Dan Griffin's Blog

Comments on security, PKI, smart cards, cryptography, and entrepreneurship.

VMware Server 2.0 and Windows 7

October 31, 2008

I’m a big fan of using virtualization to reduce the cost of software development, primarily when it comes to the lab environment for testing. So far, VMware Server has been my favorite product for that, overall.

Thus, I was quite curious when a colleage told me this week that VMware Server 2.0 had been released. I decided to download it and give it a shot.

First reaction: the new VMware server console is web-based, which is disappointing. I tend to interact heavily with the virtualization console, modifying configurations and switching between VMs. In my experience, very few web UIs are as usable as a typical, professionally-done “thick” client UI. Without consistent window focus behavior, keyboard shortcuts, and tabbing behavior, the interaction is always slower for a power user.

As a result of the migration to the web UI, after completing a default installation on Windows Server 2003, clicking on the VMware Console shortcut now brings up the default browser, which is IE7 in my case. The console pages are served by Tomcat 6, which is installed with the virtualization services and everything else. Two more complaints: why install another web server when IIS is already present and listening - is it really that hard to support IIS too? Second, I now realize why the 2.0 download is about four times larger than the 1.x ones were - there’s a lot more bloat with the web server and everything else.

A server certificate is created during installation, presumably in order to support TLS from the VM admin client. However, the cert uses only a 1024-bit key, has no usage restrictions, and is valid for 19 years. A zero-config default is sometimes a good thing, but this gives the impression that TLS support is just a marketing checkbox and not an actual security consideration.

Also, since that self-signed cert isn’t trusted by default, the user gets a nasty warning page in IE7 each time it’s opened. It would have been better to provide stronger defaults for the cert with the option to change and/or trust it during initial setup.

One more complaint - the admin web page prompts me for my Active Directory credentials each time I bring it up, even though I’ve already used them to login to Windows. Moving the VMware site to the Local Intranet security group in IE doesn’t fix the problem, even though my “automatically provide credentials” option is enabled. Is that another drawback for not using IIS?

On the plus side, the new workflow for creating a VM is really good (aside from not being able to use a keyboard) - simple and intuitive, although it might be challenging for someone who hasn’t configured a VM before.

Fortunately, the new VM viewer client uses the same old keyboard shortcuts. So once you’re connected to the client, things are smooth again. This is an area where VMware has a definite edge over Windows Hyper-V. Since I typically access the VM host over RDP, I rely on having a different set of keyboard shortcuts for the VM host versus the remote session host. With VMware, those keys are different. With Hyper-V, they’re not.

I decided to test VMware Server 2.0 using the PDC build of Windows 7 x64, just to see if I could try to get things to break. I told VMware I was creating a Windows Server 2008 x64 VM, since that seemed to be the closest option. The really excellent news here is that there were no problems getting the product installed and logged in for the first time.

Minor complaint about the Win7 OOBE (Out of Box Experience) dialogs - the Password Hint for the first user is now required. Wasn’t it optional in Vista? Password hints should be optional; most people, myself included, are just going to type of random crap in there, and it would be better if we didn’t have to type anything.

As from that, first impressions of Win7? Seems pretty solid for a pre-release version of Windows. It looks a lot like Vista, but historically Microsoft doesn’t update the look & feel until just before RTM in order to avoid leaks.

The first notification you see after the default user auto-logon is a warning that there’s no anti-virus installed, which is probably a good reminder to have. Clicking on the warning brings up IE8, and first thing it does is ask you if you want to enable the Suggested Sites feature, which apparently tries to guess additional websites you’d be interested in based on your browser history. Not stated is the implicit question as to whether you want Microsoft to know every website you visit (assuming they don’t already).

The second thing I noticed was that the shutdown icon, visible from the Start menu, had changed to indicate that an update was available. Bringing up the Windows Update control panel, I was reminded about the out-of-band Windows Server Service patch from two weeks ago, which also applies to Windows 7. It’s pretty rough that the product had an ‘important’ security patch before it was even in people’s hands. That’s life when you’re dealing with complex software, I guess.

Anyway, those are my initial impressions of VMware Server 2.0 and Windows 7. I’ll follow-up as I discover more.

Search:

Archives

Recent Posts

• Cloud developers
• Microsoft Security Intelligence Report v8
• Windows LNK bug and SCADA vuln
• Mobile devices + Cloud
• Concurrency, Security, and Windows

RSS Feed

Blogroll

Security Focus: