Once the Integrity VM software is installed and running, the VM Host
is available. Enter the following command to get information about the status
of the guests:
# hpvmstatus
hpvmstatus: No guest information is available.
hpvmstatus: Unable to continue.
|
You can create guests now by using the hpvmcreate command,
as described in “Creating Guests.” First,
however, the following virtual machine tasks should be performed:
Creating virtual switches
Even though you have not created the guests, it is a good idea to create
the virtual switches associated with the virtual network devices that the
guests require. If you specify a vswitch name that you have not created with
the hpvmnet command, you receive warning messages about
the undefined vswitch name when you create the guest.
Restricting access to devices
The VM Host needs dedicated disk space for its operating system. You
can also restrict a network device for use by the VM Host only. Define restricted
devices before you create guests to make sure that guests do not require access
to a restricted device or a portion of a restricted device.
Providing selective access to
guest consoles
You can set up a group or user account for guest administrators, who
would be responsible for system administration on a specific guest. Specify
a group or a user account for guest administration when you create or modify
the guest.
The following sections describe these procedures.
Creating Virtual Switches |
 |
In order to provide network access for guests, you must create virtual
network switches (vswitches) for them. This section describes how to create
a vswitch and verify that it has started. (For information about how virtual
switches work, see “Virtual
Network Devices,” in Chapter 2.)
To create virtual switches, use the hpvmnet command.
The following is the basic format of a command that creates a virtual switch:
hpvmnet -c -S switchname -n 0 |
where:
-c indicates the creation of a vswitch.
-S switchname specifies
the name of the virtual switch.
-n 0 associates the new vswitch with the
physical network device lan0.
Table 3–3 describes some of the
functions of the hpvmnet command.
Table 3-3 Options to the hpvmnet Command
| Option | Function |
| -b | Starts a vswitch. The vswitch must be started before it can accept
network traffic. All vswitches are started automatically when Integrity VM
is started. |
| -c | Creates a new vswitch. |
| -h | Halts one or all vswitches. You are asked to confirm this action. |
| -d | Deletes a virtual switch. You are asked to confirm this action. |
| -n 0 | Associates a VM Host network device to the vswitch. To associate a
vswitch to PPA 0 (also called lan0),
enter -n PPA0. (PPA is the physical point
of attachment as displayed by the lanscan command.) You
cannot associate a vswitch with a vPPA (vlan). |
| -s | Retrieves statistics. |
| -S vswitch_name | Specifies the name of the virtual switch. The vswitch name is limited
to eight characters and must be unique on the VM Host. |
| -V | Enables verbose mode, displaying information detailed information about
one or all vswitches. |
| -v | Displays the version number of the hpvmnet command
in addition to the vswitch information. |
For a complete list of hpvmnet command options,
refer to hpvmnet(1M).
To display the existing vswitches, enter the hpvmnet with
no arguments and options.
The following command creates a virtual switch called clan1 associated
with lan1. The hpvmnet command is used to display the clan1 vswitch.
# hpvmnet -c -S clan1 -n1
# hpvmnet
Name Number State Mode PPA MAC Address IP Address
======== ====== ======= ========= ====== ============== ===============
localnet 1 Up Shared N/A N/A
lan0 2 Up Shared N/A N/A
clan1 5 Down Shared lan1
#
|
Note that localnet is automatically created for the
local network. For a guest to use the localnet device,
it must be added to the guest's configuration.
To start a vswitch, enter the hpvmnet command with
the -b option. For example, to start the vswitch named clan1,
enter the following command:
# hpvmnet -S clan1 -b
# hpvmnet -v
Name Number State Mode PPA MAC Address IP Address
======== ====== ======= ========= ====== ============== ===============
localnet 1 Up Shared N/A N/A
lan0 2 Up Shared N/A N/A
clan1 5 Up Shared lan1 0x00306e3977ab
|
Note that clan1 is associated with the network interface
with the MAC address 0x00306e3977ab.
