search

spender-sandbox / cuckoo-modified

Modified edition of cuckoo
395 stars 178 forks source link

Unable to connect to esx hypervisor #199

Open pkernevez opened 8 years ago

pkernevez commented 8 years ago

Hi,

The commit 275a761e6efb59aa13b0b4a49e9bb45dae93d9be created a regression on the esx connector : we are not able to connect to the esx any more. This is due to the signature of the method LibVirtMachinery._connect() that changed (now requires a parameter 'Label'), but the signature of esx child (and may be other connectors) has not changed https://github.com/spender-sandbox/cuckoo-modified/blob/master/modules/machinery/esx.py#L41

The error is produced on line 535 and 470 : https://github.com/spender-sandbox/cuckoo-modified/blob/master/lib/cuckoo/common/abstracts.py#L535 https://github.com/spender-sandbox/cuckoo-modified/blob/master/lib/cuckoo/common/abstracts.py#L470

KillerInstinct commented 8 years ago

FWIW you should really be using the vSphere machinery now instead of esx.

villain commented 8 years ago

what if you dont have a vsphere instance? just performed a git pull and also seeing this

mallorybobalice commented 8 years ago

heh. vsphere api lets one do memory dumps. esxi alone can't (well, there's no underlying libvirt support for that as far as i can tell). i'm not entirely certain why it's not possible to download a memory image taken as part of the snapshot via esxi api but i suppose not everyone needs it. I too need esxi machinery fixed/agree the commit should not have been merged in as is.

pps also vcenter is not free so standing up and maintaining a limited instance is a bit of a pain .and giving cuckoo even limited access to shared infrastructure instead of say, a virtual ESXI server is a definite no-no for some.

KillerInstinct commented 8 years ago

You don't need vCenter to use the vSphere machinery. It should work as long as you have the vSphere API license requirement (which libvirt also requires) .. only difference is you're using code that's actually supported and maintained by VMware community.

mallorybobalice commented 8 years ago

hmm, ok thank you KI. I'll give it a try tomorrow. (it looks like the configs are essentially identical except for the connection info which is very similar and will take 5 mins to change). and it helps a lot if connecting directly to the esxi host is supported instead of having to go via vcenter.
@KillerInstinct - would you mind expanding just a bit more. What specific licensing is required or enabling vsphere api on esxi (edition of ESXI or separate feature?) . that last bit sounds like it's already enabled on most instances where people are using esxi api? (or have the esxi server connected to an existing vcenter?)

in any case I'll give mine a try :) thanks again for clearing it up

KillerInstinct commented 8 years ago

libvirt and pyvmomi access ESXi/vCenter through the vSphere API which is typically not free (you can get trail license.

You can use the vSphere machinery to connect to an ESXi host or to a vCenter host. ESXi is one product of the overall VMware vSphere product line. Both vCenter and ESXi have a vSphere API if licensed. As far as I remember, the vSphere API is not free, but of course you can get trial licenses.

Reference: Licensing Access to the vSphere API is governed by the variousvSphere Editions which provides both read and write access to the API. If you are using vSphere Hypervisor (free edition of ESXi), the vSphere API will only be available as read-only.

Source: https://blogs.vmware.com/vsphere/2012/02/introduction-to-the-vsphere-api-part-1.html