Virtualization Performance with Ubuntu and VMWare or Virtualbox

I've been using Linux as my primary OS for a couple of years not.  However, as a network guy I still need a windows box around for various tasks.  Mostly because the company I work for uses GoToMeeting online data conferencing and they lack Linux support.

I've found using a Virtual install of Windows to work  best for my needs.  A couple of months ago I built a new Windows 7 virtual install but it suddenly slowed to a crawl!  When I first built the box it would boot up to the login prompt in about 30 seconds.  More recently it was was taking more like 5 minutes to boot up.  And when it was my entire host Linux box was slowed down as well.  I noticed that disk utilization was through the roof when this was happening.

Further inspection showed that the host was swapping to the disk like crazy while the VM Windows install was booting up.  The swapping combined with the disk access of the VM overloaded the physical disk system and brought everything down with it.   I've got 4 GB of ram on the system, so I should be able to run the VM with a couple of gigs so RAM and still have enough left over for the host.

The solution to the issue was to decrease the swappiness of the host system.

sudo sysctl vm.swappiness=10
The swappiness setting effects the algorithm that controls when memory is swapped to disk.  The default value on Ubuntu systems is set to 60.  I lowered it down to 10 and have seen a HUGE performance improvement when running the VM!  I've since verified that that work with VMWare or Virtualbox.

Please the SwapFAQ article for more information.

Running junipernc on 64 bit Ubuntu 11.10

So I just got a new laptop and set it up with 64 bit Ubuntu 11.10 (It has 4GB of memory).  I figured I'd just use the procedure I documented here to run the Juniper vpn client.  Unfortunately this did not work.  The gui dialog never opened and it never connected.  The junipernc script writes log files to the /tmp directory and I found the following error: \


Exception in thread "main" java.lang.UnsatisfiedLinkError: /home/ericw/.juniper_networks/jdk1.6.0_30/jre/lib/i386/xawt/libmawt.so: libXtst.so.6: wrong ELF class: ELFCLASS64
at java.lang.ClassLoader$NativeLibrary.load(Native Method)
at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1807)
at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1703)
at java.lang.Runtime.load0(Runtime.java:770)
at java.lang.System.load(System.java:1003)
at java.lang.ClassLoader$NativeLibrary.load(Native Method)
at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1807)
at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1724)
at java.lang.Runtime.loadLibrary0(Runtime.java:823)
at java.lang.System.loadLibrary(System.java:1028)
at sun.security.action.LoadLibraryAction.run(LoadLibraryAction.java:50)
at java.security.AccessController.doPrivileged(Native Method)
at sun.awt.NativeLibLoader.loadLibraries(NativeLibLoader.java:38)
at sun.awt.DebugHelper.<clinit>(DebugHelper.java:29)
at java.awt.Component.<clinit>(Component.java:566)
Could not find the main class: NC. Program will exit.

I'm no expert, but it looks like the 32bit version of Java is trying to use a 64 bit library (libXtst.so.6).  My solution at this point is to run the junipernc script with the -nojava option.  This avoids the java issue altogether, but without the gui I don't know when it's connected or not.  This is not an ideal situation, but at least I can get access to my company network.

UPDATE
In the comments quickfix recommends installing ia32-libs:
sudo apt-get install ia32-libs

How SOPA Benefits Cyber Criminals

The Online Piracy Act (SOPA), also known as H.R. 3261, is a bill working it's way though the House that promises to end piracy over the Internet.  The crux of internet piracy is offshore web sites that the government can't control.  Shutting down the web sites is almost impossible, so the bill provides a mechanism to disrupt how the sites are accessed using the Domain Naming System (DNS).

For those non technically inclined, DNS is the protocol use by web browsers to find the IP address of a web server.  It's very similar to a phone book (you remember those).  Back in the dark ages when you wanted to find how what time Bob's Auto Shop closed you pulled out the yellow pages, found the Automotive Services category and then found Bob's Auto Service.  This provided you with Bob's phone number which you then dialed into your phone to call Bob.  In the enlightened age of the Internet you go to your browser and type in www.BobsAutoService.com. Your browser then contacts the DNS server supplied by your Internet Service Provider (ISP) and asks whats the IP address for www.BobsAutoService.com.  When the browser gets the reply from the DNS server it contacts the web site using the IP address and downloads the page that you want.

One of the provisions of the SOPA bill would allow the Department of Justice or any rights holders to establish blocks on DNS requests for domains that they believe are hosting copyright infringing content.  So, when your thirteen years old daughter trys to go download the newest Justin Bieber song from SvensMusicDownloads.com the browser contacts the ISP's DNS server to get the IP address.  However, since SvesMusicDownload.com is now on a block list the ISP's DNS server simply responds that it can not find it. 

