mcts training kit 70 - 652 server virtualization phần 9 pps

498 CHAPTER 8 Securing Hosts and Virtual Machines 3. Click New User Role in the Actions pane. This launches the Create User Role Wizard. Type Library Administrators, type a short description, and select Delegated Administrator from the drop-down list under User Role Profile. Click Next. 4. Click Add, type Library, and click Check Names and then OK. Click Next. 5. On the Select Scope page, select All Libraries and click Next (see Figure 8-28). As you can see, this page lets you determine the scope of delegation. By selecting All Libraries, you grant access to Library Stores only. Click Create to generate the new role. FIGURE 8-28 Selecting the scope of delegation Your new role has been created and is now available in SCVMM. Now make sure the Library Administrators can log on to the remote server. 1. Return to Server Manager, which should be open in the Task Bar. 2. Click Server Manager (SCVMM01) to view the Server Manager Home Page. 3. Click Configure Remote Desktop and then click Select Users. 4. Click Add, type Library, click Check Names, and then click OK three times. Your computer is ready for delegation. Lesson 2: Securing the Virtual Environment CHAPTER 8 499 exerc ise 3 View the Results of a Role Delegation In this exercise you will log on as a delegated administrator and view the access this grants you. Perform this exercise on SCVMM01 and log on with the Terry Adams account. 1. Log on to SCVMM01 with the Terry Adams account. Launch the SCVMM Administrator Console. You can double-click the shortcut on the desktop or click Start, click All Programs, click Microsoft System Center, click Virtual Machine Manager 2008, and then click the Virtual Machine Manager Administrator Console shortcut. This opens the Connect To Server window. 2. Localhost:8100 is already listed and Make This Server My Default is selected. Click Connect. 3. The console opens in the Overview and is focused on the Hosts view. Note that you do not see any hosts, but you have full access to the Libraries (see Figure 8-29). FIGURE 8-29 Viewing a delegated console 4. Change to Virtual Machines view. Notice that you do not have access to this view, either. However, when you change to Library View, you’ll notice that you have full access to all Library resources. You can manage resources, deploy VMs, and perform any task that is tied to an SCVMM Library. 500 CHAPTER 8 Securing Hosts and Virtual Machines 5. Change to Administration view. Notice that you have access to some items in Administration view—even the ability to create new user roles. However, if you create a new delegated administration user role, you will find that the only thing you can delegate is Libraries (see Figure 8-30). Explore the console thoroughly to view what can be done as a Library—only administrator. FIGURE 8-30 Delegated administrators only have control over their own delegation scope. Log off when your tour is complete. Lesson 2: Securing the Virtual Environment CHAPTER 8 501 Quick Check 1. When can you use Authorization Manager (AzMan)? 2. What are the three main roles that can be defined within SCVMM? 3. What is the required infrastructure to put OVMST in place? Quick Check Answers 1. AzMan is only available on full installations of Windows Server 2008 and is launched by typing AzMan.msc at the prompt in the Start menu. 2. The three main roles in SCVMM are: n Full resource pool administrator The default administrator role in SCVMM. n Delegated administrator Supports the delegation of host groups and/or libraries. n Virtual machine user A role defined by the Self-Service Portal. 3. The requirements for the OVMST are: n The tool itself, which must be downloaded n SCVMM 2007 or 2008 n Windows Server Update Services version 3.0 or 3.0 SP1 or System Center Configuration Manager n Optionally, a dedicated servicing host 502 CHAPTER 8 Securing Hosts and Virtual Machines Case Scenario: Planning a Resource Pool Security Strategy In the following case scenarios, you will apply what you’ve learned about securing hosts and virtual machines. You can find answers to these questions in the “Answers” section on the companion CD which accompanies this book. You are the resource pool administrator for Lucerne Publishing. The Lucerne resource pool contains 12 main VMs in production running on 3 hosts. All hosts are managed with SCVMM and all hosts are running Hyper-V only. One new host has been brought in to support better levels of high availability in your machines. Lucerne also runs test and development environments on machines in other host groups. Recently, one of your IT managers assisted a presentation on virtualization. The speaker talked a lot about security and the potential threats organizations face when working with virtual machines in production. Now the manager is all fired up and wants some answers to some tough questions. He has downloaded the Hyper-V Security Guide and is asking what kind of security has been implemented in your resource pool. He insists that it is necessary to document the security practices you put in place in the resource pool. Specifically, the manager wants answers to the following questions: 1. How is the resource pool configured and which components are running in it? 2. How do the resource pool components interact with each other? 