use of the scripts involves the following.

• FreeBSD 6.1 RELEASE or SECURITY.


• Sensor name is taosecurity.


• Sensor is a VMware image with lnc0 interface for management and monitoring.


• Avoid the snort_pkg_install.sh, since the Snort package with FreeBSD 6.1 RELEASE is Snort 2.4.x. That will not work as I have written the scripts. Use snort_src_install.sh instead.

Those suggestions will require the least number of modifications.

There is still a problem with this setup, however. The mysqltcl package shipped with FreeBSD 6.1 RELEASE requires mysql40-client as a dependency. I install mysql50-client prior, which conflicts with mysql40-client. This means the addition of mysqltcl as a package fails while running the sguil_server_install.sh script. Without mysqltcl, you can't start sguild, which means you can't add a sguil client user and thereby can't access Sguil.

You can work around this problem by retrieving the package from my Web server www.bejtlich.net/mysqltcl-3.01.tbz and adding it manually as root:

# pkg_add -v mysqltcl-3.01.tbz

You'll then need to add a sguil client user manually.

# cd /usr/local/src/sguil-0.6.1/server
# ./sguild -c sguild.conf -u sguild.users -adduser sguil
# cp sguild.users /usr/local/etc/nsm/
# chown sguil:sguil /usr/local/etc/nsm/sguild.users

You could also use the sguild_adduser.sh script which contains basically the same, including a LD_LIBRARY_PATH in the even you have trouble creating the sguil client user manually.

#!/bin/sh -x
SGUIL=sguil-0.6.1
LD_LIBRARY_PATH=/usr/local/lib/mysql
export LD_LIBRARY_PATH
cd /usr/local/src/$SGUIL/server/
./sguild -c sguild.conf -u sguild.users -adduser sguil
cp sguild.users /usr/local/etc/nsm/
chown sguil:sguil /usr/local/etc/nsm/sguild.users

Note that as an example of grappling with problems with the FreeBSD ports tree, the current databases/mysqltcl port is broken.

I recommend viewing the included README to see what you should run in order to get Sguil installed with all components on a single box.

If you have questions I strongly recommend posting them to sguil-users [at] lists.sourceforge.net. Any question I receive I usually send to the list. You may also find faq.sguil.net helpful.

It is important to realize that these scripts do not check to see what is installed prior to acting. Parts may fail if something is missing. If something is already installed (say, Tcl) then the pkg_add for a second instance of Tcl will fail -- but that won't cause any problems.

Please consider all Sguil installation guidance prior to this to be obsolete. This post and the scripts are probably not as clear as I would like, but this is free work and the time I have allocated for it is done!

Read More

Virtual Desktop Infrastructure Seminar

Last week I attended a seminar featuring VMware and Wyse pitching their Virtual Desktop Infrastructure. (Is it just me or does VMware's site seldom render properly in Firefox?)

The Wyse rep passed around the Wyse S10 pictured at left. It lists for $299, "runs BSD" (called "ThinOS"), and features a 450 MHz AMD Geode CPU. Although it has USB ports you can't use them for thumb drives or CD-ROM drives. (More powerful units support those devices.) It has a PPTP client with support for SSL VPNs on the product roadmap. Also on the roadmap is 802.1X, PoE, and wireless support. The S10 is basically a box to access remote desktops using RDP, ICA, or a Leostream connection broker. The box can be managed remotely, and can have its firmware flashed remotely.

This is the future of "business computing." It may also be the future of non-power-user consumer computing, at least for people with modest, office-like (email, Web, etc.) needs. The local hardware will be nothing more than a window (pun intended) to remote desktops. I imagine people might want local storage, but most of it will be stored remotely.

I have to start imagining how to monitor this sort of architecture. I guess we'll spend far more time watching data centers and hardly any time watching end nodes?

Update: I forgot to mention that I believe at some point ISPs will replace their cable modems with these devices. Power users will still be able to use "dumb" cable modems or just avoid the thin client features in their new ISP platform. I also think some hardware vendor will package this thin client into a LCD screen, like the iMac.

In general, this sort of architecture will make it easy for smart PDAs to gain access to the same information I might want on my laptop or desktop. When metropolitan wireless is ubiquitous, we won't have to worry as much about synchronization issues either. Fun!

Read More

Slow Time with FreeBSD 6.1 guest on VMware Server 1.0.0 build-28343

I was prepared to release a new FreeBSD 6.1-based Sguil virtual machine today, but I ran into an old problem. The VMware Server Release Notes say "Full support for 32-bit and 64-bit FreeBSD 6.0 as guest operating systems." I expected that meant the timing problems that had forced me to use FreeBSD 5.x were no longer a problem with FreeBSD 6.x.

Well, today I built a FreeBSD 6.1 guest VM on a Windows XP SP2 host running VMware Server 1.0.0 build-28343. It turns out the guest OS runs at about half speed. I am apparently not the only person with this problem; a #snort-gui regular mentioned running ntpdate every 3 seconds (!!) to mitigate this problem.

I posted this Vmware forum question to see if anyone responds with similar experiences. If you are running FreeBSD 6.x on VMware Server, how are you handling time problems?

Read More

VMWare Switch Is a Hub

While preparing materials for my new class TCP/IP Weapons School I needed to test how the virtual switch in VMware Server behaves. I started three VMs. All had lnc0 interfaces bridged to the host's physical NIC. Two VMs had IPs 192.168.2.51 and 192.168.2.52 assigned. The third VM had no IP assigned. When 192.168.2.51 pinged 192.168.2.52, the third VM was able to see the ICMP traffic. This means the virtual switch in VMware Server appears to behave like a hub. This makes monitoring traffic easier.

Read More

Bug in Latest VMware Server Beta Affects Sguil VM

A bug in the latest VMware Server Beta (22874) affects my newest Sguil VM. I like to deploy the VM so that VM management interface lnc0 is bridged to /dev/vmnet0, and the sniffing interface lnc1 is bridged to /dev/vmnet2. On Linux this means that /dev/vmnet0 corresponds to eth0 and /dev/vmnet2 corresponds to eth1.

You can see in the screen capture at right that my second interface is listed as a "custom" network associated with "VMnet2".

When I tried starting my VM today, I got an error message saying VMnet2 was not available. After some searching I found the following thread discussing the same problem.


The solution is simple. Rather than accept the listing that VMware provides, replace VMnet2 with /dev/vmnet2. The screen capture at left shows this configuration.

Now the VM boots without any problem. Remember to alter permissions on /dev/vmnet2 if you want to use it for promiscuous sniffing. Change permissions when the VM is not booted.

Read More

Virtualization is the New Web Browser

I read the first post by the president of VMware, Diane Greene. She discusses a subject that has been gnawing at my brain since I heard that Microsoft began offering Virtual Server as a free download. Ms. Greene makes two points. First, she promotes VMware's Virtual Machine Disk Format (VMDK) as an open alternative to Microsoft's Virtual Hard Disk Image Format Specification (VHD). I would obviously like to see an open standard prevail against a closed one.

Second, she argues discusses "the question of whether virtualization should be tightly integrated into the operating system or instead a separate wholly independent layer." As you might guess she wants separation: "Tight integration comes at the unfortunate cost of giving up bias-free choice of operating system and thus software stack (i.e. OS and application program)."

This is the Web browser-in-the-OS argument all over again. Microsoft said last year that "Microsoft will build virtualization capabilities into the Windows platform based on Windows hypervisor technology, planned for availability in the next product wave of the Windows operating system, code-named Windows 'Longhorn.' This integrated hypervisor technology in the Windows operating system will be designed to provide customers with a high-performance virtualization solution for Windows and heterogeneous environments."

Everyone's doing it. Check out Red Hat's initiatives, which include integrating Xen into Fedora Core 5. FreeBSD is also bringing Xen into its source tree, probably for FreeBSD 7.0 but maybe 6.2.

You might also consider virtualization to be like a TCP/IP stack. I remember installing Trumpet Winsock on Windows 3.1 so I could dial-in to the Internet in the early 1990s. Now every OS ships with a TCP/IP stack.

With word that Microsoft Virtual Server 2007 is delayed until 2007, like Vista and Office 2007, the only question is Microsoft's ability to execute. I consider VMware to be the leader in the virtualization space. Will there come a day, however, when I'll just use the built-in virtualization technology on Windows instead of adding a third-party product? Maybe. Then again, I'm posting these ideas in Firefox -- not IE.

Read More

New Sguil VM Available for Testing

Using the scripts I described yesterday, I built a new Sguil VM. It is available here:

freebsd54-sguil-24mar06-pub1.tar.bz2 (310 MB)

SHA256 (freebsd54-sguil-24mar06-pub1.tar.bz2) =
a18bcd8114c4f40e43f777dc3f34ca917a44093e16f72a720f1ff6183e66f434

The VM is in bzip2 format. Windows users can extract it with bsdtar for Windows.