To return to our phone number analogy all this does is make the IP address unlisted in your local phone book.  All anyone needs to do is find a phone book that still has the number listed.

So, your thirteen year old daughter really want's that Justin Bieber song.  Her friend Susie's older brother gave her a tip that if she sets the computer to use 10.154.165.37 as the DNS server she can download her music.  He herd about it from his buddy Steve who has an internship with IBM, so Steve knows what he's doing on the Internet.  Plus, Susie's brother has been using this server for weeks and he can still get to Facebook AND download all the music he wants so it MUST be all right.  She makes the change and wow, she can download her music again.  All is right with the world.

Unfortunately your thirteen year old daughter, her friend Suzie's brother and even Steve the college intern did not know that the 10.154.165.37 server is actually run by a Vladimir's Cyber Crime Gang.  Vladimir setup the server to return legitimate IP addresses for every web site on the Internet.  Except for for a couple of large banks!

A couple of days later you sit down at the computer to pay your bills.  You open your web browser to www.BankOfAmerica.com and see the same login page that you always use.  However, on the back end your browser requested the IP address for www.BankOfAmerica.com form Vladimir's DNS server.  Instead of providing the real IP address for your banking site it provided the ip address for Vladimir's web server.  Your browser actually connects to Vladimir's web server but you can't tell the difference. Even the SSL security icon in the browser bar is green like it should be; the SSL security features in your browser also rely on DNS. You enter your password into the page get all those pesky bills paid and never notice anything is wrong.  Vladimir's web server was acting as a middle man between you and the bank web server.  Vladimir now has your password.  A week later you log back in and see that your savings account has 27 cents left in it.  Thirty thousand dollars has been transferred to a bank in the Caymans.

DNS is a VERY important part of the Internet.  It is at the foundation of how the Internet works.  This is just one example of how mucking with it can and will break the Internet!   Please cal your Congressmen, write your Congressmen, do what ever you need to do to get this bill stopped!

Using junipernc script under Ubuntu 11.10.

Getting the the Juniper Network connect client to work under Ubuntu can be a bit of a challenge. I learned quite a while ago that it requires the Sun / Oracle versions of Java, openJDK will not work. If you try using the openJDK Java you will quickly see the “Session Timeout” error when connecting.

With previous versions of Ubuntu I simply installed the sun jvm from the repositories and reconfigured the system to use it rather then openjdk. However, Oracle has decided to change the licencing requirements and newer versions of Java are no longer available in the repositoy. Now I could manually download and install the Oracle Java for the entire system to use, but then I’d have to manually keep it updated. I much prefer letting the package manger handle updates (so they actually get done).

My solution this problem is to setup a dedicated Oracle Java install that is only used by Network Connect. As an added benefit it uses the junipernc script, which in my opinion is much easier to use.


Here is what you need to do:

1. Download and save the junipernc script.
2. I like to put it in ~/bin. Don't forget to make it executable.
   mv ~/Downloads/junipernc ~/bin
   chmod +x ~/bin/junipernc
3. Browse to your company vpn site and log in. (no need to install the correct java first) Click “allow” any any warnings and ctrl-c when it asks for the root password. This will download the files into the ~/.juniper_networks folder.
4. Download the Oracle jdk .bin installer. Make it executable and execute to extract the files. Move the jdk directory to the .juniperNetwork
   chmod +x ~/Downloads/jdk-6u29-linux-i586.bin
   ~/Downloads/jdk-6u29-linux-i586.bin
   mv jdk1.6.0_29/ ~/.juniper_networks/
5. Temporally update the PATH and run .junipernc for the first time.
   export PATH=~/.juniper_networks/jdk1.6.0_29/bin/:$PATH
   ~/bin/junipernc
6. You should get a notice that initial setup requires administrative privileges. Enter your password several times Enter your server name, user name and realm. ( check out Issue #2 on this blog entry to determine your realm) Enter your password or securid/pin.

Why this works
In step 4 we temporally added the path to the downloaded Oracle Java install BEFORE the existing path. The junipernc script finds the Oracle Java version first and uses it (because it’s first in the path). This allows us to connect and all is good with the world. The junipernc script also writes the path to java in the ~/.vpn.default.cfg file. On subsequent execution of junipernc it uses the path in the cfg file.

Note:  None of this would be possible without the junipernc script developed by Paul D. Smith. Please check out his site (http://mad-scientist.us/juniper.html) for more information.