To delete a vswitch, first stop the vswitch and then enter the hpvmnet command
with the -d option. For example:
# hpvmnet -S clan1 -d
hpvmnet: The vswitch is currently active
hpvmnet: Unable to continue
# hpvmnet -S clan1 -h
hpvmnet: Halt the vswitch 'clan0'? [n]: y
# hpvmnet -S clan1 -d
hpvmnet: Remove the vswitch 'clan0'? [n] y
# hpvmnet -v
Name Number State Mode PPA MAC Address IP Address
======== ====== ======= ========= ====== ============== ===============
localnet 1 Up Shared N/A N/A
lan0 2 Up Shared N/A N/A
|
For information about allocating vswitches to guests, refer to “Creating Guests” in
Chapter 4. For information about modifying virtual networks, refer to “Configuring Virtual Networks” in
Chapter 5.
Restricting Devices to the VM Host |
|
As stated in “Planning Your Virtual
Machines,” some devices should be restricted for use by the VM
Host. The VM Host system boot device and swap disk, as well as any logical
volumes used by the VM Host should be restricted from access by guests. Define
restricted devices before you create guests in order to prevent accidental
conflicts.
You can also restrict network devices to the VM Host. This provides
a dedicated network connection for the VM Host system.
To restrict access to storage and network devices, use the hpvmdevmgmt command.
For example, the following command restricts a logical volume:
# hpvmdevmgmt -a rdev:/dev/vg00/lvol8
You also use the hpvmdevmgmt command to display a
list of the restricted devices. For example:
# hpvmdevmgmt -l rdev
/dev/rdsk/c10t0d4:CONFIG=rdev,EXIST=YES,DEVTYPE=DISK,SHARE=NO::
6005-08b4-0001-15d0-0001-2000-003a-0000
|
To list the devices available on the VM Host system, use the ioscan command.
The hpvmdevmgmt command is also useful for defining
shared devices.
Providing Selective Access to Guest Consoles |
|
Integrity VM provides secure access to guest consoles. When you create
the guest, you can specify the group account or user account that will have
guest administration privileges. These users are allowed to log on to the
guest under their own user accounts and use the hpvmconsole command
to perform system administration tasks on the guest virtual machine.
There are two types of console users: admin and oper. Use the hpvmcreate, hpvmmodify,
and hpvmclone commands with the -g and -u options
to assign admin and oper privileges. You cannot use the su command
to change from one privilege level to another. Per-user checks are based on
real login account identifiers, not UUIDs.
Guest operators and administrators need access to the hpvmconsole command
to control the virtual machine. If you do not want the same user to have access
to the VM Host, you can restrict their use of the hpvmconsole command to guest
console access only by creating a restricted account for that purpose, as
follows:
Using the useradd command, set up an /etc/passwd entry
for each guest on the VM Host. The user name of the account must be the same
as the guest name and must have no more than eight characters. For example:
# useradd -d /var/opt/hpvm/guests/compass1 -c 'compass1 console' \
> -s /opt/hpvm/bin/hpvmconsole guest1 |
In this example, the following options are used:
-d specifies the home directory for the guest1
account.
-c specifies a comment text string that describes
the account.
-s specifies the path for the shell of the
new account.
Use the passwd command to set a password
for the account. For example:
# passwd guest1
A guest administrator can now access the compass1 virtual
console using the ssh command or telnet command
on the VM Host and logging in to the compass1 account.
The guest administrator cannot use the su command.
The following is an example session of remote access to the compass1 virtual
console on the VM Host myhost:
# telnet compass1
Trying 16.xx.yy.zz...
Connected to compass1.rose.com.
Escape character is '^]'.
HP-UX compass B.11.23 U ia64 (ta)
login: guest1
Password:
Please wait...checking for disk quotas
MP MAIN MENU
CO: Console
CM: Command Menu
CL: Console Log
SL: Show Event Logs
VM: Virtual Machine Menu
HE: Main Help Menu
X: Exit Connection
[compass] vMP> |
The virtual console interface displays raw characters for the CL and
CO command, including the guest's attempts to query the console terminal for
its type and characteristics. As a result, the terminal answers those queries,
which can cause the terminal setup communication to interfere with your console
commands. Interactive users can clear the screen. This situation can be a
problem, however, for noninteractive or scripted use of the console.
Printable version
