The error read “umount of temporary devfs failed” and would be seen at the very end of the VM building process when trying to unmount some of the temporary installation directories.

A Workaround that Works

I attempted all sorts of workarounds involving editing the unmount_dev() function in the vmbuilder source and inserting os.sync() or sleep commands to try to wait for the temporary installation’s devfs to no longer be in use before unmounting it. These did not work!

A very simple workaround that did work for me was to tell vmbuilder to remove the cron package from the list of default packages to install in the VM. This is done by simply appending the following argument at the end of the vmbuilder command line: --removepkg=cron

For example:

vmbuilder [your_hypervisor] ubuntu [your_options] --removepkg=cron

I recommend trying to run vmbuilder with the --removepkg=cron option, as in the above example, and see if that fixes the problem for you!

More Information

Command-line tools like lsof reported that culprit was the Linux Kernel itself that was still using the temporarily installation’s devfs! Removing the cron package from being installed by default (a newer thing in recent versions of Ubuntu VMs) fixed the problem, but what does a cron package inside the VM we are building have to do with vmbuilder failing? I’m not entirely sure; however, I guess that, perhaps, the cron package inside the temporary installation was holding on to some sort of lock in the temporary installation’s devfs.

My stab-in-the-dark guess as to why the Kernel would appear to be hanging on to it, according to the lsof command, is that, perhaps, this somehow involved a chroot being used for VM building. If anyone knows more information that can shed light onto this issue, please let me know!

Reference: https://bugs.launchpad.net/vmbuilder/+bug/966439

You might have seen one-time passwords in the wild if you use Gmail, Google Apps, or other Google services, where a token application running on Android or the iPhone/iPod iOS can be used as an optional second factor for authenticating users [see: Two-factor Authentication with Google Services].  You also might have seen OTPs in the corporate world if you use a security dongle to access company resources, such as the RSA SecurID, or, perhaps, you have looked into pseudo–two-factor authentication like paper password cards or live in a region where banks frequently provide OTPs on paper.  Whatever your relationship is with them, there are two one-time password, two-factor authentication PAM modules that you should know about.

One-time Passwords with PAM

Using Authenticator

Linux/Unix/PAM two-factor authentication with one-time passwords can be easily accomplished (for free) without using a Google product of any kind (see the end of this article); however, if you already use Google Authenticator for existing Gmail, Google Apps, or other Google accounts, you might find it to be helpful to simply use Google Authenticator for your PC or network authentication needs as well.

• Download the Google Authenticator PAM module
• Configure PAM to make use of the Google Authenticator module

Using Barada

If Google Authenticator does not suit your needs, Barada is an analogous solution that also offers a mobile phone token application and PAM module.

• Download the Barada PAM module
• Search the Android Market for the free Barada token application

Conclusion

I provide consulting if you need additional help setting this up, so feel free to contact me.

Also, you might want try using one-time passwords and two-factor authentication with web programming projects in PHP and other languages!

Keywords: one-time passwords, two-factor authentication, PAM, OTP, TFA, one-time passwords in Linux, two-factor authentication in Linux, one-time passwords PAM module, two-factor authentication PAM module

Unfortunately, if you use a professional web host, there is a good chance that you are stuck in a situation where you use WordPress for your blog or website but cannot use HTTPS to secure your access to your WordPress installation. This can be caused by anything, such as: HTTPS is simply not offered, HTTPS costs quite a bit extra to have enabled, your WordPress installation is in a shared hosting environment, or multiple domains you own are tied to your hosting account in a way that complicates the issuing of certificates and setup of HTTPS.

Fortunately, there is a solution (actually, one of many) for WordPress fans to improve the sending of passwords over HTTP.

Semisecure Login Reimagined is a plugin for WordPress that implements client-side (browser-side) encryption in JavaScript, complete with the use of nonces to prevent against replay attacks (note that this plugin is NOT designed to necessarily protect against session hijacking). My installation instructions are at the bottom of this post.

Plugin Details:
About link: WordPress Plugins Directory/Semisecure Login Reimagined
Requires WordPress version: 2.7 or higher
Tested with WordPress version: 2.8.6 by me
Plugin homepage link: Moggy’s Website/Semisecure Login Reimagined v3
Author homepage link: Moggy

Description of plugin from the WordPress plugin directory:

“Semisecure Login Reimagined increases the security of the login process by using a combination of public and secret-key encryption to encrypt the password on the client-side when a user logs in. JavaScript is required to enable encryption. It is most useful for situations where SSL is not available, but the administrator wishes to have some additional security measures in place without sacrificing convenience.”

