search

dkindlund / honeyclient

MITRE HoneyClient Project
http://www.honeyclient.org
GNU General Public License v2.0
8 stars 4 forks source link

Master VM not acquiring IP address - after starting FW and running StartManager.pl #218

Closed dkindlund closed 14 years ago

dkindlund commented 14 years ago

I'm not sure if this issue had been addressed since I couldn't find a definitive answer to the problem I'm currently experiencing.

Before I set my master VM ethernet to host I was able to obtain an IP address (ie. 192.168.0.129). As instructed my the documentation I've changed the VM's ethernet to HOST ONLY and unregistered the VM. The 'ruby script/server -e production' and firewall VM have been started as instructed. StartManager.pl is run and creates the clone as well, but when the clone VM completes it's not acquiring an IP address. I'm getting an address like so - 169.254.90.130. Can you please assist in resolving this matter? Have I missed something in the documentation or is this an undocumented configuration fix?

Thanks

dkindlund commented 14 years ago

Author: kindlund Assuming your clone VM is properly networked to the Host-Only network (vmnet1), then it sounds like the DHCP daemon for vmnet1 running on your VMware Server isn't properly issuing DHCP leases to your clone. A simple test would be unregister and delete your clone VMs, re-register your master VM, power your master VM on (with it still on the Host-Only network0, and verify that your master VM gets a DHCP lease on the network. If that doesn't happen, then you need to verify your DHCP daemon is running; you can do something like: 'ps ax | grep vmnet1' to see what type of services are running on your Host-Only network (vmnet1).

dkindlund commented 14 years ago

Author: andrehall815@gmail.com I started the clone VM and it appears DHCP isn't starting up.

ps ax |grep vmnet1

5922 ? S 0:00 /usr/bin/vmnet-netifup -d /var/run/vmnet-netifup-vmnet1.pid /dev/vmnet1 vmnet1 6578 pts/0 R+ 0:00 grep vmnet1

I've gone back through the documentation to insure I have made the necessary changes to the file in (/etc/vmware/vmnet1/dhcpd/dhcpd.conf)

Here are the entries in my file:

allow unknown-clients; default-lease-time 1800; # 30 minutes max-lease-time 7200; # 2 hours

subnet 10.0.0.0 netmask 255.255.255.0 { range 10.0.0.128 10.0.0.253; option broadcast-address 10.0.0.255; option domain-name-servers 192.168.0.2; option domain-name "localdomain"; options routers 10.0.0.254; {

Is there anything else I need to check/do to fix this?

Thanks

dkindlund commented 14 years ago

Author: kindlund Replying to [comment:2 andrehall815@gmail.com]:

I started the clone VM and it appears DHCP isn't starting up.

ps ax |grep vmnet1

5922 ? S 0:00 /usr/bin/vmnet-netifup -d /var/run/vmnet-netifup-vmnet1.pid /dev/vmnet1 vmnet1 6578 pts/0 R+ 0:00 grep vmnet1

Actually, that output from 'ps ax' indicates that the DHCP daemon on vmnet1 is not running. To be clear: the problem you're having is with one of the VMware Server daemons -- not anything Honeyclient related.

I'd suggest you do the following:

  1. Power down or suspend all running VMs on the VMware Server
  2. Shutdown VMware Server (e.g., '/etc/init.d/vmware stop')
  3. Verify all VMware related services are stopped (e.g., 'ps ax | grep vm')
  4. Start up VMware Server (e.g., '/etc/init.d/vmware start')
  5. Verify the DHCP daemon on vmnet1 is started (e.g., 'ps ax | grep vmnet1') -- you should see an entry that has 'dhcpd' in it.
  6. Verify any of your VMs on your Host-Only network can get a DHCP lease.
dkindlund commented 14 years ago

Author: andrehall815@gmail.com VMWare Stopped:

root@bishop:~# /etc/init.d/vmware stop Stopping VMware services: Virtual machine monitor done Bridged networking on /dev/vmnet0 done DHCP server on /dev/vmnet1 done Host-only networking on /dev/vmnet1 done DHCP server on /dev/vmnet8 done NAT service on /dev/vmnet8 done Host-only networking on /dev/vmnet8 done Virtual ethernet done VMWare Started:

root@bishop:~# /etc/init.d/vmware start Starting VMware services: Virtual machine monitor done Virtual ethernet done Bridged networking on /dev/vmnet0 done Host-only networking on /dev/vmnet1 (background) done Host-only networking on /dev/vmnet8 (background) done NAT service on /dev/vmnet8 done Starting VMware virtual machines... done

VMWare Status:

root@bishop:~# /etc/init.d/vmware status Bridged networking on /dev/vmnet0 is running Host-only networking on /dev/vmnet1 is running Host-only networking on /dev/vmnet8 is running NAT networking on /dev/vmnet8 is not running Module vmmon loaded Module vmnet loaded

DHCP appear to be running on vmnet8, not vmnet1:

7141 pts/0 S 0:00 /usr/bin/vmnet-bridge -d /var/run/vmnet-bridge-0.pid /dev/vmnet0 eth0 7153 ? Ss 0:00 /usr/bin/vmnet-natd -d /var/run/vmnet-natd-8.pid -m /var/run/vmnet-natd-8.mac -c /etc/vmware/vmnet8/nat/nat.conf 7202 pts/0 S 0:00 /usr/bin/vmnet-netifup -d /var/run/vmnet-netifup-vmnet8.pid /dev/vmnet8 vmnet8 7205 pts/0 S 0:00 /usr/bin/vmnet-netifup -d /var/run/vmnet-netifup-vmnet1.pid /dev/vmnet1 vmnet1 7224 ? Ss 0:00 /usr/bin/vmnet-dhcpd -cf /etc/vmware/vmnet8/dhcpd/dhcpd.conf -lf /etc/vmware/vmnet8/dhcpd/dhcpd.leases -pf /var/run/vmnet-dhcpd-vmnet8.pid vmnet8 7276 pts/1 S+ 0:00 vi /etc/vmware/vmnet1/dhcpd/dhcpd.conf

It doesn't appear to be an issue with dhcp not running just not on vmnet1.

Do you think going back over the interface configuration is VMWare will possible fix it?

dkindlund commented 14 years ago

Author: kindlund Replying to [comment:4 andrehall815@gmail.com]:

Do you think going back over the interface configuration is VMWare will possible fix it?

Yes, re-run vmware-config.pl and verify vmnet1 is host-only networking -- that should cause the DHCP daemon to start back up for vmnet1.

dkindlund commented 14 years ago

Author: andrehall815@gmail.com It works. Rerun of the VMWare config fixed the issue. I now have dhcp running on vmnet1

Thanks for your help!!!!

dkindlund commented 14 years ago

Author: kindlund No problem.