The OS is FreeBSD 5.4 with the latest security patches. Sguil 0.6.1 is set up with all components on the same system. This VM is similar to my two old VMs using FreeBSD 6.0 and Sguil 0.6.0p1.

I tried to address issues people discussed. I could not build the disks using SCSI because FreeBSD did not recognize them. I know the VM works in VMware Workstation and VMware Server Beta. I did not yet test it in VMware Player. VMware ESX Server probably doesn't work because it doesn't like IDE disks. This VM uses a 6 GB virtual disk. I gave the /nsm partition 2 GB space so you can try collecting more traffic.

I built the VM with two interfaces. As configured they are both bridging vmnet0 (the default interface). I personally change this before running the VM "in production," such that lnc0 bridges to a management interface (vmnet0 and eth0) and lnc1 bridges to a sniffing interface (vmnet2 and eth1). Yes, I am running this VM on Linux and VMware Server Beta.

Here are the accounts on the VM in (system) name: password; comment format.

• (FreeBSD) sguil: sguil; not in wheel group


• (FreeBSD) analyst: analyst; in wheel group


• (FreeBSD) root: r00t


• (MySQL) sguil: sguil


• (MySQL) root: r00t


• (Sguil) sguil: sguil

To get everything running:

1. Boot the VM. Log in as user analyst. Run 'startx' to open an X session.


2. Open an xterm. su - root. Run 'sancp_start.sh', 'snort_start.sh', '/usr/local/bin/log_packets.sh restart'.


3. Open a second xterm. su - sguil. Run 'sguild_start.sh', 'sensor_agent_start.sh', 'barnyard_start.sh'.


4. Open a third xterm. Run 'sguil_client_start.sh'.


5. The Sguil client window will appear. Use server 'localhost', port '7734', user 'sguil', password 'sguil'.


6. Select sensor 'taosecurity' when given the option.


7. Congratulations. You are running Sguil!

When all components are running, 'sockstat -4' output will look something like this:

sguil    barnyard   4502  11 tcp4   127.0.0.1:53438       127.0.0.1:7735
sguil    tclsh8.4   4464  3  tcp4   127.0.0.1:50811       127.0.0.1:7736
sguil    tclsh8.4   4464  4  tcp4   127.0.0.1:7735        *:*
sguil    tclsh8.4   4464  5  tcp4   127.0.0.1:7735        127.0.0.1:53438
sguil    tclsh8.4   4429  11 tcp4   *:7734                *:*
sguil    tclsh8.4   4429  12 tcp4   127.0.0.1:7736        *:*
sguil    tclsh8.4   4429  13 tcp4   127.0.0.1:7736        127.0.0.1:50811
mysql    mysqld     1845  10 tcp4   127.0.0.1:3306        *:*

The Sguil client connects to port 7734 TCP, where the server is listening. Barnyard connects to port 7735 TCP. The sguild server listens on port 7736 TCP for connections from sensor_agent.tcl. MySQL listens on port 3306 TCP. Note in this deployment everything is listening on localhost except for MySQL. I usually don't have port 7734 TCP listening on public IPs. I instead use SSH port forwarding to tunnel the client communications:

ssh -L 7734:localhost:7734 analyst@sensor_mgt_ip

When I start my client I then connect to localhost, port 7734.

The easiest way to test the whole setup is to netcat to port 22 TCP on a system watched by the sensor. Enter the text 'GOBBLES' when connected to port 22 TCP. There is a Snort rule that fires when Snort sees this text on port 22 TCP.

You should see an alert appear in the Sguil console.

If you have any questions, please post them here as comments. You may also get help posting them via email to sguil-users at lists dot sourceforge dot net.

Read More

New Sguil Scripts and VM

I have not been happy with the performance of FreeBSD 6.0 under VMware Workstation or VMware Server Beta. I thought some workarounds helped, but that wasn't really the case.

Also, since releasing my original Sguil installation script, I've wanted to break it into scripts for the Sguil sensor, database, server, and client.

I decided today to kill two birds with one stone. First, I broke the master script into the following smaller scripts.

• sguil_sensor_install.sh
  


• sguil_sensor_install_patch.sh


• sguil_server_install.sh


• sguil_database_install_pt1.sh


• sguil_database_install_pt2.sh


• sguil_client_install.sh

All of them are available in this archive: sguil_install_scripts.tar.gz.

These are not pretty. There is no error checking. There is no interaction. You will have to make modifications to get them to work flawlessly in your environment.

Important: As written these scripts download packages for FreeBSD 5, not 6. You can modify this.

These will work best "out of the box" if you want to install all Sguil components on a single host. This is the case because I did not make any adjustments to have MySQL listen on a public interface, for example.

So what good are these? Well, you can now see exactly what software is required for each Sguil component. It's possible I may have erred on the side of including one too many packages for a certain component, but I believe this configuration will work. I did some testing to iron out bugs, but I can't guarantee success.

Using these scripts, I created a new Sguil 0.6.1 complete (sensor/database/server/client) VM on FreeBSD 5.4 RELEASE. The following shows how I invoked the scripts, and the adjustments I made to get the patches to work on this VM.

First I downloaded the script collection.

taosecurity:/root# fetch http://www.bejtlich.net/sguil_install_scripts.tar.gz
sguil_install_scripts.tar.gz                  100% of 2552  B 1716 kBps
taosecurity:/root# tar -xzvf sguil_install_scripts.tar.gz
x scripts
x scripts/sguil_client_install.sh
x scripts/sguil_sensor_install.sh
x scripts/sguil_server_install.sh
x scripts/sguil_sensor_install_patch.sh
x scripts/sguil_database_install_pt2.sh
x scripts/sguil_database_install_pt1.sh
taosecurity:/root#
taosecurity:/root# cd scripts/
taosecurity:/root/scripts# ls
sguil_client_install.sh         sguil_sensor_install.sh
sguil_database_install_pt1.sh   sguil_sensor_install_patch.sh
sguil_database_install_pt2.sh   sguil_server_install.sh
taosecurity:/root/scripts# chmod +x *.sh

Next I started with the sensor installation.

taosecurity:/root/scripts# ./sguil_sensor_install.sh
Starting Sguil sensor installation.
...edited...
Sguil server installation finished.

You must modify the following patches in /usr/local/etc/nsm
to match your environment.

sensor_agent.conf.patch
snort.conf.patch
barnyard.conf.patch
sancp.conf.patch
log_packets.sh.patch

When done, run sguil_sensor_install_patch.sh

Next, modify the start scripts to match your environment.

These are in the /home/sguil directory:

barnyard_start.sh       sensor_agent_start.sh

You'll notice the end of the script suggests making changes to patches to match your environment. Here are the common changes:

• sensor_agent.conf.patch: change hostname from 'gruden' to 'your_hostname'


• snort.conf.patch: change 'var RULE_PATH /nsm/rules/gruden' to 'nsm/rules/your_hostname'


• barnyard.conf.patch: change hostname from 'gruden' to 'your_hostname'; change interface from 'lnc1' to whatever your system uses


• sancp.conf.patch: probably no changes


• log_packets.sh.patch: change hostname from 'gruden' to your_hostname; change interface from 'lnc1' to whatever your system uses

Once I made changes I needed, I ran sguil_sensor_install_patch.sh.

taosecurity:/root/scripts# ./sguil_sensor_install_patch.sh
Patching Sguil sensor configuration and logging scripts.

Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- sensor_agent.conf  Wed Dec 28 14:57:30 2005
|+++ sensor_agent.conf.diff     Wed Dec 28 14:58:33 2005
--------------------------
Patching file sensor_agent.conf using Plan A...
Hunk #1 succeeded at 13.
Hunk #2 succeeded at 22.
Hunk #3 succeeded at 55 (offset 6 lines).
done
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- snort.conf Wed Dec 28 14:30:42 2005
|+++ snort.conf.diff    Wed Dec 28 15:07:23 2005
--------------------------
Patching file snort.conf using Plan A...
Hunk #1 succeeded at 107.
Hunk #2 succeeded at 621.
done
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- barnyard.conf      Wed Dec 28 14:30:42 2005
|+++ barnyard.conf.diff Wed Dec 28 15:00:38 2005
--------------------------
Patching file barnyard.conf using Plan A...
Hunk #1 succeeded at 23.
Hunk #2 succeeded at 38.
Hunk #3 succeeded at 133.
done
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- sancp.conf Wed Dec 28 14:30:42 2005
|+++ sancp.conf.diff    Wed Dec 28 15:01:49 2005
--------------------------
Patching file sancp.conf using Plan A...
Hunk #1 succeeded at 45.
done
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- log_packets.sh     Wed Dec 28 20:11:54 2005
|+++ log_packets.sh.diff        Wed Dec 28 20:12:39 2005
--------------------------
Patching file log_packets.sh using Plan A...
Hunk #1 succeeded at 28.
done

The sensor installation provides several start scripts that must also be adjusted for your environment:

• /root/snort_start.sh: change 'gruden' to 'your_hostname' and 'lnc1' to your sniffing interface


• /root/sancp_start.sh: change 'gruden' to 'your_hostname' and 'lnc1' to your sniffing interface


• /home/sguil/barnyard_start.sh: change 'gruden' to 'your_hostname'

At this point I was ready to install the Sguil database. I broke this into two scripts because I needed a delay to ensure MySQL was running before taking certain actions.

taosecurity:/root/scripts# ./sguil_database_install_pt1.sh
Starting Sguil database installation, part 1.
...edited...
The latest information about MySQL is available on the web at
http://www.mysql.com
Support MySQL by buying support/licenses at https://order.mysql.com
Run sguil_database_install_pt2.sh after MySQL is running.
taosecurity:/root/scripts# Starting mysqld daemon with databases from /var/db/mysql
taosecurity:/root/scripts# sockstat -4 | grep 3306
mysql    mysqld     1187  10 tcp4   *:3306                *:*

Now I start part 2 of the database installation after checking to be sure MySQL is listening on port 3306. Note that the script edits /etc/rc.conf to make MySQL listen on localhost on port 3306. You can also do the following:

# mysqladmin -p shutdown
Enter password:

To restart the server:

mysqld_safe --bind-address=127.0.0.1 --user=mysql &

taosecurity:/root/scripts# ./sguil_database_install_pt2.sh
Starting Sguil client installation, part 2.

+-------------------+
| Tables_in_sguildb |
+-------------------+
| history           |
| nessus            |
| nessus_data       |
| portscan          |
| sensor            |
| sessions          |
| status            |
| user_info         |
| version           |
+-------------------+
Sguil database installation complete.

The sensor and database are done. On the the Sguil server. You'll notice I install mysqltcl from the ports tree. I am no longer hosting a package for this. You'll also be prompted to enter a password for the Sguil client. This is proof that mysqltcl and sguild are working.

taosecurity:/root/scripts# ./sguil_server_install.sh
Starting Sguil server installation.
...edited...
=> Attempting to fetch from http://www.xdobry.de/mysqltcl/.
mysqltcl-3.01.tar.gz                          100% of  164 kB   62 kBps
===>  Extracting for mysqltcl-3.01
=> MD5 Checksum OK for mysqltcl-3.01.tar.gz.
===>  Patching for mysqltcl-3.01
===>  Applying FreeBSD patches for mysqltcl-3.01
===>   mysqltcl-3.01 depends on shared library: tcl84 - found
===>   mysqltcl-3.01 depends on shared library: mysqlclient.15 - found
===>  Configuring for mysqltcl-3.01
===>  Building for mysqltcl-3.01
...edited...
Create a Sguil client user password when prompted.
Please enter a passwd for sguil:
Retype passwd:
User 'sguil' added successfully
SGUILD: Exiting...
Sguil server installation finished.

You must modify /usr/local/etc/nsm/sguild.conf.patch
to match your environment.

When done, apply it:

patch -p0 < sguild.conf.patch

As the end of the script notes, you should patch /usr/local/etc/nsm/sguild.conf. The /usr/local/etc/nsm/sguild.conf.patch by default should work as is for those with a local installation.

taosecurity:/root/scripts# cd /usr/local/etc/nsm/
taosecurity:/usr/local/etc/nsm# patch -p0 < sguild.conf.patch
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- sguild.conf        Wed Dec 28 16:29:21 2005
|+++ sguild.conf.diff   Wed Dec 28 16:30:34 2005
--------------------------
Patching file sguild.conf using Plan A...
Hunk #1 succeeded at 1.
Hunk #2 succeeded at 30.
Hunk #3 succeeded at 42.
Hunk #4 succeeded at 71.
done

At last we are ready to install the client. It's fairly simple.

taosecurity:/root/scripts# ./sguil_client_install.sh
Starting Sguil client installation.
...edited...
Sguil client installation finished.

I'd like to share a few words on requirements for running these scripts.

• Make sure you have users sguil and analyst on the system.


• With FreeBSD 5.4, I applied the User installation. I manually extracted the ports tree by downloading it from ftp://ftp.freebsd.org/pub/FreeBSD/ports/ports-current/ports.tar.gz and extracting it in /usr. I did that because the ports tree on the CD is 10 months old.


• If you create a system with DHCP, make sure you have an entry in /etc/hosts for 127.0.0.1 and the name of your sensor, like 'taosecurity taosecurity.taosecurity.com'.

Here are the open ports on a system where all components are running. I omit sshd.

taosecurity:/home/analyst$ sockstat -4 | grep -v sshd
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
sguil    barnyard   717   12 tcp4   127.0.0.1:51062       127.0.0.1:7735
sguil    tclsh8.4   701   3  tcp4   127.0.0.1:53610       127.0.0.1:7736
sguil    tclsh8.4   701   4  tcp4   127.0.0.1:7735        *:*
sguil    tclsh8.4   701   6  tcp4   127.0.0.1:7735        127.0.0.1:51062
sguil    tclsh8.4   672   12 tcp4   *:7734                *:*
sguil    tclsh8.4   672   13 tcp4   127.0.0.1:7736        *:*
sguil    tclsh8.4   672   14 tcp4   127.0.0.1:7736        127.0.0.1:53610
mysql    mysqld     505   10 tcp4   127.0.0.1:3306        *:*
root     sendmail   430   3  tcp4   127.0.0.1:25          *:*
root     syslogd    315   6  udp4   *:514                 *:*
root     dhclient   247   4  udp4   *:68                  *:*

I plan to post the new VM when I get a chance.

Read More

Promiscuous Mode on Linux VMware Server Beta

I've been writing about deploying VMware Server Beta on Debian. Today I tried my Sguil VM and found I could not sniff all traffic on lnc1. I could only see broadcast traffic (ARP, DHCP, etc.). That indicated lnc1 was not seeing the physical interface in promiscuous mode.

I have the lnc1 interface corresponding to /dev/vmnet2, which is bridged to eth1 on the Linux host. After checking to be sure eth1 was up and could see all traffic as I expected, I couldn't think of a reason why lnc1 wouldn't see the same. I did not have this problem on Windows when I wrote about it.

Luckily I found this GSX document which said:

GSX Server does not allow the virtual Ethernet adapter to go into promiscuous mode unless the user running GSX Server has permission to make that setting. This follows the standard Linux practice that only root can put a network interface into promiscuous mode.

Well, I have the VMware Server components running as root.

If you want all users to be able to set the virtual Ethernet adapter (/dev/vmnet0 in our example) to promiscuous mode, you can simply run the following command on the host operating system as root.

chmod a+rw /dev/vmnet0 

That sounded promising. I looked at my /dev/vmnet* first:

donato:/dev# ls -al vmnet*
crw-------  1 root root 119, 0 Mar 23 08:21 vmnet0
crw-------  1 root root 119, 1 Mar 23 08:21 vmnet1
crw-------  1 root root 119, 2 Mar 23 08:22 vmnet2
crw-------  1 root root 119, 3 Mar 23 08:21 vmnet3
crw-------  1 root root 119, 4 Mar 23 08:21 vmnet4
crw-------  1 root root 119, 5 Mar 23 08:21 vmnet5
crw-------  1 root root 119, 6 Mar 23 08:21 vmnet6
crw-------  1 root root 119, 7 Mar 23 08:21 vmnet7
crw-------  1 root root 119, 8 Mar 23 08:21 vmnet8
crw-------  1 root root 119, 9 Mar 23 08:21 vmnet9

Following the article's advice:

donato:/dev# chmod a+rw /dev/vmnet2
donato:/dev# ls -al vmnet*
crw-------  1 root root 119, 0 Mar 23 08:21 vmnet0
crw-------  1 root root 119, 1 Mar 23 08:21 vmnet1
crw-rw-rw-  1 root root 119, 2 Mar 23 08:22 vmnet2
crw-------  1 root root 119, 3 Mar 23 08:21 vmnet3
crw-------  1 root root 119, 4 Mar 23 08:21 vmnet4
crw-------  1 root root 119, 5 Mar 23 08:21 vmnet5
crw-------  1 root root 119, 6 Mar 23 08:21 vmnet6
crw-------  1 root root 119, 7 Mar 23 08:21 vmnet7
crw-------  1 root root 119, 8 Mar 23 08:21 vmnet8
crw-------  1 root root 119, 9 Mar 23 08:21 vmnet9

Success. Now I can sniff all traffic in promiscuous mode on lnc1.