3. How are the virtual machines running on the resource pool secured? Suggested Practices To help you successfully master the exam objectives presented in this chapter, complete the following tasks. Hyper-V Security n Practice 1 Take the time to work with the various virtual network adapters available in Hyper-V. Connect different virtual machines to each adapter type in an effort to isolate their network traffic. This will be useful practice for the exam. n Practice 2 Take the time to create new folders for the storage of virtual machine files. Take a close look at the access control lists that must be enabled to support moving these storage locations from their defaults. One good way to do this is to examine the security properties of the default locations. Chapter Summary CHAPTER 8 503 Hyper-V Role Delegation n Practice 1 Play with the various roles you can generate for Hyper-V role delegation with Authorization Manager. Rely on the InitialStore.xml file to begin this practice and save your changes. Copy the updated stores to other servers to load them and then log on with different accounts to test the access you have granted. n Practice 2 Play with the various roles you can generate for SCVMM role delegation with the Administrator Console. Then log on with different accounts to test the access you have granted. Chapter Summary n Virtual environments need a different security approach. When you are running host servers and virtual machines that rely on the same operating system, you need to segregate the security context of the resource pool from the virtual environment. n It is important to maintain the integrity of the installed files, installed services, and firewall rules of the Windows Server 2008 installation when adding the Hyper-V role for the security implementation. n The Security Configuration Wizard in Windows Server 2008 generates security profiles based on the role of a server within the network and allows you to configure service configurations through predefined, role-based configurations; network security; and registry settings; as well as implement an audit policy. n Windows Vista added a new capability for the Windows operating system—being able to configure removable device controls through the use of Group Policy. This is done through the control of device installations. To increase the security context in the resource pool, this GPO should be applied on both servers and PCs so that no unauthorized user can connect a USB drive. n BitLocker Full Drive Encryption allows you to encrypt the contents of the operating system volume and is often used for mobile systems, but can be also used to protect server drives. n To be able to audit an object you need to enable the auditing policy within a Group Policy object, and you must turn on auditing for the object itself. n In a distributed management resource pool, you rely on Authorization Manager to manage Hyper-V hosts. In a centrally managed resource pool, you rely on a host server and virtual machine management tool—for example SCVMM—to assign least-privilege access rights. 504 CHAPTER 8 Securing Hosts and Virtual Machines n The Hyper-V authorization stores are made up of four components: store scope, store tasks, store roles, and assigned users or groups. AzMan can operate in Administrator mode to modify an existing policy and in Developer mode to create new policies and to modify the structure of an existing policy. n Virtual Service Offering’s scope of protection depends on the size of the organization. You should rely on the various virtual networks supported by Hyper-V to segregate traffic between virtual machines of different sensitivity. n Time synchronization in virtual machines is very important when working in Active Directory forests and domains, and is also essential if you want Kerberos authentication to work properly. n The Offline Virtual Machine Servicing Tool (OVMST) is designed to automatically update all virtual machines whether they are on or off. CHAPTER 9 505 C H A P T E R 9 Protecting Hyper-V Resource Pools D ata protection is one of the most important aspects of any resource pool because of the very nature of the pool itself: It is composed of host servers running virtual workloads. Running your production workloads in virtual machines transforms the way you work with production machines, but it also has both positive and negative impacts on your protection strategies. First of all, you need to design a protections strategy for your host servers. As you know, if a host server fails and it is not protected, all of the virtual workloads on that server will also fail. However, if you run the host server on a failover cluster, the workloads on the host server will automatically be transferred to another host. If you don’t run the host server on a failover cluster—for example, if you are running a Standard edition of Windows Server 2008 with Hyper-V or if you are running Windows Hyper-V Server—all of the workloads fail. What is worse is that you cannot