NST and Virtual Machines

General Virtual Machine Questions

What Virtual Machines Will NST Run Under?

NST is currently known to run under:

• The VMware product line.
• VirtualBox

What are the Disadvantages of Running NST within a Virtual Machine?

• Performance will be less than running NST on bare metal.
• Wireless tools will not work as physical wireless adapters appear are typically virtualized as Ethernet NICs.

What are the Advantages of Running NST within a Virtual Machine?

• You can monitor the traffic on the machine without any cables or hardware.
• You can easily move your NST system to a different machine.

Can I Run Virtual Machines from a NST System?

Yes. If you perform a full installation of NST, you can install a virtual environment and run virtual machines within your NST system. For example, if you install VirtualBox onto your NST system, it will be possible to run things like "Windows 7" virtually within your NST system.

Both the VMware and VirtualBox environments are known to run on a NST system. Any virtual environment which runs under Fedora should work on a NST system as well.

VirtualBox Frequently Asked Questions

Why can't I monitor all traffic on the virtual network adapter?

There are two likely reasons that can trigger this issue:

1. The network adapter must be up and enabled on the host system before a virtualized NST system will be able to see any traffic on the adapter. If this is the issue, you will need to enable the network adapter on the machine which hosts the virtual NST (outside of the NST system).

2. VirtualBox allows one to specify the "virtual hardware implementation" when configuring network adapters. We have seen the case where some "virtual hardware implementations" do not properly support promiscuous mode operation within the NST environment (in particular some of the E1000 adapters).

So, if you run across this condition, we recommend that you try a different "virtual hardware implementation" (the PCnet Fast-III implementation has worked for us).

How do I install the VirtualBox Guest Additions?

• Install the following packages that are necessary to build the kernel modules:

yum install gcc kernel-devel

• From the Devices menu of VirtualBox, click on the Install Guest Additions options. If things go well, a virtual CD will appear on your GNOME desktop.

• Open a terminal window and login as root (if you aren't already logged in as root).

• Copy the contents of the CD to a temporary directory, run the installation script, and then remove the temporary directory (NOTE: While VBOX* will probably work as shown below, it is recommended to replace it with the actual directory name):

cp -rp /media/VBOX* /tmp/
cd /tmp/VBOX*
./VBoxLinuxAdditions-x86.run # NOTE: Run ./VBoxLinuxAdditions-amd64.run if 64 bit machine
cd
rm -fr /tmp/VBOX*

• Reboot the system (may not always be required - you can't do this step if running from a Live boot).

How do I update the VirtualBox Guest Additions?

Anytime you update the kernel on a NST system running under VirtualBox, you will need to rebuild the VirtualBox kernel module. This can be done using the following command:

service vboxadd setup

It's recommended to either reboot your machine or restart the VirtualBox services after rebuilding the kernel module. Here are the commands to restart the VirtualBox services:

service vboxadd restart
service vboxadd-x11 restart
service vboxadd-service restart

NOTE: You may or may not have the vboxadd-x11 service.

NOTE: Updating and restarting the services won't necessarily fix your current X session. So, if you are logged into a graphical desktop, you will need to log out and back in order to make use of the VirtualBox drivers.

How do I install VirtualBox Server onto a NST Distribution?

If you've installed the NST onto bare metal (a typical hard disk installation) and you are interested in running virtual machines within your NST system, you can easily install VirtualBox. This should work starting with NST release 2.11.0:

yum update
yum install VirtualBox-3.1

NOTE: At the time of this writing, VirtualBox has two versions available in their yum repository. The package named VirtualBox installs a 3.0 release, whereas the package named VirtualBox-3.1 installs a 3.1 release.

How do I update the VirtualBox Server Modules?

Anytime you update the kernel on a Linux based system running VirtualBox v3.1.x, you will need to tell VirtualBox to rebuild its kernel modules. This can be done using the following command:

service vboxdrv setup

NOTE: This this is different than the "VirtualBox Guest Additions" as this refers to the native OS under which the VirtualBox environment is running under.

VMware Frequently Asked Questions

Why Would I Want To Run NST Under VMware?

There are several reasons why one may want to boot the Network Security Toolkit from within a VMware virtual machine:

• You would like to have a full hard disk installation of the Network Security Toolkit, but don't want to re-partition your hard disk.
• You would simply like to try out a new Network Security Toolkit ISO distribution, but don't want to reboot your system. Using the free VMware Server or VMware Player, one can boot the Network Security Toolkit directly from the ISO file (you won't need to burn a disk).
• You'd like to monitor the network traffic to and from a particular Windows machine, and you don't have the necessary hardware to tap into what's going across the Ethernet cable. By booting the Network Security Toolkit within a virtual machine on the Windows machine, you will be able to monitor the Ethernet traffic with tools such as wireshark, snort, ntop, etc.
• You are doing development on a Windows machine and would like to use some of the features from the Network Security Toolkit without using an additional machine (the Network Security Toolkit makes it pretty easy to setup a web server or SQL database in these situations).