Read More

Short Note Regarding VMware Server Beta and VMware Server Console

Yesterday I posted experiences with VMware Server Beta. I repeated the installation process on a normal Intel laptop running Debian and I had no problems, save one. When I tried to connect to the VMware Server using the VMware Server Console (running on Windows 2000), I could never see the VM screen appear. The VM seemed to be running fine, but I had the same problem as described in this forum thread. Luckily, the fix in the thread worked for me too; I set the permissions on the .vmx file to 755 and I was able to see the VM screen in VMware Server Console.

The only unfortunate aspect of the endeavor was the limitations of my hardware. Although everything runs, a 366 MHz PII laptop with 287 MB (?) RAM does not a good VMware Server make.

Also: /usr/lib/vmware-mui/apache/bin/apachectl controls VMware's httpd server.

Another note: I had to rerun vmware-config.pl to change networking options. When I did that, I lost httpd. To restore it, I had to run vmware-config-mui.pl.

Read More

VMware Server Beta on Debian Status Report

I previously reported running FreeBSD 6.0 on my Hacom Lex Twister VIA 1 GHz Nehemiah. Today I decided to install Debian on it. I will warn you now that the majority of this post is documentation for my own reference, and the hope it might help someone else. If you're looking for short, pithy security insights, today is not your day.

I used a USB-connected external CD burner as my installation source. The Hacom is very temperamental with it. I had to disable all booting sources except the USB-CD. Next I booted the Hacom with the USB-CD off. Once I got an error from the BIOS about a lack of bootable devices, I then turn on the USB-CD and press to try booting again.

Installing Debian on the Hacom was fairly painless. I did not add any packages with aptitude during the installation. That meant the following packages were installed.

hacom:~# dpkg --list
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name           Version        Description
+++-==============-==============-============================================
ii  adduser        3.63           Add and remove users and groups
ii  apt            0.5.28.6       Advanced front-end for dpkg
ii  apt-utils      0.5.28.6       APT utility programs
ii  aptitude       0.2.15.9-2     terminal-based apt frontend
ii  at             3.1.8-11       Delayed job execution and batch processing
ii  base-config    2.53.10        Debian base system configurator
ii  base-files     3.1.2          Debian base system miscellaneous files
ii  base-passwd    3.5.9          Debian base system master password and group
ii  bash           2.05b-26       The GNU Bourne Again SHell
ii  bsdmainutils   6.0.17         collection of more utilities from FreeBSD
ii  bsdutils       2.12p-4sarge1  Basic utilities from 4.4BSD-Lite
ii  console-common 0.7.49         Basic infrastructure for text console config
ii  console-data   2002.12.04dbs- Keymaps, fonts, charset maps, fallback table
ii  console-tools  0.2.3dbs-56    Linux console and font utilities
ii  coreutils      5.2.1-2        The GNU core utilities
ii  cpio           2.5-1.3        GNU cpio -- a program to manage archives of
ii  cramfsprogs    1.1-6          Tools for CramFs (Compressed ROM File System
ii  cron           3.0pl1-86      management of regular background processing
ii  dash           0.5.2-5        The Debian Almquist Shell
ii  debconf        1.4.30.13      Debian configuration management system
ii  debconf-i18n   1.4.30.13      full internationalization support for debcon
ii  debianutils    2.8.4          Miscellaneous utilities specific to Debian
ii  dhcp-client    2.0pl5-19.1    DHCP Client
ii  diff           2.8.1-11       File comparison utilities
ii  discover1      1.7.7          hardware identification system
ii  discover1-data 1.2005.01.08   hardware lists for libdiscover1
ii  dpkg           1.10.28        Package maintenance system for Debian
ii  dselect        1.10.28        a user tool to manage Debian packages
ii  e2fslibs       1.37-2sarge1   ext2 filesystem libraries
ii  e2fsprogs      1.37-2sarge1   ext2 file system utilities and libraries
ii  ed             0.2-20         The classic unix line editor
ii  eject          2.0.13deb-8sar ejects CDs and operates CD-Changers under Li
ii  exim4          4.50-8         metapackage to ease exim MTA (v4) installati
ii  exim4-base     4.50-8         support files for all exim MTA (v4) packages
ii  exim4-config   4.50-8         configuration for the exim MTA (v4)
ii  exim4-daemon-l 4.50-8         lightweight exim MTA (v4) daemon
ii  fdutils        5.4-20040228-1 Linux floppy utilities
ii  findutils      4.1.20-6       utilities for finding files--find, xargs, an
ii  gcc-3.3-base   3.3.5-13       The GNU Compiler Collection (base package)
ii  gettext-base   0.14.4-2       GNU Internationalization utilities for the b
ii  grep           2.5.1.ds1-4    GNU grep, egrep and fgrep
ii  groff-base     1.18.1.1-7     GNU troff text-formatting system (base syste
ii  grub           0.95+cvs200406 GRand Unified Bootloader
ii  gzip           1.3.5-10sarge1 The GNU compression utility
ii  hostname       2.13           A utility to set/show the host name or domai
ii  hotplug        0.0.20040329-2 Linux Hotplug Scripts
ii  ifupdown       0.6.7          high level tools to configure network interf
ii  info           4.7-2.2        Standalone GNU Info documentation browser
ii  initrd-tools   0.1.81.1       tools to create initrd image for prepackaged
ii  initscripts    2.86.ds1-1     Standard scripts needed for booting and shut
ii  ipchains       1.3.10-15      Network firewalling for Linux 2.2.x
ii  iptables       1.2.11-10      Linux kernel 2.4+ iptables administration to
ii  iputils-ping   20020927-2     Tools to test the reachability of network ho
ii  kernel-image-2 2.4.27-10sarge Linux kernel image for version 2.4.27 on 386
ii  kernel-pcmcia- 2.4.27-10sarge Mainstream PCMCIA modules 2.4.27 on 386
ii  klogd          1.4.1-17       Kernel Logging Daemon
ii  libacl1        2.2.23-1       Access control list shared library
ii  libattr1       2.4.16-1       Extended attribute shared library
ii  libblkid1      1.37-2sarge1   block device id library
ii  libc6          2.3.2.ds1-22   GNU C Library: Shared libraries and Timezone
ii  libcap1        1.10-14        support for getting/setting POSIX.1e capabil
ii  libcomerr2     1.37-2sarge1   common error description library
ii  libconsole     0.2.3dbs-56    Shared libraries for Linux console and font
ii  libdb1-compat  2.1.3-7        The Berkeley database routines [glibc 2.0/2.
ii  libdb3         3.2.9-22       Berkeley v3 Database Libraries [runtime]
ii  libdb4.2       4.2.52-18      Berkeley v4.2 Database Libraries [runtime]
ii  libdiscover1   1.7.7          hardware identification library
ii  libgcc1        3.4.3-13       GCC support library
ii  libgcrypt11    1.2.0-11.1     LGPL Crypto library - runtime library
ii  libgdbm3       1.8.3-2        GNU dbm database routines (runtime version)
ii  libgnutls11    1.0.16-13.1    GNU TLS library - runtime library
ii  libgpg-error0  1.0-1          library for common error values and messages
ii  liblocale-gett 1.01-17        Using libc functions for internationalizatio
ii  liblockfile1   1.06           NFS-safe locking library, includes dotlockfi
ii  liblzo1        1.08-1.2       A real-time data compression library
ii  libncurses5    5.4-4          Shared libraries for terminal handling
ii  libnewt0.51    0.51.6-20      Not Erik's Windowing Toolkit - text mode win
ii  libopencdk8    0.5.5-10       Open Crypto Development Kit (OpenCDK) (runti
ii  libpam-modules 0.76-22        Pluggable Authentication Modules for PAM
ii  libpam-runtime 0.76-22        Runtime support for the PAM library
ii  libpam0g       0.76-22        Pluggable Authentication Modules library
ii  libpcap0.7     0.7.2-7        System interface for user-level packet captu
ii  libpcre3       4.5-1.2sarge1  Perl 5 Compatible Regular Expression Library
ii  libpopt0       1.7-5          lib for parsing cmdline parameters
ii  libsigc++-1.2- 1.2.5-4        type-safe Signal Framework for C++ - runtime
ii  libss2         1.37-2sarge1   command-line interface parsing library
ii  libssl0.9.7    0.9.7e-3sarge1 SSL shared libraries
ii  libstdc++5     3.3.5-13       The GNU Standard C++ Library v3
ii  libtasn1-2     0.2.10-3       Manage ASN.1 structures (runtime)
ii  libtext-charwi 0.04-1         get display widths of characters on the term
ii  libtext-iconv- 1.2-3          Convert between character sets in Perl
ii  libtext-wrapi1 0.06-1         internationalized substitute of Text::Wrap
ii  libtextwrap1   0.1-1          text-wrapping library with i18n - runtime
ii  libusb-0.1-4   0.1.10a-9.sarg userspace USB programming library
ii  libuuid1       1.37-2sarge1   universally unique id library
ii  libwrap0       7.6.dbs-8      Wietse Venema's TCP wrappers library
ii  locales        2.3.2.ds1-22   GNU C Library: National Language (locale) da
ii  login          4.0.3-31sarge5 system login tools
ii  logrotate      3.7-5          Log rotation utility
ii  mailx          8.1.2-0.200405 A simple mail user agent
ii  makedev        2.3.1-77       creates device files in /dev
ii  man-db         2.4.2-21       The on-line manual pager
ii  manpages       1.70-1         Manual pages about using a GNU/Linux system
ii  mawk           1.3.3-11       a pattern scanning and text processing langu
ii  modutils       2.4.26-1.2     Linux module utilities
ii  mount          2.12p-4sarge1  Tools for mounting and manipulating filesyst
ii  nano           1.2.4-5        free Pico clone with some new features
ii  ncurses-base   5.4-4          Descriptions of common terminal types
ii  ncurses-bin    5.4-4          Terminal-related programs and man pages
ii  net-tools      1.60-10        The NET-3 networking toolkit
ii  netbase        4.21           Basic TCP/IP networking system
ii  netkit-inetd   0.10-10        The Internet Superserver
ii  nvi            1.79-22        4.4BSD re-implementation of vi
ii  passwd         4.0.3-31sarge5 change and administer password and group dat
ii  pciutils       2.1.11-15      Linux PCI Utilities
ii  pcmcia-cs      3.2.5-10       PCMCIA Card Services for Linux
ii  perl-base      5.8.4-8        The Pathologically Eclectic Rubbish Lister
ii  ppp            2.4.3-20050321 Point-to-Point Protocol (PPP) daemon
ii  pppconfig      2.3.11         A text menu based utility for configuring pp
ii  pppoe          3.5-4          PPP over Ethernet driver
ii  pppoeconf      1.7            configures PPPoE/ADSL connections
ii  procps         3.2.1-2        The /proc file system utilities
ii  psmisc         21.5-1         Utilities that use the proc filesystem
ii  sed            4.1.2-8        The GNU sed stream editor
ii  slang1a-utf8   1.4.9dbs-8     The S-Lang programming library with utf8 sup
ii  sysklogd       1.4.1-17       System Logging Daemon
ii  sysv-rc        2.86.ds1-1     Standard boot mechanism using symlinks in /e
ii  sysvinit       2.86.ds1-1     System-V like init
ii  tar            1.14-2         GNU tar
ii  tasksel        2.24           Tool for selecting tasks for installation on
ii  tcpd           7.6.dbs-8      Wietse Venema's TCP wrapper utilities
ii  telnet         0.17-29        The telnet client
ii  usbutils       0.70-8         USB console utilities
ii  util-linux     2.12p-4sarge1  Miscellaneous system utilities
ii  wget           1.9.1-12       retrieves files from the web
ii  whiptail       0.51.6-20      Displays user-friendly dialog boxes from she
ii  zlib1g         1.2.2-4.sarge. compression library - runtime