Automatic installation instructions:

1. Login to your WordPress installation through the admin interface as one of your administrator-privileged users (http://your-site-url-here/wp-admin/), and be sure to do this from a trusted, non-public Internet connection, on a private network and not over a wireless connection.
2. Click on Plugins on the left navigation bar.
3. With Plugins selected, there should now be an Add New link just beneath Plugins in the left navigation bar. Click on Add New just beneath the word Plugins.
4. On the Install Plugins page under Search, be sure that Term appears in the drop-down (else click the drop-down arrow and select Term) and then enter in the search box to the right of Term “semisecure login reimagined” exactly as shown (but without the quotes). Click Search Plugins.
5. In the search results, Semisecure Login Reimagined should appear. All the way on the right-side of that result should be an Install link. Click on Install.
6. In the box that appears, click on the (red) Install Now button.
7. On the results page, click on Activate Plugin. You now have secure login wherever available, but we can do better (so keep reading the following steps).
8. Click on Plugins on the left navigation bar.
9. Under Semisecure Login Reimagined, click Settings to edit that plugin’s settings.
10. Note the Wikipedia quote stating, “RSA claims that 1024-bit keys are likely to become crackable some time between 2006 and 2010 and that 2048-bit keys are sufficient until 2030. An RSA key length of 3072 bits should be used if security is required beyond 2030.” In the Number of bits drop-down, select the number of bits you wish for the encryption to use. 1024 is the default (faster performance) but is likely to be easily-crackable by the end of 2010, 2048 is considerably /better at present, and 3072 might be even better (but will have slower performance). You should pick what you feel most comfortable with, or if you are unsure and this is for a blog that you and possibly a few others manage I would recommend picking 2048 for better security and a slight performance decrease (only during authentication).
11. Click the Generate Key button.
12. Click Misc Settings up near the top of the page.
13. Check the box next to Encrypt passwords when managing users?. Congratulations! Now not only are your initial login passwords encrypted, but also passwords entered when adding new users, changing passwords, etc.
14. (If you experience problems logging in, likely due to caching issues, set the Nonce setting to Asynch (Ajax). Otherwise, you can probably just leave this setting as-is.)
15. Click the Update Options button.

Log out, log back in, and on the login page you should see a little message stating, “Semisecure Login is enabled,” just below the Password entry box. Congratulations, your passwords are no longer being sent in plaintext!

If you like this tutorial, please share it with others, link to this post, and let me know!

There might come a time when one wants to test Xen Cloud Platform (XCP) or XenServer without needing to wipe an entire physical machine.  Fortunately (at least with XCP 1.1), XCP can easily be installed within a virtual machine!

The main caveat in doing this is that HVM guests will not be supported if the virtual machine doesn’t export the host system’s HVM support (e.g. VT), which is probably generally the case with the Kernel Virtual Machine (KVM) available and easily installable in Ubuntu, Debian, RedHat Enterprise Linux (RHEL), and CentOS.

It might be possible to install XCP in Qemu in this fashion, but the author of this HOWTO has not yet tried this.  It is probably possible to install XenServer in KVM (and might be possible to install XenServer similarly in Qemu), but the author of this HOWTO has also not tried to do this.

If you have any questions or comments, please feel free to comment here, or just contact me!

0. Before You Begin

The setup I used for testing this tutorial (YMMV):

• Hardware: Intel Core i7 680UM quad-core processor with VT enabled in BIOS, 4 GB RAM
• Operating System: Ubuntu 11.10 x86_64
• Packages: Kernel Virtual Machine (KVM), virt-manager,
• Installer Handy: Xen Cloud Platform version 1.1 (XCP 1.1)

I also ensured:

• Laptop connected to AC
• Reliable Internet connection (useful for installing guest VM later)

1. Install Necessary Packages

The packages that need to be installed in your OS of choice include:

• kvm
• virt-manager

I also recommend the packages:

• vnc-viewer or vinagre or tsclient or some other VNC client
• An ssh client

sudo apt-get install qemu-kvm libvirt-bin bridge-utils

You can then install the additional packages required for this tutorial by running the following command in your Terminal:

sudo apt-get install virt-manager vinagre

At this point, you are now ready to download the XCP installer Base ISO.

2. Download Xen Cloud Platform (XCP) Installer

After the above command finishes successfully, the next step is to download the installer Base ISO (CD image) file for XCP.  At the time of this writing, XCP 1.1 was the latest version, so that’s the version I tested (YMMV).

Click on ONE of the following links (I recommend trying top to bottom, and avoid running any that might eventually become outdated):

• XCP Download Page (to find the latest and greatest version of XCP to try)
• XCP Version 1.1 Download Page (to find the latest and greatest revision of XCP 1.1 to try)
• Download XCP 1.1 installer Base ISO (direct link to the file I used, which might become terribly outdated)

3. Install XCP in KVM

Next, you will create a virtual machine for testing XCP and install XCP inside of the test VM.