transfer the virtual machines from a failed Hyper-V to another host server because even if you can access the VMs—for example, if they are stored on a shared folder running on a separate server or in a storage area network—you cannot open an existing VM within Hyper-V. Hyper-V only supports the exporting and importing of a VM, but if the host server has failed, you cannot export the VM from the original host. This means that you must have protection mechanisms for both the virtual machines you run and the hosts themselves. If for some reason you run standalone hosts, you must have a solid backup and recovery strategy for the host. More Info HYPER-V FAILOVER CLUSTERS More information on creating and deploying both single-site and multi-site Hyper-V failover clusters can be found in Chapter 3, “Completing Resource Pool Configurations.” C o n t e n t s CHAPTER 9 505 Protecting Hyper-V Resource Pools 505 Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .507 Lesson 1: Protecting Your Resource Pools . . . . . . . . . . . . . . . . . . . . . . . . . .508 Understanding Hyper-V Host Protection Strategies 508 Understanding Virtual Machine Protection Strategies 510 Working with Windows Server Backup 516 Working with System Center Data Protection Manager 529 Case Scenario: Dealing with a Host Server Failure . . . . . . . . . . . . . . . . . . .547 Suggested Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .547 Windows Server Backup 548 System Center Data Protection Manager 548 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .548 506 CHAPTER 9 Protecting Hyper-V Resource Pools These protection mechanisms range from simple backups to disks to complex systems that automatically store all information offsite. The mechanisms you choose for your environment will depend on the size of your organization, the recovery policies your organization has in place, and the complexity of your resource pool. Keep the following considerations in mind as you plan for your own recovery strategy: n If you are running standalone host servers, you must protect each and every host server through regular backups. These backups must be tested regularly to ensure that they are consistent and provide a valid restoration method. n If you are running clustered host servers, you should try to have as many redundant nodes as possible to avoid single points of failure. If VMs are hosted on a resource group that includes more than two nodes, the likelihood of having all nodes fail at once is considerably reduced and your virtual machines are well protected. They should still be backed up, however. To protect the hosts even more, you should have a means of quickly re-creating a host and introducing it into the cluster to replace failed nodes. n If you are using a single-site cluster, make sure your shared storage container is not a single point of failure. If you are using a storage area network, rely on the SAN’s own capabilities to create duplicates of the data your cluster manages—that data being, in fact, the VMs you run. n If you are running multi-site host clusters, you are already replicating the virtual machine data offsite and are protected. Once again, you still need a means to back up the virtual machines themselves as well as a simple means to introduce new hosts into the cluster if required. n If you are running a resource pool management tool such as System Center Virtual Machine Manager, you need to make sure you protect this system as well as the database it relies on. n If your resource pool is using a utility directory—as it should—you must protect the domain controllers it relies on. If they are VMs, you can use normal VM protection strategies as defined in this chapter. n If you are using Library Servers, you need to protect these systems so that they can be quickly recovered if a mishap occurs. As you can see, your protection plan must cover more than just the host servers or the virtual machines they run. It must protect the entire resource pool, it must be tested, and it must be documented so that you know what to do in the event of a disaster. More Info HYPER-V PROTECTION STRATEGIES For more information on Hyper-V protection strategies, look up “Backup and Disaster Recovery for Server Virtualization” at http://technet.microsoft.com/en-us/ magazine/2008.10.disasterr.aspx. Before You Begin CHAPTER 9 507 Specifically in terms of backup, your disaster recovery strategy must consider how you intend to protect your systems. You have three choices: n Back up entire host systems. This will back up both the host systems and the virtual machines running on them. n Back up the files that make up the virtual machines as files only. This captures a VM as it is during its operation. n Back up files and folders within each of the VMs. Each method will have an impact on your recovery operations. In addition, you are faced with a potential issue that you do not face in physical environments: Because your resource pools are clustered together and because Hyper-V supports Quick Migration, the VMs that are on one host on Monday may very well not be the same VMs that are on the same host on Tuesday. This means that VMs are moving targets. Your protection strategy must take virtual machine mobility into account. Exam objective in this chapter: n Manage snapshots and backups. Before You Begin To complete this chapter, you must have: n Experience with Windows Server 2003 and or Windows Server 2008 disaster recovery implementations. n Access to a setup as described in the Introduction. In this case, you will be using the third USB disk, which was listed as a requirement. [...]