That's pretty sparse. No SSH, no FTP client!

Here's my partioning scheme:

hacom:~# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/hda1             250M   52M  186M  22% /
tmpfs                 245M     0  245M   0% /dev/shm
/dev/hda3             4.6G   33M  4.4G   1% /home
/dev/hda8             361M  8.1M  334M   3% /tmp
/dev/hda5             4.6G  122M  4.3G   3% /usr
/dev/hda6             2.8G   77M  2.6G   3% /var
/dev/hda4             216G   33M  205G   1% /vmware

The first packaged I added was SSH:

hacom:~# apt-get install ssh

After answering some sensible curses-based questions, I had SSH listening on port 22.

At this point I'm going to post my dmesg output here for those of you who want to know how the internals are recognized.

Linux version 2.4.27-2-386 (horms@tabatha.lab.ultramonkey.org)
 (gcc version 3.3.5 (Debian 1:3.3.5-13)) #1 Wed Aug 17 09:33:35 UTC 2005
BIOS-provided physical RAM map:
 BIOS-e820: 0000000000000000 - 000000000009fc00 (usable)
 BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved)
 BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved)
 BIOS-e820: 0000000000100000 - 000000001eff0000 (usable)
 BIOS-e820: 000000001eff0000 - 000000001eff3000 (ACPI NVS)
 BIOS-e820: 000000001eff3000 - 000000001f000000 (ACPI data)
 BIOS-e820: 00000000ffff0000 - 0000000100000000 (reserved)
495MB LOWMEM available.
On node 0 totalpages: 126960
zone(0): 4096 pages.
zone(1): 122864 pages.
zone(2): 0 pages.
ACPI: RSDP (v000 CLE266                                    ) @ 0x000f69b0
ACPI: RSDT (v001 CLE266 AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x1eff3000
ACPI: FADT (v001 CLE266 AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x1eff3040
ACPI: DSDT (v001 CLE266 AWRDACPI 0x00001000 MSFT 0x0100000e) @ 0x00000000
Kernel command line: root=/dev/hda1 ro
No local APIC present or hardware disabled
Initializing CPU#0
Detected 1002.300 MHz processor.
Console: colour VGA+ 80x25
Calibrating delay loop... 1998.84 BogoMIPS
Memory: 496364k/507840k available (1069k kernel code, 11088k reserved, 459k data, 96k init, 0k highmem)
Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
Inode cache hash table entries: 32768 (order: 6, 262144 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 32768 (order: 5, 131072 bytes)
Page-cache hash table entries: 131072 (order: 7, 524288 bytes)
CPU: L1 I Cache: 64K (32 bytes/line), D cache 64K (32 bytes/line)
CPU: L2 Cache: 64K (32 bytes/line)
CPU:     After generic, caps: 0381b83f 00000000 00000000 00000000
CPU:             Common caps: 0381b83f 00000000 00000000 00000000
CPU: Centaur VIA Nehemiah stepping 08
Enabling fast FPU save and restore... done.
Enabling unmasked SIMD FPU exception support... done.
Checking 'hlt' instruction... OK.
Checking for popad bug... OK.
POSIX conformance testing by UNIFIX
ACPI: Subsystem revision 20040326
ACPI: Interpreter disabled.
PCI: PCI BIOS revision 2.10 entry at 0xfb400, last bus=3
PCI: Using configuration type 1
PCI: Probing PCI hardware
PCI: ACPI tables contain no PCI IRQ routing entries
PCI: Probing PCI hardware (bus 00)
PCI: Using IRQ router VIA [1106/3177] at 00:11.0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
VFS: Disk quotas vdquot_6.5.1
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x0
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with HUB-6 MANY_PORTS MULTIPORT SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x03f8 (irq = 4) is a 16550A
COMX: driver version 0.85 (C) 1995-1999 ITConsult-Pro Co. 
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP: routing cache hash table of 4096 buckets, 32Kbytes
TCP: Hash tables configured (established 32768 bind 65536)
Linux IP multicast router 0.06 plus PIM-SM
RAMDISK: cramfs filesystem found at block 0
RAMDISK: Loading 3692 blocks [1 disk] into ram disk... done.
Freeing initrd memory: 3692k freed
VFS: Mounted root (cramfs filesystem).
Freeing unused kernel memory: 96k freed
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
ide: late registration of driver.
VP_IDE: IDE controller at PCI slot 00:11.1
VP_IDE: chipset revision 6
VP_IDE: not 100% native mode: will probe irqs later
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
VP_IDE: VIA vt8235 (rev 00) IDE UDMA133 controller on pci00:11.1
    ide0: BM-DMA at 0xee00-0xee07, BIOS settings: hda:DMA, hdb:pio
    ide1: BM-DMA at 0xee08-0xee0f, BIOS settings: hdc:pio, hdd:pio
hda: WDC WD2500SB-01KBC0, ATA DISK drive
blk: queue df825b60, I/O limit 4095Mb (mask 0xffffffff)
ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
hda: attached ide-disk driver.
hda: 488397168 sectors (250059 MB) w/8192KiB Cache, CHS=30401/255/63, UDMA(33)
Partition check:
 /dev/ide/host0/bus0/target0/lun0: p1 p2 < p5 p6 p7 p8 > p3 p4
Journalled Block Device driver loaded
kjournald starting.  Commit interval 5 seconds
EXT3-fs: mounted filesystem with ordered data mode.
Adding Swap: 1502036k swap-space (priority -1)
EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,1), internal journal
SCSI subsystem driver Revision: 1.00
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,3), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,8), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,5), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,6), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,4), internal journal
EXT3-fs: mounted filesystem with ordered data mode.
Linux Kernel Card Services 3.1.22
  options:  [pci] [cardbus] [pm]
PCI: Found IRQ 11 for device 00:0c.0
PCI: Sharing IRQ 11 with 00:08.0
PCI: Sharing IRQ 11 with 00:10.0
PCI: Found IRQ 5 for device 00:0c.1
PCI: Sharing IRQ 5 with 00:09.0
PCI: Sharing IRQ 5 with 00:10.1
Yenta ISA IRQ mask 0x0008, PCI irq 11
Socket status: 30000006
Yenta ISA IRQ mask 0x0008, PCI irq 5
Socket status: 30000006
irda_init()
Intel(R) PRO/1000 Network Driver - version 5.2.52-k3
Copyright (c) 1999-2004 Intel Corporation.
PCI: Found IRQ 11 for device 00:08.0
PCI: Sharing IRQ 11 with 00:0c.0
PCI: Sharing IRQ 11 with 00:10.0
e1000: eth0: e1000_probe: Intel(R) PRO/1000 Network Connection
PCI: Found IRQ 5 for device 00:09.0
PCI: Sharing IRQ 5 with 00:0c.1
PCI: Sharing IRQ 5 with 00:10.1
e1000: eth1: e1000_probe: Intel(R) PRO/1000 Network Connection
PCI: Found IRQ 10 for device 00:0a.0
PCI: Sharing IRQ 10 with 00:10.2
PCI: Sharing IRQ 10 with 00:11.5
e1000: eth2: e1000_probe: Intel(R) PRO/1000 Network Connection
Via 686a/8233/8235 audio driver 1.9.1-ac3
PCI: Found IRQ 10 for device 00:11.5
PCI: Sharing IRQ 10 with 00:0a.0
PCI: Sharing IRQ 10 with 00:10.2
via82cxxx: Six channel audio available
PCI: Setting latency timer of device 00:11.5 to 64
ac97_codec: AC97 Audio codec, id: VIA97 (Unknown)
via82cxxx: board #1 at 0xEF00, IRQ 10
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
usb-uhci.c: $Revision: 1.275 $ time 09:50:48 Aug 17 2005
usb-uhci.c: High bandwidth mode enabled
PCI: Found IRQ 11 for device 00:10.0
PCI: Sharing IRQ 11 with 00:08.0
PCI: Sharing IRQ 11 with 00:0c.0
usb-uhci.c: USB UHCI at I/O 0xeb00, IRQ 11
usb-uhci.c: Detected 2 ports
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
PCI: Found IRQ 5 for device 00:10.1
PCI: Sharing IRQ 5 with 00:09.0
PCI: Sharing IRQ 5 with 00:0c.1
usb-uhci.c: USB UHCI at I/O 0xec00, IRQ 5
usb-uhci.c: Detected 2 ports
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 2 ports detected
PCI: Found IRQ 10 for device 00:10.2
PCI: Sharing IRQ 10 with 00:0a.0
PCI: Sharing IRQ 10 with 00:11.5
usb-uhci.c: USB UHCI at I/O 0xed00, IRQ 10
usb-uhci.c: Detected 2 ports
usb.c: new USB bus registered, assigned bus number 3
hub.c: USB hub found
hub.c: 2 ports detected
usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
PCI: Found IRQ 7 for device 00:10.3
ehci_hcd 00:10.3: VIA Technologies, Inc. USB 2.0
ehci_hcd 00:10.3: irq 7, pci mem df9f5000
usb.c: new USB bus registered, assigned bus number 4
ehci_hcd 00:10.3: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
hub.c: 6 ports detected
irda_init()
uhci.c: USB Universal Host Controller Interface driver v1.1
pci_hotplug: PCI Hot Plug PCI Core version: 0.5
shpchp: acpi_shpchprm:get_device PCI ROOT HID fail=0x1001
pci_hotplug: PCI Hot Plug PCI Core version: 0.5
pciehp: acpi_pciehprm:get_device PCI ROOT HID fail=0x1001
e1000: eth0: e1000_watchdog: NIC Link is Up 100 Mbps Full Duplex
Real Time Clock Driver v1.10f
cs: IO port probe 0x0100-0x04ff: excluding 0x170-0x177 0x370-0x377 0x4d0-0x4d7
cs: IO port probe 0x0800-0x08ff: clean.
cs: IO port probe 0x0c00-0x0cff: clean.
cs: IO port probe 0x0a00-0x0aff: clean.