3.1. Create XCP Virtual Machine in virt-manager

In your Terminal window, run the following command:

sudo virt-manager

This will start the virt-manager tool, which I find especially useful for managing VMs in KVM.  This tool is probably available for your favorite Linux distribution too, since I think it first appeared on RedHat flavors before being ported to Ubuntu.

Next, perform the following steps:

1. In the top-left corner of the Virtualization Manager window, click the Create a new virtual machine button.
   
2. Enter a name for your new XCP test VM, choose Local install media (ISO image or CDROM), and click Forward.
   
3. Select Use ISO image and Browse to the location of the XCP installation Base ISO file you downloaded (see the above “USEFUL TIP”), then click Forward.
   
4. Choose the amount of virtual memory (RAM) and virtual CPUs to provide to the new XCP test VM, then click Forward. Note: Your guest virtual machines running beneath XCP will also occupy this same virtual memory that XCP will be using; as such, I recommend at least 1024 MB if you will testing XCP and only 1-2 lightweight Linux guest VMs, and up to as much as you feel you can afford to give to your XCP test environment.
   
5. Select Enable storage for this virtual machine and choose Create a disk image on the computer’s hard drive. Next, enter a size for the XCP test virtual machine’s virtual hard drive file, and it is recommended to select Allocate entire disk now, then click Forward. Note: This virtual hard drive file will not only contain XCP, but it will also contain the virtual hard disk files of guest virtual machines you wish to run beneath XCP; as such, make sure this is large enough for your needs (the XCP installer would not allow me to use a disk sized at 8.0 GB, and the next disk size I tried was 30.0 GB, which did work–YMMV, so try setting it to a high enough value to begin with to save yourself the hassle of starting all over again).
   
6. Choose your desired network settings, select kvm as the Virt Type, choose your desired Architecture setting, and click Finish to begin the XCP installation.  Note: kvm and x86_64 worked for me, as well as Virtual network ‘default’ NAT as settings on this screen–YMMV.
   

Complete the XCP Installation

Hopefully the XCP installation program will boot successfully in your newly created KVM test virtual machine.  If so, continue with the following steps:

1. The XCP installer should boot and, after selecting your keyboard layout, it should ask you if you wish to load a device driver or simply proceed with the installation.  Select Ok and proceed with configuring the XCP installation.
   
2. At some point early in the XCP installation process, the following warning will probably appear: Hardware virtualization assist support is not available on this system. This warning means that HVM support (e.g. Intel VT support) is not available from within your KVM test virtual machine, and is expected. If this error does appear, choose Ok and proceed with the installation, but note that you will only be able to run paravirtualized guest VMs beneath XCP (so, at the time of this writing, no Microsoft(R) Windows(R) VMs). If this error does not appear, then, somehow, you might have the ability to provide nested HVM support–I have no idea, so good luck and let me know what happens!
   
3. Choose to use the provided virtual hard disk for installation, and click Ok.
   
4. Choose to use Local media for the XCP installation source, and click Ok.
   
5. When you reach the Supplemental Packs prompt, choose No if you have no idea what this means.
   
6. Proceed with the installation. If you decide to use NTP (probably unnecessary) for automatic time setting, three servers I know of are 0.pool.ntp.org and 1.pool.ntp.org and 2.pool.ntp.org and are what I used in my configuration.
   
7. At some point, you will reach a Confirm Installation dialogue, where, if you are certain you wish to proceed, you may choose Install XCP.
   
8. If you are fortunate, you will reach an Installation Complete message.  At this point, clicking Ok should be the only thing you need to do to restart the XCP test virtual machine.
   
9. If you are even more fortunate, you will see a screen like the following, which indicates that XCP is booting inside of your KVM virtual machine!
   
10. The finish line looks like the following screen.  Congratulations!
    

License

Author: Patrick F. Wilbur
Author’s website: http://pdub.net

This HOWTO and all of its screenshot images are licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License. You may use, reproduce, and/or adapt this work, so long as the above author name and website are intact and/or referenced in all reproductions and adaptations of this work that you make.

Thank you for reading!  If you have any comments or questions, please feel free to comment, below. Otherwise, you may also contact me!

Authors: Jeanna N. Matthews, Eli M. Dow, Todd Deshane, Wenjin Hu, Jeremy Bongio, Patrick F. Wilbur, Brendan Johnson

Publisher: Prentice Hall

• Official Website: http://runningxen.com
• Amazon: Buy Now