... window: Add-PSSnapin Windows.ServerBackup Get-Command -PSSnapin Windows.ServerBackup | Get-Help –Full The first cmdlet loads the Windows Server Backup PowerShell snap-in and the second cmdlet obtains help from the contents of the snap-in Table 9- 2   WSB PowerShell Cmdlets Cmdlet Description Add-WBBackupTarget Adds a backup target to the backup policy Add-WBVolume Adds a volume to the backup policy Get-WBBackupTarget... non-working server 6 Navigate to HKey_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion If a sub-key named WindowsServerBackup exists, click it If not, right-click CurrentVersion, select New, and then select Key Type WindowsServerBackup and press Enter This creates the Windows Server Backup branch 7 Create a sub-key under WindowsServerBackup called Application Support Right-click WindowsServerBackup,... Modify Type Hyper-V VSS Writer and click OK The result should be a new entry for WSB (see Figure 9- 7 ) WSB will read this key next time you perform a backup and will be able to use the Hyper-V VSS writer during the backup Figure 9- 7   Adding the Hyper-V VSS Writer value to the registry 10 Now export this value so that you can update other servers to use the Hyper-V VSS writer Right-click WindowsServerBackup... contents of the Hyper-VWriter.reg file Your server is now ready to run WSB backups Make sure you import the registry file on all other servers to enable support for the Hyper-V VSS writer As with all imported r ­ egistry ­nformation, you will get a security warning when importing the reg file Click Yes i to ­ omplete the import (see Figure 9- 9 ) c Figure 9- 9   Adding the contents of the Hyper-VWriter.reg file... policy Get-WBDisk Gets all disks Get-WBPolicy Gets current backup policy Get-WBSchedule Gets backup schedule in policy Get-WBSummary Gets backup history and summary Get-WBVolume Gets all volumes New-WBBackupTarget Creates a new backup target New-WBPolicy Creates a new empty policy Remove-WBBackupTarget Removes a backup target from the policy Remove-WBPolicy Deletes the backup policy Remove-WBVolume... begin by installing the Windows Server Backup tool Perform the installation from Server Manager Lesson 1: Protecting Your Resource Pools CHAPTER 9 5 19 1 Open Server Manager, right-click Features in the Tree pane, and then click Add Features 2 Scroll down and then expand Windows Server Backup Features Select Windows Server Backup And Command-line Tools Choose the Command-line Tools only if you intend... notepad writerslist.txt 4 Locate the GUID for the Hyper-V VSS writer in the writerslist.txt file (see Figure 9- 6 ) Select the text, right-click it, and choose Copy The copied data will be used in the next step Figure 9- 6   Locating the Hyper-V VSS writer GUID 5 20 CHAPTER 9 Protecting Hyper-V Resource Pools 5 Start the Registry Editor to add the Hyper-V writer to WSB: regedit Important Editing the Registry... Choose This Server and click Next 2 Choose the date of the backup to restore (see Figure 9- 1 4) Click Next Figure 9- 1 4  Choosing a recovery backup date 3 Choose the type of restore you need For example, to recover a VM, choose ­ pplications A and then click Next 5 26 CHAPTER 9 Protecting Hyper-V Resource Pools 4 WSB lists the available applications This is a host server, so it lists Hyper-V VSS Writer... SharePoint Services and Office SharePoint Server n Exchange Server, including servers running Standby Continuous Replication n Active Directory Domain Services Microsoft Virtual Server virtual machines Lesson 1: Protecting Your Resource Pools CHAPTER 9 5 29 n Hyper-V virtual machines n Hyper-V host servers n Virtual Server host servers In addition, SCDPM lets you provide protection for several different... VM SCDPM Additional Servers OpsMgr, Update Services, Certificate Services, NAP, VPN, and so on SCDPM Storage Pool (Pass-through disks) Segregated Virtual Network Host Servers Shared Storage Containers Figure 9- 1 8  The SCDPM resource pool architecture Requirements for SCDPM Protection SCDPM requires several components to run properly Table 9- 3 outlines these requirements Table 9- 3   Microsoft SCDPM Requirements . because Hyper-V host servers use a parent partition that runs the Windows Server 2008 operating system, you can rely on standard Windows Server recovery techniques to get a non-working host server. HYPER-V PROTECTION STRATEGIES For more information on Hyper-V protection strategies, look up “Backup and Disaster Recovery for Server Virtualization at http://technet.microsoft.com/en-us/ magazine/2008.10.disasterr.aspx with Hyper-V or if you are running Windows Hyper-V Server all of the workloads fail. What is worse is that you cannot transfer the virtual machines from a failed Hyper-V to another host server