With that out of the way, we can talk about why I'm installing Debian on this box. I'd like to run VMware Server Beta on it. Sure, Debian is not an officially supported platform, but I read this post from a few days ago and thought "this can work."

The original post that gave me hope to run VMware Server Beta on Debian mentioned the requirement to add several packages. I added the following. Note that I use the correct package names, while the post does not.

hacom:~# apt-get install kernel-source-2.4.27
hacom:~# apt-get install kernel-headers-2.4.27-2-386
hacom:~# apt-get install build-essential

With these packages installed, I set up the kernel files as outlined in the post.

hacom:/usr/src# bzip2 -d kernel-source-2.4.27.tar.bz2
hacom:/usr/src# tar -xf  kernel-source-2.4.27.tar
hacom:/usr/src# ln -s kernel-source-2.4.27 linux
hacom:/usr/src# mv /usr/src/kernel-source-2.4.27/include /usr/src/kernel-source-2.4.27/include.orig
hacom:/usr/src# ln -s /usr/src/kernel-headers-2.4.27-2-386/include /usr/src/kernel-source-2.4.27/include

Now I was ready to extract the VMware archives and try installing them.

hacom:/tmp# cd /usr/local/src
hacom:/usr/local/src# ls
VMware-mui-e.x.p-22088.tar.gz  VMware-server-e.x.p-22088.tar.gz
hacom:/usr/local/src# tar -xzf VMware-server-e.x.p-22088.tar.gz
hacom:/usr/local/src# cd vmware-server-distrib/
hacom:/usr/local/src/vmware-server-distrib# ls
FILES  bin  doc  etc  installer  lib  man  sbin  vmware-install.pl
hacom:/usr/local/src/vmware-server-distrib# ./vmware-install.pl
Creating a new installer database using the tar3 format.

Installing the content of the package.

In which directory do you want to install the binary files?
[/usr/bin]

What is the directory that contains the init directories (rc0.d/ to rc6.d/)?
[/etc]

What is the directory that contains the init scripts?
[/etc/init.d]

In which directory do you want to install the daemon files?
[/usr/sbin]

In which directory do you want to install the library files?
[/usr/lib/vmware]

The path "/usr/lib/vmware" does not exist currently. This program is going to
create it, including needed parent directories. Is this what you want? [yes]

In which directory do you want to install the manual files?
[/usr/share/man]

In which directory do you want to install the documentation files?
[/usr/share/doc/vmware]

The path "/usr/share/doc/vmware" does not exist currently. This program is going
to create it, including needed parent directories. Is this what you want?
[yes]

The installation of VMware Server e.x.p build-22088 for Linux completed
successfully. You can decide to remove this software from your system at any
time by invoking the following command: "/usr/bin/vmware-uninstall.pl".

Before running VMware Server for the first time, you need to configure it by
invoking the following command: "/usr/bin/vmware-config.pl". Do you want this
program to invoke the command for you now? [yes]

The correct version of one or more libraries needed to run VMware Server may be
missing.  This is the output of ldd /usr/bin/vmware:
        libm.so.6 => /lib/libm.so.6 (0x4001a000)
        libdl.so.2 => /lib/libdl.so.2 (0x4003c000)
        libpthread.so.0 => /lib/libpthread.so.0 (0x4003f000)
        libX11.so.6 => not found
        libXtst.so.6 => not found
        libXext.so.6 => not found
        libXt.so.6 => not found
        libICE.so.6 => not found
        libSM.so.6 => not found
        libXrender.so.1 => not found
        libz.so.1 => /usr/lib/libz.so.1 (0x40092000)
        libc.so.6 => /lib/libc.so.6 (0x400a4000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

This program cannot tell for sure, but you may need to upgrade libc5 to glibc
before you can run VMware Server.

Hit enter to continue.

At this point I knew I had a problem. I didn't like seeing all of those "not found" messages, so I aborted and added the necessary packages.

hacom:~# apt-get install libx11-6
hacom:~# apt-get install libxtst6
hacom:~# apt-get install libxt6
hacom:~# apt-get install libxrender1

When I later ran into trouble starting the Web-based interface to the server, I realized I needed to add these packages too:

hacom:~# apt-get install libdb2
hacom:~# apt-get install libxi6

Now I was ready to try installing VMware Server again.

hacom:/usr/local/src/vmware-server-distrib# ./vmware-install.pl

Installing the content of the package.

