search

spender-sandbox / cuckoo-modified

Modified edition of cuckoo
392 stars 178 forks source link

What is difference esx.conf and vsphere.conf #471

Open masifpak opened 6 years ago

masifpak commented 6 years ago

We have a scenario where we have deployed vcenter server to manage multiple ESX servers. To enjoy the independence of ESX server (What ever ESX server our Cuckoo and analysis machine is hosted), can we use user name and password of vcenter server for launching and stopping analysis machine.

jgajek commented 6 years ago

vSphere machinery (vsphere.conf) uses the vSphere API directly to communicate with vCenter/ESXi. ESX machinery (esx.conf) uses the libvirt abstraction layer. Use the vSphere machinery if you want to talk to vCenter.

masifpak commented 6 years ago

I did but facing some problem like could not find host system. What user privilege should be? Did you try this? Can you share the configs. I used only these parameters. host = 10.0.0.1 port = 443 user = username_goes_here pwd = password_goes_here

jgajek commented 6 years ago

What's the exact error you are getting?

masifpak commented 6 years ago

2017-07-21 14:52:20,972 [lib.cuckoo.core.scheduler] INFO: Using "vsphere" machine manager with max_analysis_count=0, max_machines_count=0, and max_vmstartup_count=10 2017-07-21 14:52:21,095 [root] CRITICAL: CuckooCriticalError: Couldn't connect to vSphere host itsec@SNGPL-MAE:/opt/cuckoo$

jgajek commented 6 years ago

If you are sure that the connectivity to the server is ok, and you have the correct username and password, then you can try to uncomment the unverified_ssl=on in vsphere.conf

Nagaev commented 6 years ago

The main difference in term of features is the possibility to use full memory dump with vsphere config, which is not the case with esx conf.

About the config file, I can confirm it works for me. You should uncomment unverified_ssl = on and check if the specified account has appropriate rights.

masifpak commented 6 years ago

Thanks Yes it is working.