What hardware would I need (approx) to run ESXi server?

I am considering to purchase off-the-shelf commodity hardware in order to build server that will host virtual machines using ESXi server.

Intended purpose for this server is NOT mission critical tasks. It will have to run perhaps 20-50 Windows XP/Vista/7 virtual machines (in total, but closer to 20 figure). Each guest would have to have 1-2 GB of ram, and probably two-three times more disk space than guest OS needs with clean install and all updates applied (that would be around 6-8 GB for XP, and i believe closer to 10-15 for win7). Those guests will act as a test ground for a new product that is network management software, thus guests will idle most of their time once initially loaded, but if I give them some task to complete, they should be able to perform reasonably well.

Now, from what I have learned... CPU is usually not much of an issue (6 cores would do it), memory should not be lacking, but doesn't have to be sum of all guests, because of overcommitment... That leads me to IO, which is, as it seems, the bottleneck.

Since I have very little experience with ESXi (and ESX, too) server, I'd like to ask:

1. How much memory could I save by overcommitment, and how does it affect performance?


2. Is 6-core cpu enough to run above described system?


3. Would it be possible to run entire server off two (or even one) SSD drives (to host system virtual disks), with few additional HDDs (2-3) in RAID 0 to be used as secondary storage?


4. I read somewhere that ESXi allows having something like "master image", essentially virtual machine that is "deployed" many times, so that disk space can be saved by having only differences stored by specific guests, instead of copying around whole virtual disks. Is this true, and how can this help me?


5. Are there any other things I need to take into consideration when building this off-the-shelf solution?

I should probably mention here that I'm fully aware of issues like SPOF regarding power supply, raid 0, etc, but since it's only a testing ground and not a production system, it's not so important for me.

Thanks, B.

Answer

1. You can save a fair amount (~20-50%) but mixing between XP/Vista and W7 won't help - try to stick to one if you care about page sharing.


2. I'd go for more cores myself, certainly if it's closer to 50 than 20 - think about a dual-CPU box, either Xeon 56xx or AMD Magny-Cours.


3. DON'T try to do this with even the most enterprise-oriented SSDs, not unless you like rebuilding and restoring your systems. Bad idea, morris-dancing-bad in fact.


4. I think you mean VMWare View - it's designed specifically for what you're doing and works very well indeed - costs though.


5. Yes, either use fast centralised storage (i.e. FC or 10Gbps iSCSI) or if you want to do this with local disks then use a minimum of 4 disks in a hardware RAID 10 configuration, ideally 10krpm ones too.

Hope this helps but you probably want to get a few people's opinions too - that's the benefit of this site - varied experiences :)

How to check who is currently logged on to windows workstation from command line?

Environment is in domain, server is Windows Server 2003, workstations have Vista and XP installed.
I need the way to check remotely who is currently logged on workstation, preferably from some simple command line and without sysinternals or third party programs.

Thanks

Answer

This was the original source but that is now 404 :

They suggested using the (Windows Management Interface Command) WMIC which available on windows :

WMIC /NODE: xxx.xxx.xxx.xxx COMPUTERSYSTEM GET USERNAME 

Will return the username currently logged into xxx.xxx.xxx.xxx, or

WMIC /NODE: "workstation_name" COMPUTERSYSTEM GET USERNAME 

will return the username currently logged into "workstation_name"

UPDATE: This should working on Windows 10 too - if you are an admin on the remote machine.

linux - SSH key-based authentication best practice

One of the security processes that we are thinking of changing is the way we allow users to access our servers. We have about 20 web servers where the only access is SSH and at the moment we use password authentication. With key-base authentication being more secure I have to consider how best to manage this process.

If we have 8 remote users all using different machines how do we control the key authentication as each of these machines will need the key to the server. Is the management done at the client level or the server level? What happens when the user changes his laptop or tries to remote in from a different machine/location?

Barring this we are looking at:

Changing the SSH port We already have root disabled Looking at google-authenticator using PAM Whitelist IP's for server access? Secure SSH server for server hopping?

Anything else missed?

Answer

Each user should generate their own key pair and provide you with a copy of the public key which you will put into the appropriate AuthorizedKeysFile (normally ~/.ssh/authorized_keys) or they can put it in their own ~/.ssh/authorized_keys file.

They should be required to set a pass phrase on the private key. When they change laptop they simply take a copy of the private key with them (it's a simple text file).

If your users have a smartphone then you can add 2 step authentication (a good thing anyway) using a service like Duo (which is quite easy to install and set up) or as you not google auth.

amazon web services - Does AWS Load balancer prevent DDos effectively?

I have a small but popular local website, it is a nonprofit venture. We arrange programming contest. But randomly in some contest our servers goes down. For example in last contest, we had around 300 users and we deployed 12 C4Large grade servers (when site went down, we increased server to tackle it) but still the site was down for 2 hours (even though after 1 hour most of the contestants left seeing the site not working). All our servers are accessed through AWS Load balancer and we use SSL in the load balancer level. I think due to using load balancer, IIS can't differentiate upcoming traffic by IP so i can't apply the IIS built in dynamic IP based restriction for such attack. Is there a way to do these from AWS?

Is this an issue of DDos/Dos attack on our server? We use the same server and same code but in some contest we face this issue but in some other we do not face this issue. But I do not know how to track this to be sure whether we are under DDos or not. What can we do to protect ourselves?