In which directory do you want to install the binary files?
[/usr/bin]

What is the directory that contains the init directories (rc0.d/ to rc6.d/)?
[/etc]

What is the directory that contains the init scripts?
[/etc/init.d]

In which directory do you want to install the daemon files?
[/usr/sbin]

In which directory do you want to install the library files?
[/usr/lib/vmware]

The path "/usr/lib/vmware" does not exist currently. This program is going to
create it, including needed parent directories. Is this what you want? [yes]

In which directory do you want to install the manual files?
[/usr/share/man]

In which directory do you want to install the documentation files?
[/usr/share/doc/vmware]

The path "/usr/share/doc/vmware" does not exist currently. This program is going
to create it, including needed parent directories. Is this what you want?
[yes]

The installation of VMware Server e.x.p build-22088 for Linux completed
successfully. You can decide to remove this software from your system at any
time by invoking the following command: "/usr/bin/vmware-uninstall.pl".

Before running VMware Server for the first time, you need to configure it by
invoking the following command: "/usr/bin/vmware-config.pl". Do you want this
program to invoke the command for you now? [yes]

Making sure services for VMware Server are stopped.

Stopping VMware services:
   Virtual machine monitor                                             done
   Bridged networking on /dev/vmnet0                                   done
   DHCP server on /dev/vmnet1                                          done
   Host-only networking on /dev/vmnet1                                 done
   Bridged networking on /dev/vmnet2                                   done
   Bridged networking on /dev/vmnet3                                   done
   DHCP server on /dev/vmnet8                                          done
   NAT service on /dev/vmnet8                                          done
   Host-only networking on /dev/vmnet8                                 done
   Virtual ethernet                                                    done

You must read and accept the End User License Agreement to continue.
Press enter to display it.
...omitted...
Do you accept? (yes/no) yes

Thank you.

Configuring fallback GTK+ 2.4 libraries.

In which directory do you want to install the mime type icons?

Do you accept? (yes/no) yes

Thank you.

Configuring fallback GTK+ 2.4 libraries.

In which directory do you want to install the mime type icons?
[/usr/share/icons]

The path "/usr/share/icons" does not exist currently. This program is going to
create it, including needed parent directories. Is this what you want? [yes]

What directory contains your desktop menu entry files? These files have a
.desktop file extension. [/usr/share/applications]

In which directory do you want to install the application's icon?
[/usr/share/pixmaps]

Trying to find a suitable vmmon module for your running kernel.

None of the pre-built vmmon modules for VMware Server is suitable for your
running kernel.  Do you want this program to try to build the vmmon module for
your system (you need to have a C compiler installed on your system)? [yes]

Using compiler "/usr/bin/gcc". Use environment variable CC to override.

What is the location of the directory of C header files that match your running
kernel? [/lib/modules/2.4.27-2-386/build/include]

Extracting the sources of the vmmon module.

Building the vmmon module.

Using standalone build system.
make: Entering directory `/tmp/vmware-config0/vmmon-only'
make[1]: Entering directory `/tmp/vmware-config0/vmmon-only'
make[2]: Entering directory `/tmp/vmware-config0/vmmon-only/driver-2.4.27-2-386'
make[2]: Leaving directory `/tmp/vmware-config0/vmmon-only/driver-2.4.27-2-386'
make[2]: Entering directory `/tmp/vmware-config0/vmmon-only/driver-2.4.27-2-386'
make[2]: Leaving directory `/tmp/vmware-config0/vmmon-only/driver-2.4.27-2-386'
make[1]: Leaving directory `/tmp/vmware-config0/vmmon-only'
make: Leaving directory `/tmp/vmware-config0/vmmon-only'
The module loads perfectly in the running kernel.

You have already setup networking.

Would you like to skip networking setup and keep your old settings as they are?
(yes/no) [yes]

I'm cheating here because I don't have output from my first run, where I set up networking. All I originally did was set up eth0 as a bridge for vmnet0. I set up eth1 as a bridge for vmnet2, and I also bridged eth2.

Extracting the sources of the vmnet module.

Building the vmnet module.

Using standalone build system.
make: Entering directory `/tmp/vmware-config0/vmnet-only'
make: Leaving directory `/tmp/vmware-config0/vmnet-only'
The module loads perfectly in the running kernel.

/etc/init.d/httpd.vmware: line 120: status: command not found
Please specify a port for remote console connections to use [902]

Restarting internet superserver: inetd.
Configuring the VMware VmPerl Scripting API.

Building the VMware VmPerl Scripting API.

Using compiler "/usr/bin/gcc". Use environment variable CC to override.

Installing the VMware VmPerl Scripting API.

The installation of the VMware VmPerl Scripting API succeeded.

Do you want this program to set up permissions for your registered virtual
machines?  This will be done by setting new permissions on all files found in
the "/etc/vmware/vm-list" file. [no]

Generating SSL Server Certificate

In which directory do you want to keep your virtual machine files?
[/vmware]

Do you want to enter a serial number now? (yes/no/help) [no]

Starting VMware services:
   Virtual machine monitor                                             done
   Virtual ethernet                                                    done
   Bridged networking on /dev/vmnet0                                   done
   Host-only networking on /dev/vmnet1 (background)                    done
   Bridged networking on /dev/vmnet2                                   done
   Bridged networking on /dev/vmnet3                                   done
   Host-only networking on /dev/vmnet8 (background)                    done
   NAT service on /dev/vmnet8                                          done
   Starting VMware virtual machines...                                 done

The configuration of VMware Server e.x.p build-22088 for Linux for this running
kernel completed successfully.

Now I was ready to set up the VMware Management Interface.

hacom:/usr/local/src/vmware-server-distrib# cd ..
hacom:/usr/local/src# ls
VMware-mui-e.x.p-22088.tar.gz  VMware-server-e.x.p-22088.tar.gz  vmware-mui-distrib  vmware-server-distrib
hacom:/usr/local/src# cd vmware-mui-distrib/
hacom:/usr/local/src/vmware-mui-distrib# ls
bin  console-distrib  doc  etc  mui  vmware-install.pl
hacom:/usr/local/src/vmware-mui-distrib# ./vmware-install.pl
A previous installation of VMware software has been detected.

The previous installation was made by the tar installer (version 3).

Keeping the tar3 installer database format.

Uninstalling the tar installation of VMware Management Interface.

   Shutting down http.vmware:                                          done

This program previously created the directory /var/log/vmware-mui, and was about
to remove it. Since there are files in that directory that this program did not
create, it will not be removed.

The removal of VMware Management Interface e.x.p build-22088 for Linux completed
successfully. Thank you for having tried this software.

You must read and accept the End User License Agreement to continue.
Press enter to display it.
...omitted...
Do you accept? (yes/no) yes

Thank you.

Installing the content of the package.

In which directory do you want to install the binary files?
[/usr/bin]

What is the directory that contains the init directories (rc0.d/ to rc6.d/)?
[/etc]

What is the directory that contains the init scripts?
[/etc/init.d]

In which directory do you want to install the VMware Management Interface files?
[/usr/lib/vmware-mui]

The path "/usr/lib/vmware-mui" does not exist currently. This program is going
to create it, including needed parent directories. Is this what you want?
[yes]

In which directory would you like to install the documentation files?
[/usr/lib/vmware-mui/doc]

The path "/usr/lib/vmware-mui/doc" does not exist currently. This program is
going to create it, including needed parent directories. Is this what you want?
[yes]

The installation of VMware Management Interface e.x.p build-22088 for Linux
completed successfully. You can decide to remove this software from your system
at any time by invoking the following command:
"/usr/bin/vmware-uninstall-mui.pl".

Before running VMware Management Interface for the first time, you need to
configure it by invoking the following command: "/usr/bin/vmware-config-mui.pl".
Do you want this program to invoke the command for you now? [yes]

Configuring httpd.conf to run Apache as:
User: www-data and Group: nogroup

Set the number of minutes before a http session times out. (This is the length
of time before someone connecting to VMware Management Interface will be logged
out) [60]

Generating SSL Server Certificate

   Starting httpd.vmware:                                              done

Installation of VMware Management Interface was successful

The configuration of VMware Management Interface completed successfully.

