The Linux vendor has entered into an agreement with Atsec information security to certify Red Hat Enterprise Linux 6 under Common Criteria at Evaluation Assurance Level (EAL) 4, according to a Red Hat blog post.

Common Criteria is a standard evaluation rating issued by the National Information Assurance Partnership that government customers use to evaluate the security of IT products before making purchasing decisions.

The pursuit of certification also will cover the KVM hypervisor on both Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6. A hypervisor enables an OS to run virtually without the need for a physical server, reducing the number of energy resources a data center requires.

KVM, or Kernel-based Virtual Machine (KVM), is the virtualization infrastructure for the Linux kernel. Red Hat’s virtualization leverages RHEL’s Security-Enhanced Linux feature, a joint project development by the National Security Agency and the Linux community to provide high levels of security.

SELinux in particular ensures virtual resources run in separate containers, which protects each one individually in case of intrusion. Protecting each virtualized resource individually is one guideline the National Institute of Standards and Technology recently offered as a way to address common concerns about implementing virtualization.

By including hypervisor technology in its certification, Red Hat will enable government customers to host multiple tenants on a single machine, allowing for a private cloud-computing infrastructure, according to the vendor.

The federal government increasingly is using virtualization to create more efficient and cost-effective data centers as part of an agency-wide consolidation effort.

Security often has been an area of concern for people using virtualization technology, but that perception is beginning to change as the technology becomes more sophisticated and widely used, and security issues taken into consideration by those developing hypervisors.

Red Hat already has achieved Common Criteria certification 13 different times on four different Linux platforms.

Source

PORTLAND, OR – OSCON – July 19, 2010 – Puppet Labs, the leader in data center automation, today released Puppet 2.6, a major upgrade with a focus on improvements for enterprise environments. Puppet 2.6 includes new functionality and features that make managing servers even easier. To download Puppet 2.6, visit www.puppetlabs.com/.

“The 2.6 release places an even stronger emphasis on the enterprise while also opening up new opportunities for people with varied skill sets to use Puppet,” said Luke Kanies, CEO of Puppet Labs. “Since our last release was 0.25.5, we say that it’s ‘eleventy times better.’ The changes are truly significant because Puppet is now even more capable of making traditionally painful, manual process easier for systems administrators. We’ve also dramatically improved the ability to integrate Puppet with existing systems, making it a platform for automating your infrastructure.”

New features include:

REST API, making it easier to integrate Puppet with other systems.
Preliminary Windows support for heterogeneous computing environments.
Language enhancements & an Internal DSL so administrators who know and want to use pure Ruby for infrastructure development, can easily do so.
Event model, which lays the foundation for powerful reporting and monitoring. It provides structure to data generated by the system and facilitates reporting and analysis, simplifying the identification of infrastructure problems.
Easy to deploy and maintain, Puppet simplifies many standard tasks for systems administrators, while ensuring consistent environments for application engineers. Puppet is cloud-ready, but can also be used with current infrastructure: internal or external clouds, virtual environments, or in physical infrastructure. Puppet is supported on a variety of operating systems: Red Hat, CentOS, Fedora, Debian, Ubuntu, SuSE, Solaris, HP-UX, AIX, BSD, Windows, and OS X.

Other additions with Puppet 2.6 include significant work in the core of Puppet to make it easier to work with configuration data, including enhancing how Puppet reports on what it does, adding more audit capabilities and helping export information about the infrastructure environment. The command line interface has also been completely redesigned to allow using a single executable to interact with all of Puppet’s functionality.

Today Puppet Labs also announced a $5 million Series B round of funding from Kleiner Perkins Caufield & Byers, True Ventures, Radar Partners, and Emerson St. Partners. With this new funding, Puppet Labs plans to accelerate the expansion of its engineering team.

For more information about Puppet, visit www.puppetlabs.com. For more information about the 2.6 release visit www.puppetlabs.com/2dot6.

Source

Today, we at Rackspace launched an ambitious project called OpenStack that aims to make this new world a reality.

I want to lay out the thinking that got us here and why we think this moment will change computing forever.