Thanks

Answer

As @Tim said, AWS offers AWS Shield, so it’s advanced option provides some basic protection. They also have a basic WAF. I would suggest deploying that as a minimum - but it might not be enough, depending on site traffic and where any attacks are actually originating from.

If it’s a small enough site, that’s probably enough but I would recommend doing some research to see if your problem is failover / some other attack or a DDoS attack.

If it’s more complex, you’re going to want a WAF and DDoS protection on top of your AWS server such as Incapsula (apologies: this is a link to a product page) - this will protect against Layer 3 and Layer 7 attacks. This might not be needed on your website but it is something for your servers and for the higher level infrastructure. Most importantly, it’s not just DDoS protection (but the DDoS protection is always-on, unlike something like Cloudflare, where you have to turn it on if you get attacked) but also protection against other web threats.

I don’t want to advertise for any service, but if you’re not sure what’s causing an attack, one of the bigger benefits of a paid service is going to be the NOC so they can monitor the activity that you’re not so sure about.

.htaccess file location

I am trying to use an .htaccess file to create clan URL for my website. I want to test it on my local version of the site and the upload to the server if I succeed.

The question is, where do I have to put the .htaccess file? (I am using LAMP)

Right now my page's index.php file is in var/www/project/

Should I place the .htaccess file here, and can I have multiple .htaccess files?

If I have another project in folder var/www/project2 and want to set redirect rules for that site too, and some of the rules are different than the ones set on the first project, how can I handle that?

Answer

You can configure your rules both in .htaccess and per directory / file / alias... in the apache configuration.

If you uses .htaccess files, you can set them anywhere starting from your server root, and it will have effect on any child folder.

Thus if /var/www is your server root, then /var/www/.htaccess will be checked for both project & project2.

Conversely, /var/www/project/.htaccess will only have effect on this folder and its children, not on /var/www/project2 .

apache 2.4 - Default Virtual Host not catching the request

I have an Apache 2.4 server with two enabled virtual hosts:

/etc/apache2/sites-enabled/000-default.conf

        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

/etc/apache2/sites-enabled/my-website.conf

    ServerAdmin myself@my-website.com
    ServerName my-website.com
    Redirect permanent "/" "https://my-website.com/"




    
    ....
    

I created a domain name pointing to the same machine: my-other-website.com.

When I issue an http request (browser, curl,...) on my-other-website.com, I would expect it to serve the default virtual host. Instead, I get 301 redirected to https://my-website.com/.

How come?

Changing into didn't help.

Answer

VirtualHost marching is a bit peculiar and particular.

The “problem” is that you mix a *:80 with hostname:80 and the latter is the preferred match when a request for that ip-address & port number combination is received.

And *:80 is only the default VirtualHost for requests that don’t have the same ip-address as your my-website.com domain.

See https://httpd.apache.org/docs/2.4/vhosts/details.html#hostmatching

When the connection is first received on some address and port, the server looks for all the VirtualHost definitions that have the same IP address and port.

If there are no exact matches for the address and port, then wildcard (*) matches are considered.

If no matches are found, the request is served by the main server.

If there are VirtualHost definitions for the IP address, the next step is to decide if we have to deal with an IP-based or a name-based vhost.

domain name system - Troubleshooting AWS SES DKIM issues with CNAME records

I am using AWS Simple Email Services (SES) and am trying to configure DKIM so as to add an extra layer of security to my emails. According to SES documentation, the procedure for setting up SES + DKIM with your DNS is:

1. Generate DKIM CNAME records inside the SES UI/console


2. Edit your DNS records by adding these (3) CNAME records



3. Within 72 hours, SES will verify the DKIM records you added and begin adding DKIM-based authentication to your emails

I have followed these steps several times and each time I get failed validation errors inside SES:

However they don't give the reason for the failure/error each time this happens. I have checked and rechecked (and rechecked!) that I am adding CNAME records with the correct name + value that SES has generated for me.

I think I'm going to have to open an incident with AWS, but before I do, I'd like to see if I can use a reliable "DNS querying tool" to somehow confirm whether the CNAME records are added to my DNS configuration properly.

Does such a tool exist? If so, how could I use it to verify the CNAME records that are associated with my domain name?

---

Update:

Here is the output from my dig command:

dig ._domainkey.example.com CNAME

; <<>> DiG 9.10.3-P4-Ubuntu <<>> ._domainkey.example.com CNAME

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39150
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 8192
;; QUESTION SECTION:
;._domainkey.example.com.   IN CNAME


;; ANSWER SECTION:
._domainkey.example.com.    7200 IN CNAME .dkim.amazonses.com.

;; Query time: 132 msec
;; SERVER: 10.0.2.3#53(10.0.2.3)
;; WHEN: Fri Feb 16 20:15:39 UTC 2018
;; MSG SIZE  rcvd: 145

Answer

Your domain isn't actually using Route 53 for its authoritative DNS hosting, so records created in a Route 53 hosted zone are invisible to the Internet, as well as to other AWS services.

You need to do one of two things:

• create these records with your current DNS hosting provider, in their console, not in Route 53, or


• make a change at your domain registrar to set the authoritative nameservers to your domain to the 4 nameservers Route 53 assigned to your hosted zone, so that you're using Route 53 rather than your current DNS host.