Now I had the VMware components running:

hacom:~# netstat -natup
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:902             0.0.0.0:*               LISTEN     3192/inetd
tcp        0      0 0.0.0.0:8333            0.0.0.0:*               LISTEN     1528/httpd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     1443/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN     1409/exim4
tcp        0      0 0.0.0.0:8222            0.0.0.0:*               LISTEN     1528/httpd
tcp        0    300 192.168.2.18:22         192.168.2.5:1957        ESTABLISHED2580/sshd: richard

hacom:~# ps -ef | grep vm
www-data  1528     1  0 13:52 ?        00:00:02 /usr/lib/vmware-mui/apache/bin/httpd
 -DSSL -DSSL_ONLY -DGSX -d /usr/lib/vmware-mui/apache
root      3322     1  0 15:05 pts/0    00:00:00 /usr/bin/vmnet-bridge
 -d /var/run/vmnet-bridge-0.pid /dev/vmnet0 eth0
root      3330     1  0 15:05 pts/0    00:00:00 /usr/bin/vmnet-bridge
 -d /var/run/vmnet-bridge-2.pid /dev/vmnet2 eth1
root      3334     1  0 15:05 pts/0    00:00:00 /usr/bin/vmnet-bridge
 -d /var/run/vmnet-bridge-3.pid /dev/vmnet3 eth2
root      3342     1  0 15:05 ?        00:00:00 /usr/bin/vmnet-natd
 -d /var/run/vmnet-natd-8.pid -m /var/run/vmnet-natd-8.mac
 -c /etc/vmware/vmnet8/nat/nat.conf
root      3348     1  1 15:05 ?        00:00:02 /usr/sbin/vmware-serverd -s -d
root      3413     1  0 15:05 pts/0    00:00:00 /usr/bin/vmnet-netifup
 -d /var/run/vmnet-netifup-vmnet1.pid /dev/vmnet1 vmnet1
root      3421     1  0 15:05 pts/0    00:00:00 /usr/bin/vmnet-netifup
 -d /var/run/vmnet-netifup-vmnet8.pid /dev/vmnet8 vmnet8
root      3437     1  0 15:05 ?        00:00:00 /usr/bin/vmnet-dhcpd
 -cf /etc/vmware/vmnet1/dhcpd/dhcpd.conf -lf /etc/vmware/vmnet1/dhcpd/dhcpd.leases
 -pf /var/run/vmnet-dhcpd-vmnet1.pid vmnet1
root      3439     1  0 15:05 ?        00:00:00 /usr/bin/vmnet-dhcpd
 -cf /etc/vmware/vmnet8/dhcpd/dhcpd.conf -lf /etc/vmware/vmnet8/dhcpd/dhcpd.leases
 -pf /var/run/vmnet-dhcpd-vmnet8.pid vmnet8

When I tried to start a VM, however, I saw the following in /var/log/vmware/vmware-serverd.log:

Mar 21 12:14:37: app| Attempting to launch vmx : /vmware/sguil0-6-0p1_freebsd6-0_1024mb/FreeBSD.vmx
Mar 21 12:14:38: app| New connection on socket server-vmxvmdb from host
 localhost (ip address: local) , user: root
Mar 21 12:14:38: app| Connection from : /vmware/sguil0-6-0p1_freebsd6-0_1024mb/FreeBSD.vmx
Mar 21 12:14:38: app| Setting up autoDetect info.
Mar 21 12:14:38: app| VMServerdConnect: connecting to /vmware/sguil0-6-0p1_freebsd6-0_1024mb/FreeBSD.vmx
Mar 21 12:14:38: app| VMControl: Unexpected response from vmware-authd
 (Error connecting to /usr/lib/vmware/bin/vmware-vmx process.)
Mar 21 12:14:38: app| vmserverd: Could not connect to virtual machine 
 /vmware/sguil0-6-0p1_freebsd6-0_1024mb/FreeBSD.vmx:
 Unexpected response from vmware-authd:
 Error connecting to /usr/lib/vmware/bin/vmware-vmx process.
Mar 21 12:14:38: app| Failed to connect to vm: 
 /vmware/sguil0-6-0p1_freebsd6-0_1024mb/FreeBSD.vmx
Mar 21 12:14:38: app| VmsdCmd Command error: Operation failed to change
 the VM to the expected power state

Oh for Pete's sake. What could be wrong?

I looked closer at the logs and saw this:

Mar 21 12:07:45: app| HOSTINFO: Unknown CPU vendor "CentaurHauls" seen.
Mar 21 12:07:45: app| Failed to get information about CPUs.

In dmesg output I saw something similar:

/dev/vmmon[3301]: VMMON CPUID: Unrecognized CPU

This gave me enough for a better search in the VMware forums, where I found this post. Basically, VMware Server does not run on the Nehemiah CPU in the Hacom.

Here's my /proc/cpuinfo:

hacom:/var/log/vmware# cat /proc/cpuinfo
processor       : 0
vendor_id       : CentaurHauls
cpu family      : 6
model           : 9
model name      : VIA Nehemiah
stepping        : 8
cpu MHz         : 1002.300
cache size      : 64 KB
fdiv_bug        : no
hlt_bug         : no
f00f_bug        : no
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu vme de pse tsc msr sep mtrr pge cmov pat mmx fxsr sse xstore
bogomips        : 1998.84

At this point my project is stalled. I don't see a workaround. Maybe the final version will run on this box.

Read More

VMWare Likes FreeBSD 6.1-BETA2

I just installed FreeBSD 6.1-BETA2 in VMware Workstation 5.5.1 build-19175. I have not seen the same sorts of timing problems shown by FreeBSD 6.0 RELEASE inside the VMs I use and have created for the Sguil project. I did not see any obvious changes that would account for the better behavior. I hope FreeBSD 6.1 RELEASE behaves just as well.

I am not sure if I will create a Sguil VM for FreeBSD 6.1 and Sguil 0.6.1, or if I will wait for a newer version of Sguil. The latest Sguil version mostly contains client-side improvements. The next version of Sguil (release date unknown) will probably integrate the Passive Asset Detection System, so I would want to include that.

Read More

Virtualization on Low-End Hardware

I have a few really old laptops that I've rescued for use in the TaoSecurity labs. One is a Thinkpad 600e PII 366 MHz with 128 MB RAM, and the other is a Thinkpad 1400 Pentium MMX 300 MHz with 256 MB RAM. Recently I wondered if I could use them as VMware Player running on them. First I needed a supported operating system. I first tried Ubuntu, since it looked like the most recent free OS with which I was familiar. Unfortunately, Ubuntu's live CD and installation CD hung on the two laptops I tried.

I turned next to Red Hat Linux 9, intending to use the Fedora Legacy project to update the OS once installed. RH 9 and Fedora Legacy worked perfectly. I don't need to repeat what I did because the Using Fedora Legacy's yum 2.x for Red Hat Linux 9 documentation is so excellent. I checked the FAQ and used Yum to update the kernel after the userland apps were updated. Impressive all around.

Next came the moment of truth. Would VMware Player run on these old systems? The newer PII ThinkPad installed the Linux .rpm with no problems. When I ran vmware-config.pl, however, I had to let VMware compile the kernel modules it needed. It needed kernel-source-2.4.20-43.9.legacy.i386.rpm installed, and I had to point the installer to /usr/src/include/linux-2.4 instead of /usr/src/include/linux. When the process was done I was able to run VMware Player as root. Awesome.

Then I tried the older Thinkpad. After installing the .rpm, I tried running vmware-config.pl. I encountered this error:

[root@rh9tp1400 root]# vmware-config.pl 
Your processor does not support the cmov instruction. VMware Player will not run
on this system.

Your /proc/cpuinfo is:

processor       : 0
vendor_id       : GenuineIntel
cpu family      : 5
model           : 8
model name      : Mobile Pentium MMX
stepping        : 2
cpu MHz         : 299.950
fdiv_bug        : no
hlt_bug         : no
f00f_bug        : yes
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu vme de pse tsc msr mce cx8 mmx
bogomips        : 598.01

Execution aborted.

Darn. No VMware Player on the Pentium MMX 300 MHz! Well, if VMware Player wouldn't run, what about QEMU? I found a QEMU .rpm at the DAG repository. When I tried installing it, the .rpm complained it needed SDL-1.2.5-3.i386.rpm.

(Note: When I installed RH 9 on these laptops, I did a Workstation install, automatic partitioning, no firewall, and I customized the packages to remove GNOME, Graphical Internet, Office/Productivity, Sound and Video, Graphics, Games and Entertainment, X Software Development, GNOME Software Development, and Printing Support; I added System Tools and Kernel Development. Total package size: 1311 MB.)

I installed the SDL package, and sure enough QEMU ran on the P-MMX! I booted a Linux image to test it. I did not try networking. This was more proof-of-concept, since I do not have QEMU images ready for use as I do VMs.

One of the main reasons I conducted this test was to provide a baseline of hardware I could expect to use when I teach my classes. I plan to suggest a PII with 256 MB RAM running RH 9 as the absolute free-OS minimum for supporting VMware Player.

Read More