. _xenserver:
XenServer (XCP-NG)
XenServer Setup & Lockdown (XCP-NG, Citrix XenServer).
Securing Xenserver
Basic steps to harden an out of box installation of xenserver. Required.
Console non-root User Setup
Create a non-root user account with sudo access.
useradd {USER}
passwd {USER}
visudo
visudo{USER} ALL=(ALL) ALL
sudo su -
SSHD Linux Setup to setup sercure SSH cert-only logins.
Explicitly enable access only for users, not ssh group.
/etc/ssh/sshd_configallowusers {USER}
service sshd restart
Disable Utils Webpage
cp /opt/xensource/www/XCP-ng-index.html /home/{USER}/original-index.html
echo '' > /opt/xensource/www/XCP-ng-index.html
Note
Citrix-index.html is used for XenServer.
Restrict XAPI to Pre-defined Hosts
Only allow explicit hosts access to the API.
/etc/hosts.denyxapi:ALL
/etc/hosts.allowxapi:{IP} {IP}
Disable TLS < 1.2 for SSL Connections
xe pool-disable-ssl-legacy
Note
This can be done in the GUI via XenPool › Properties › Security › TLS 1.2 only.
Only Keep 2 Days of Logs
Keep 2 days of log rotations, instead of 31 by default.
/etc/logrotate.confrotate 2
Creating A Local ISO Repository
This will allow the use of ISO’s on dom0 to be used during VM creation. From
an SSH session, create a directory and create a Storage Repository on top of it.
mkdir -p /var/opt/xen/iso_import
xe sr-create name-label=LocalISO type=iso device-config:location=/var/opt/xen/isos device-config:legacy_mode=true content-type=iso
xe sr-list
xe sr-scan uuid={UUID OF ISO REPOSITORY}
Convert VM to a Template
Clear command history from root/user.
shutdown cleanly.
VM: set vCPU priority to lowest (if reasonable).
VM: set Memory to dynamic, 512-1024MB (if reasonable).
VM: {RMB} › Convert to Template.
Template: Custom Fields: add custom fields as needed.
Modifying a VM Template
Copy the UUID from the template image General › Properties › UUID
SSH to the XenServer, change to root.
Convert template to VM and start it.
Start a Template VM.xe vm-param-set uuid={UUID} is-a-template=false xe vm-start uuid={UUID}
After changes, convert back to a template in the GUI.
Manually Creating New VM from Template
Determine the template name, and create a new VM from that template, start it.
xe template-list
xe vm-install template="{TEMPLATE NAME}" new-name-label="{NEW VM}"
xe vm-start uuid={NEW VM}
Copy VM to New Storage Repository
Copy VM
VM › 🖱 › Copy VM
Full copy
{NEW SR}
Updated: None
Warning
MAC addresses are not copied; update VM with existing MAC address if needed.
Warning
Snapshots must be individually copied or exported to a template on the new repository.
PCI Passthrough for Direct Hardware Access
Used for direct hardware access needs, like disks for ZFS and GPU’s for plex.
Find Device IDs
On XenServer as root, list PCI devices and determine the device ID’s that
you want. They are in the format B:D.f (beginning of line). You can see
current drives attached to these PCI devices by listing system block devices.
lspci
ls -a /sys/block
Prevent dom0 Driver Binding
This prevents dom0 from binding to hardware and presenting via a meta-layer.
/opt/xensource/libexec/xen-cmdline --set-dom0 "xen-pciback.hide=(04:00.0)"
Note
/opt/xensource/libexec/xen-cmdline --set-dom0 "xen-pciback.hide=(04:00.0)(00:02.0)"
Reboot XenServer.
Add PCI Device Passthrough
With target VM off, determine UUID of vm with xe vm-list, then passthrough
PCI devices. You only have to do this once.
xe vm-param-set other-config:pci=0/0000:{B:D.f} uuid={VM UUID}
Note
xe vm-param-set other-config:pci=0/0000:{B:D.f},0/0000:{B:D.f} uuid={VM UUID}
Fix / Upgrade Missing OS Templates
If there are missing OS templates when creating a VM, it generally means that
the create-guest-templates script hasn’t been run. Running it manually as
root on the server will add/update all OS templates and populate the dropdown.
/usr/bin/create-guest-templates
yum update guest-templates* --enablerepo=xcp-ng-testing
Auto Start VM on Boot
Start VM when Hypervisor is booted.
xe pool-list
xe vm-param-set uuid={POOL} other-config:auto_poweron=true
xe vm-list
xe vm-param-set uuid={VM} other-config:auto_poweron=true
USB Local Storage
Useful for migrations and where the local storage repository needed to be fully rebuilt.
fdisk -l
ls -l /dev/disk/by-id
cat /etc/xensource-inventory | grep -i installation_uuid
xe sr-create type=lvm content-type=user device-config:device=/dev/disk/by-id/{USB BY-ID} name-label='USB Storage' host-uuid={HOST UUID} shared=false
xe sr-list name-label='USB Storage'
xe pbd-list sr-uuid={UUID USB SR}
xe pbd-unplug uuid={PBD UUID}
xe sr-forget uuid={UUID USB SR}
Exporting VM Disks
Disks can be exported in standard formats for other hypervisor consumption.
xe vdi-list
xe vdi-export uuid={UUID} filename={FILE}.raw format=raw
Note
vhd can be used as well.
References