“The cloud” at its most fundamental level is all about a massive supply increase in computing power. The PC era was all about putting a computer on every desk. The cloud era goes a step further, putting the power of supercomputing at the literal fingertips of every individual at anytime. Whether it’s enabling a youth soccer coach to schedule practice across the online calendars of 18 families, or helping a scientist fold proteins to design new cancer drugs, or encouraging a frontline employee to instantly and cheaply test a new marketing campaign, the exponential growth in computing power and applications is changing every corner of our economy and society. And, this era is truly just beginning. We have seen only a tiny fraction of the potential gains that arise from cheap, ubiquitous computing power.

As this landscape has evolved, some have dismissed cloud computing as just a return to the mainframe era. This view is fundamentally wrong. Mainframes were available to only the smartest employees at the richest companies. The cloud is accessible to all, and usable by anyone, at low cost. Its ubiquity is the source of its power.

However, there is one area where mainframe concepts are intruding into the cloud – the vertically integrated technology stack. As hardware and software merge into services, the danger of locked down proprietary software stacks are emerging in the cloud space. The cloud world changes everything, and that is not good to many entrenched interests of the old guard. Core technologies from operating systems to hypervisors to databases are being used to tie cloud customers into an integrated view of the world.

If the web has taught us anything, it is that open systems, portability, and choice drive innovation. The open Linux system brought us a mountain of software and tools to help accomplish almost any task. And, each component, whether a database or a widget could be moved in and out freely based on the job getting done.

We at Rackspace have long talked about an “open” cloud. And as a service provider built on our Fanatical Support difference, we have never had an interest in creating technical walls around our service. But, given that no standards tools have emerged to build massively scalable clouds, we too have had to build custom software that creates some level of wall around our cloud offerings. For months we have debated how to drive greater standards and increase the velocity of cloud technologies in general. We finally converged on the obvious answer: open source our cloud technology.

Today, we announced a new open source project that includes those core technologies: OpenStack. And, we are not alone. As we looked at all the projects that already existed to drive standards we saw that other efforts were underway that complemented what we have done. We saw a ton of promise in the Nebula computing project built by NASA and are making it a core part of the project. Taking the contributions of Rackspace and NASA as a starting point, OpenStack forms a powerful foundation of technologies including, a scalable compute provisioning engine – OpenStack Compute – and a fully distributed storage engine – OpenStack Object Storage.

The community, which we plan to actively support and drive, is live today at openstack.org with code available for download.

Last week we assembled a strong group of cloud community leaders and developers to meet and review the architecture, engage on technology direction and contribute code. The effort attracted more than 100 participants from 25 companies including hosting companies, telecom providers, hardware manufacturers, cloud ecosystem companies and beyond. This enthusiasm and collaboration around OpenStack has laid the foundation for a vibrant and innovative approach to building the core software to power the future cloud world.

What do we expect OpenStack to mean for the cloud community? Some pretty major things. One, anyone will be able to run this cloud and do it anywhere. Enterprises and governments will be able to build private clouds. Service providers will have the same technology used by Rackspace and NASA to build new offers. Choice and portability are inevitable in this world. Two, the whole tech ecosystem can build around this foundation. With wide adoption, there will be a market for new services all around this core engine. From storage systems to monitoring tools to management systems, there is no end to what can be attached to the core project. Three, the cloud will advance faster than ever. Between just NASA and Rackspace, an army of developers are committed to the continued advancement of OpenStack. With our emerging supporters in the project, we expect to dramatically expand that army. Finally, a core set of standards will be freely available and totally open. New technologies can be attached. Better solutions will be driven into the product. And, the use of this powerful technology will not tie you to the use of any other technologies.

For our customers, we think there are many benefits that flow from these community gains. Not only will this help our offers develop faster and more transparently, but our customers can run private editions of our core systems in house or in our managed hosting operation.

We could not be more excited about the launch of this project and the enthusiasm around it. As a company that has invested a great deal in the development of cloud technologies, we did not take the decision to open source lightly. We think this decision will serve our interests and those of our customers. While we at Rackspace hire top developers and engineers to make sure our technology is second to none, seeking a technology advantage has never been our approach. We have our own vision about how to deploy this technology and serve customers – by giving them seamless access to scalable computing with the trusting partnership that comes through Fanatical Support. But, there will be many approaches and winning formulas. We think by welcoming those approaches and driving standards and more rapid innovation we will all win.