How Much Does It Cost?

While some of the VMware virtualization products do cost money, others like VMware Server and VMware Player do not. The choice is yours as NST should run within all of VMware's virtual environments.

What Version(s) of the NST Work Within VMware Virtualization Environments?

The 1.4.1 and later releases of the Network Security Toolkit should work very well as a guest OS within a VMware virtual environment. These newer releases of the Network Security Toolkit will include the nstvmware script and the open-vm-tools package to maximize the performance of the Network Security Toolkit when running from within a Virtual machine.

Are the VMware Tools & Modules Included?

Yes, starting with the 1.4.1 release of the Network Security Toolkit we have included the various kernel modules and utility programs necessary for optimal performance within a VMware virtual environment.

Starting with the 2.11.0 release of the NST package, these tools are found in the open-vm-tools package.

Is There a Pre-Built VMware NST Virtual Machine Available?

Yes. You should be able to find a pre-built version of the NST Virtual Machine on the project's download page. These downloads will be large ZIP files with a naming convention of: "nst-vm-VERSION.ARCH.zip" where VERSION corresponds to the NST release and ARCH corresponds to the hardware archecture. For example: nst-vm-2.13.0.i686.zip.

The 2.13.0 release of the NST was the first time that both a 32 bit (i686) and 64 bit (x86_64) pre-built NST virtual machine was made available for direct download.

How Do I Use the NST ISO in a VMware Virtual Machine?

If you've already downloaded the NST ISO image(s), you don't need to download the large pre-built NST virtual machine ZIP file(s). You can build your own NST virtual machine fairly simply using an NST ISO image.

In order to boot the Network Security Toolkit ISO image from within a VMware virtual machine, we recommend that you follow these steps:

• Install VMware Server or VMware Player onto your host system.
• Next download and unzip the "nst-vm-live-VERSION.ARCH.zip" file onto your host system. When this file is unzipped it will create a "nst-VERSION-ARCH" directory containing the necessary files to boot the Network Security Toolkit ISO image.
• Next, if necessary, download a ISO image of the Network Security Toolkit from NST project's download page. You can also download the ISO image directly from a running Network Security Toolkit system using the "Get CD/DVD/Device Image" page in the NST WUI (select System then File System Management from the main menu bar to find the link to the page).
• Copy (or move) the ISO image into the "nst-VERSION-ARCH" directory created by the extraction of the "nst-vm-live-VERSION.ARCH.zip" file.
• Start the VMware virtual environment using one of the provided .vmx files. There are many different VMware virtual environments, here are a couple of examples:
  • Under Windows: double clicking on the "nst-vm-windows-2.11.0.vmx" icon (you may not see the ".vmx" extension).
  • Linux users can start the VMware Player on the command line using the following:

[root@striker ~]# vmplayer nst-VERSION-ARCH/nst-vm-linux-VERSION.vmx &

If you intend to use the Network Security Toolkit for a extended period of time, we recommend that you use the install mode of the nstvmware script to install the distribution to a virtual hard disk. By doing a hard disk install in this manner, your changes will be kept permanently between reboots.

[root@probe ~]# nstvmware -m install -a toolkit -v

... Takes awhile and a lot of output is produced as NST
    is installed from the virtual ISO image to the virtual
    hard disk image ...

[root@probe ~]# poweroff

... System shuts down and the VMware Player terminates ...

Using the "install" function of the nstvmware script assumes that a virtual hard disk will be available as /dev/sda. The entire virtual hard disk will be initialized. Any data you may have had on the virtual disk will be lost! Do not use this command if you have any information on the virtual disk you want to keep.

This will give your toolkit permanent storage and cause it to boot up directly into a graphical desktop login. You may delete or disconnect the ISO image from the virtual machine after installing to the virtual disk. If you do not remove or disconnect the ISO image from the virtual machine, you may need to adjust the "virtual BIOS" settings. To adjust the "virtual BIOS" settings, you'll need to press the "F2" key at the appropriate time - watch the boot screen closely.

After a hard disk install, the password will be reset to the factory default value of nst2003 (for NST distributions prior to 1.4.2 the default value is nst@2003).