We hope you join us in this cause. We know there are many parties who might want to join us in the effort, please reach out to us.

We look forward to updating you as we make progress.

Source

SAP announced today that it is testing app deployments on the VCE coalition’s Vblock virtualization infrastructure. Introduced late last year, Vblock combines computing, network, storage, security, management and virtualization technologies from Cisco, EMC and VMWare. Vblock will help customers deliver shared services through private clouds, according to SAP. SAP customer Levi Strauss has tested enterprise apps running on Vblock in a lab environment, and it declared the pilot project a success.

“The results are significant and highly compelling, clearly showing how a private cloud could help us better manage our SAP landscape and contain costs,” said Levi Strauss CIO Tom Peck in a statement issued today by SAP.
SAP said Vblock will help customers cut costs by lowering hardware and software expenditures, reducing planning and design requirements through replication, and reducing risk by reusing proven deployments. It could also be used by hosting partners to improve scalability and deployment density, raising efficiency by leveraging existing hardware and software through virtualization. Cincinnati Bell is expected to announce today that it will become an SAP hosting partner, and it will use Vblock as the foundation of its virtualized delivery approach.

AP did not specify today when or how it will formally release Vblock-based virtualization options. It’s a front on which SAP is lagging behind some of its competitors. Lawson Software, for example, has recently released an array of deployment-ready private-cloud, virtualized application and Amazon EC2-based app hosting options.

On the SaaS front, SAP announced at SAPPHIRE that it will replace it’s SAP CRM On Demand offering later this year with an improved Sales On Demand application touted as offering Facebook- and Twitter-like collaboration capabilities. Incorporating elements of SAP’s recently released StreamWork SaaS application, the planned Sales On Demand app seems to answer the Chatter collaboration capabilities Salesforce.com has been broadly beta testing in anticipation of release this summer.

In his keynote on Tuesday, SAP co-CEO Jim Hagemann Snabe also announced that SAP will add to its portfolio of targeted “extension” apps delivered SaaS style but designed to be integrated with on-premise ERP deployments. SAP already offers SaaS apps for e-sourcing and travel-and-expense management. A carbon-impact app is to be added in July, and Hagemann Snabe mentioned sales force automation and talent management as other areas for extension apps.

Of course, Business By Design has been SAP’s primary SaaS offering-in-waiting for more than 18 months. Hagemann Snabe said SAP is now accepting new subscriptions for the small- and midsized-business ERP and CRM suite in anticipation of a volume-ready launch across multiple continents in late July.

Source

Virtualization offers many benefits including scalability, flexibility, rapid deployment of new servers, cost savings, as well as energy efficiency. With all these immediate benefits, it is no surprise that virtualization is quickly transforming the IT landscape. However, in the rush to capitalize on these benefits, some organizations may have overlooked the ramifications a virtualized environment has on a company’s security posture. Most of us are used to securing individual machines that we can see and feel, but a virtualized environment is hidden in layers of code. As a result, it presents the security administrator with new challenges that are not obvious at first glance.

To better illustrate this point, let’s start with a basic definition — what exactly is virtualization? Virtualization is the technology that allows the creation of virtual networking and computing resources on a single physical piece of hardware. These virtual resources all share the resources of a single physical host. This is made possible by adding an additional hypervisor (also known as a VM monitor) layer to the host server. The hypervisor allows multiple operating systems to concurrently run on the host computer.

Prior to virtualization, servers typically had 1:1 software-to-hardware mapping, meaning one operating system or application would run on one hardware server. For larger deployments, this often meant hundreds to thousands of physical servers running in a data center environment. It takes substantial hardware, energy, deployment and management costs to run such an environment. In addition to that, these servers were on average running at only five to 10 percent capacity, resulting in a huge waste of resources. With virtualization, organizations were able to run 10 or more virtual servers on a single host. What once was a 1:1 ratio now becomes 10:1 or even 20:1. It is not difficult to see the immediate and long-term benefits that virtualization brings.

This much most of us know already. The issue is that these fantastic benefits have blinded some IT departments to virtualization’s potential risks. As with any new IT infrastructure technology, virtualization does bring new threats and security concerns. In fact, in October 2007, Gartner vice president Neil MacDonald predicted that through 2009, 60 percent of production VMs will be less secure than their physical counterparts. I’d be willing to bet this prediction has very much come true. There are simply too many new avenues that creative criminals are able to exploit.

The top security threats surrounding virtualization include:

VM sprawl – VMs are so easy to create that it sometimes leads to VM sprawl. VM sprawl is the phenomenon of VMs increasing in an environment over time to the point where the infrastructure becomes less than optimal due to forgotten VMs with no real function taking away from the pool of shared resources. VMs, like traditional systems, need to be properly patched and managed. Failure to do so can lead to huge security holes within the network.One can thus appreciate how VM sprawl leads to a less secure network – most Microsoft-based operating systems are patched regularly because Microsoft typically releases patches on “Patch Tuesdays” and most laptops and desktops are used daily. However, a forgotten VM that has been left dormant for weeks, if not months, will be seriously out-of-date with respect to patches, which increases the organization’s vulnerability footprint and reduces the organization’s security preparedness.

Virtualization specific attacks – Virtualization opens up a new vector for potential attackers to exploit. There have been real world examples of compromised VMs being used to attack other VMs on the same host, or even gain access to the host machine itself through the exploitation of memory space of devices shared by both the host and guest machines. Attacks on the hypervisor itself can potentially compromise all the VMs running above it.

Traditional threats – Legacy viruses, trojans, rookits, keyloggers and other malware can all do substantial damage to a VM and its host. Additionally, an infected VM can carry out attacks against other VMs as well as other physical servers on the network.

An effective security strategy for most virtualized environments is to “double-down” on conventional security wisdom, making sure to take a layered approach to security technologies. As the conventional wisdom states, there’s no such thing as a silver bullet that will bulletproof an organization’s security posture. This is doubly true for organizations rolling out a virtualized environment. By doubling down, I mean that most organizations have to take the following steps:

Anti-virus software must be deployed on each VM and especially on the host system.

Access rights need to be clearly defined for each virtual resource.

An AV and anti-malware security solutions should be deployed at the network gateway. This is particularly imperative for VMs, which may have been the result of sprawl and not had an operating system or AV software update for weeks or months.

Network intrusion prevention systems can thwart non-malware based attacks such as SQL injections.

Anti-spam and web filtering will prevent users from being exposed to malware carried through web and email.

Virtualization has transformed the computing world. It represents the ability to rapidly deploy new servers, maximum usage of hardware resources, and have a more streamlined computing environment. As more and more businesses rush to deploy virtual machines, they must also beware of the security issues specific to virtual environments. Keep your eyes wide open — and be safe!

Source

RHEL 6.0 will also have at least one less feature as well. This will be the first version of the OS not to include the Xen hypervisor. Instead the company plans to focus its virtualization efforts around the kernel-based Virtual Machine (KVM), said Tim Burke, Red Hat vice president of platform engineering.

For RHEL 6, “Virtualization has been a key focus, as has providing infrastructure that will be part of our cloud services,” Burke said.

To help in cloud deployments, the RHEL 6 OS has the ability to dynamically allocate kernel data structures. “This will allow cloud service providers to give better service-level agreements,” Burke said. As virtual machines are loaded on to the OS, the administrator can specify how much memory, how many processing cycles and how much network bandwidth can be allotted to each machine.

Another new addition is the Completely Fair Scheduler (CFS), which “more dynamically balances the workloads among the tasks,” distributing the CPU resources more evenly across all the applications. Borrowing techniques from Red Hat’s software for running latency-intolerant services, it also does a more sophisticated job of scheduling high-priority processes over low-priority ones, Burke said.

Power savings features have been added. The timing infrastructure has been reorganized as well, and uses something called the tickless kernel enhancement. Previously, the kernel would interrupt the CPU 1,000 times per second to take a time measurement, which prevented the CPU going into power-saving sleep mode. The tickless kernel feature relies instead on hardware-based timers, allowing the CPU to go to sleep in those periods when there are no other chores to complete.

The file systems space has been revamped for larger data sets. This is the first version of RHEL to use ext4 as the default file system. (Formerly it used ext3.) RHEL can now run file systems of up to 16 terabytes. The new file system also runs file system checks much more speedily, which means faster recovery times after unclean shutdowns. For really big data sets, RHEL also includes an option to upgrade to SGI’s XFS file system, which can scale to 128 terabytes.

With Red Hat’s emphasis on supporting cloud computing, the company’s decision to drop Xen may seem surprising. But over the past few years, Red Hat has increasingly thrown its support behind KVM. In 2008, the company purchased virtualization software provider Qumranet, whose developers pioneered much of the early KVM work.

Burke said that one of the reasons Xen was dropped is that the company was duplicating a lot of effort in maintaining two hypervisors, a job that requires an increasing amount of energy. For instance, Intel added some virtualization support capabilities in its just-released Nehalem server processor, but these capabilities required some modifications in both sets of software.

Source

Red Hat has quickly crossed the first hurdle with its Kernel-based Virtual Machine hypervisor, after a previous false start in virtualization with Xen.

What’s a good form of virtualization if one day you will want to move your on-premises virtual machine into an off premises cloud? The short answer is VMware. A slightly longer answer is XenServer or Hyper-V. But KVM is emerging as a legitimate answer as well. Many clouds are being run on Red Hat Enterprise Linux and they will be able to host Red Hat KVM workloads on their virtual servers.

On March 16, IBM demonstrated the feasibility of this. It announced its Development and Test Cloud will run Red Hat’s Enterprise Virtualization. Red Hat’s virtualization product line “is an optimal hypervisor technology for the infrastructure offerings o the IBM cloud,” said IBM’s Maria Azua, VP of cloud computing enablement.

Red Hat and IBM together “aim to break down barriers to virtualization and cloud adoption by providing a stable, robust environment” for enterprise apps, said Red Hat’s Scott Crenshaw, general manager of the cloud business unit. One step in favor of cloud computing stability is avoiding the need to convert a virtual machine from the enterprise environment into something else once it’s headed for the cloud. Most Amazon EC2 customers either have to make such a conversion or skip running their application in a virtual machine on premises and make it up strictly as an Amazon Machine Image, a proprietary file format.

Amazon Web Services are finding plenty of customers willing to do that. But in the long run, technologies that show cloud awareness, ease of migration without conversion and ease of management are going to enjoy the widest adoption. It’s still early, but KVM is showing some potential.

On March 15,the Symbian Foundation announced it was building a cloud on Red Hat Enterprise Linux, since it uses the operating system for its developer site, developer.symbian.org. It wanted an open source base, including KVM, for hosting develop with Symbian as it becomes open source code.

Earlier in March, a leading Swedish Internet company, Voddler, adopted Red hat Enterprise Virtualization as its standard environment. Voddler distributes movies online, and needs to frequently reallocate resources to match demand. It has the ability to perform live migration of KVM virtual machines and execute dynamic resource scheduling through the Red Hat management layer.

Last I knew, NTT Communications was hosting storage as a beta online service in Japan last November, built upon Red Hat Enterprise Virtualization.

All of these uses indicate that KVM has gotten a foothold in some large adoptions. Open source and cloud computing go well together because, whatever the software, it needs to be replicated on short notice in the cloud environment to make the cloud elastic — expanding and contracting with demand.

Red Hat initially started down the road of supporting open source Xen as an alternative to VMware. Then open source developers cooled to the Xen project and began focusing their attention on KVM.

Xen was influenced by and served the purposes of several major vendors, including Sun Microsystems, Oracle, IBM and Citrix Systems. What was good for Citrix in the long run proved good for Microsoft. Citrix, a close Microsoft partner, acquired XenSource, with the Xen brain trust, and Microsoft and Citrix Systems both standardized their VM on Microsoft’s VHD format. Open source loyalties, shifting before the deal was announced, were accelerated afterward.

KVM or Kernel-based Virtual Machine was the brainchild of Avi Kivity at the Israeli startup, Qumranet. The key maintainers of the Linux kernel development process took a quick liking to KVM and included it in the 2.6.20 kernel in February 2007. It became part of Red Hat Enterprise Linux 5.4 in September 2009.

Being the open source favorite may bring you fame but does it mean KVM will it have an impact on the commercial market? How much of an impact on cloud computing? Will the Avi Kivity team now at Red Hat spur ongoing development, keep KVM in close synchronization with the Linux kernel (it uses the kernel’s scheduler and memory manager) and avoid conflicts? IBM, Voddler, NTT and the Symbian Foundation have placed early bets that it will. I’ll be watching to see who follows. Citrix and VMware have been leapfrogging each other in virtualization features, but virtualization is more like a marathon than a 100-yard dash. Perhaps the new kid at the back of the pack is going to be closer to front by the time we get to the finish line.

Source

Nasuni was founded last year and on Tuesday is announcing the beta version of its Nasuni Filer – a so-called “cloud storage gateway.” Target customers are mid-sized companies who are interested in cloud storage, but are concerned about exposing sensitive data or suffering from high latency.

“We connect our customers to partners, people like Iron Mountain and Amazon that provide cloud storage, and we are delivering it as a file server in your virtual environment,” says Nasuni founder and CEO Andres Rodriguez, who previously founded Archivas, an online storage management software vendor acquired by Hitachi Data Systems three years ago.

Nasuni is based in Natick, Mass., with 18 employees, and has $8 million in first-round funding from North Bridge Venture Partners and Sigma Partners. Rodriguez says Nasuni has eight customers in alpha mode and is now offering the filer in a free public beta.

Nasuni’s NAS file server runs in a VMware virtual machine and integrates with either Amazon S3 or Iron Mountain remote storage services, while providing features such as encryption, caching, deduplication, automatic provisioning, and synchronous snapshots.

Accessing cloud storage introduces latency, Rodriguez says, but Nasuni allows users to work with a local cache, speeding up access to data.

“It’s quite clever,” says IDC analyst Laura DuBois. “It does address security concerns in the form of encryption of data in flight and at rest, and it also certainly addresses the concerns around availability.”

Nasuni is one of many startups building software and services that add capability to cloud platforms such as Amazon. For example, the company RightScale was founded to help customers build and clone virtual servers and manage storage in the cloud, and Symantec offers storage management for Amazon customers.

Nasuni will make its product generally available in the spring, and add more partners before doing so, according to Rodriguez. Nasuni will start charging customers after the beta trial, with fees starting around $250 a month. Although two vendors will be involved in each sale, customers would receive just one bill, which could come either from Nasuni or a partner depending on the billing model, he says.

Source

The extent of the impact of the DDoS assault could not be immediately determined. However, Allen Goldberg, spokesman for UltraDNS, said the attack started about 4:45 p.m. Pacific time Wednesday, causing some delays to customers. UltraDNS had its systems running normally within an hour, and the attack only affected Northern California Internet users, Goldberg said.

“No one was ever out. There was no downtime,” Goldberg told InformationWeek Thursday. “Queries may have taken some time to resolve and some may not have been completed, but there was never an outage.”

Details of the attack were not available, and Goldberg declined to discuss specific customers. However, postings on the Twitter thread of Jeff Barr, a strategist for Amazon Web Services, indicated that AWS and Amazon were affected. Amazon could not be reached for comment in time for this writing.

The AWS Service Health Dashboard indicated that AWS’ storage and computing cloud services, S3 and EC2, respectively, were affected. At 5:44 p.m. Pacific AWS was investigating reports of “DNS resolution errors,” and by 6:02 p.m. confirmed that “some customers in the West Coast are experiencing issues with resolving DNS.” By 6:39 p.m., the system had fully recovered.

DDoS attacks occur regularly on the Web and are usually brought under control by service providers before the assaults cause serious damage. AWS has been a target of DDoS attacks before. A suspected denial-of-service attack on AWS shut down a code hosting service for nearly 24 hours in early October.

In October, an assault aimed at AWS shut down Bitbucket, a code hosting service, for nearly 24 hours. The company detailed its ordeal in its blog. Facebook and Twitter have also been targeted.

Source

But it also posed a potential threat. EC2 brought to the masses something once confined mainly to corporate IT systems: engineering in which Oz-like programs called hypervisors create and control virtual processors, networks, and disk drives, many of which may operate on the same physical servers. Computer security researchers had previously shown that when two programs are running simultaneously on the same operating system, an attacker can steal data by using an eavesdropping program to analyze the way those programs share memory space. They posited that the same kinds of attacks might also work in clouds when different virtual machines run on the same server.

Source