Managing Hyper-V
-
@Tim_G said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
So let me ask it this way... with a datacenter hosted Hyper-V cluster, and no legacy LAN security, how would you manage a Hyper-V system?
Because this is what we have and want and what works beautifully with other products.
If the hosts are running Server GUI (hopefully not), then TeamViewer. But yeah, you got me.
Okay, I think that there is going to be an answer here, we just need to dig for it. It's just a hunch, but I feel like it must be true. I totally can see MS not making this obvious or talking about it much, but not providing that functionality at all is not like them. This is a pretty huge "how do we replace what we have with Xen or KVM with Hyper-V" kind of question. Things that we easily build with other products seem to be a challenge with Hyper-V. Now 5Nine solves that in a really expensive, really crappy way with their product that really, you could solve just as easily using Hyper-V manager I think. So if you have a separate device to manage the cluster sitting local to it, and you can RDP safely into that remotely, that works. But that's a lot of infrastructure and if you don't want a SPOF, it's even more.
I know that this is a big selling point of the Scales, that you get triple redundant, or more, secure web remote management plus no open port remote assistance all automatic and out of the box and that almost no one else offers that. So I totally understand that I'm coming from a unique starting point as that is what we use today. I don't expect Hyper-V to compete with the Scale at that level, it's just not the same level of system. But I'm pretty sure it's not falling as far short of it as we are seeing. My guess is that there is a good PowerShell method to do this that just has to be figured out. Once ours is up, I'll be playing with it.
-
Maybe this is just me having too much faith in MS, but I have to say, I never do that and not have it come true. Sometimes it's just being able to overcome the doubt and believe in them and ta da, an answer gets found because they really do think these things through
There is a lot at MS I don't like, but they tend to be pretty good at this kind of stuff. -
@scottalanmiller said in Managing Hyper-V:
@Tim_G said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
So let me ask it this way... with a datacenter hosted Hyper-V cluster, and no legacy LAN security, how would you manage a Hyper-V system?
Because this is what we have and want and what works beautifully with other products.
If the hosts are running Server GUI (hopefully not), then TeamViewer. But yeah, you got me.
Okay, I think that there is going to be an answer here, we just need to dig for it. It's just a hunch, but I feel like it must be true. I totally can see MS not making this obvious or talking about it much, but not providing that functionality at all is not like them. This is a pretty huge "how do we replace what we have with Xen or KVM with Hyper-V" kind of question. Things that we easily build with other products seem to be a challenge with Hyper-V. Now 5Nine solves that in a really expensive, really crappy way with their product that really, you could solve just as easily using Hyper-V manager I think. So if you have a separate device to manage the cluster sitting local to it, and you can RDP safely into that remotely, that works. But that's a lot of infrastructure and if you don't want a SPOF, it's even more.
I know that this is a big selling point of the Scales, that you get triple redundant, or more, secure web remote management plus no open port remote assistance all automatic and out of the box and that almost no one else offers that. So I totally understand that I'm coming from a unique starting point as that is what we use today. I don't expect Hyper-V to compete with the Scale at that level, it's just not the same level of system. But I'm pretty sure it's not falling as far short of it as we are seeing. My guess is that there is a good PowerShell method to do this that just has to be figured out. Once ours is up, I'll be playing with it.
I've not come across a need to do it in that way. But I agree there's got to be a way.
What about via IPv6? Just a shot from the hip.
Or, what about SolarWinds? I haven't looked at that part of it.
-
@Tim_G said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@Tim_G said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
So let me ask it this way... with a datacenter hosted Hyper-V cluster, and no legacy LAN security, how would you manage a Hyper-V system?
Because this is what we have and want and what works beautifully with other products.
If the hosts are running Server GUI (hopefully not), then TeamViewer. But yeah, you got me.
Okay, I think that there is going to be an answer here, we just need to dig for it. It's just a hunch, but I feel like it must be true. I totally can see MS not making this obvious or talking about it much, but not providing that functionality at all is not like them. This is a pretty huge "how do we replace what we have with Xen or KVM with Hyper-V" kind of question. Things that we easily build with other products seem to be a challenge with Hyper-V. Now 5Nine solves that in a really expensive, really crappy way with their product that really, you could solve just as easily using Hyper-V manager I think. So if you have a separate device to manage the cluster sitting local to it, and you can RDP safely into that remotely, that works. But that's a lot of infrastructure and if you don't want a SPOF, it's even more.
I know that this is a big selling point of the Scales, that you get triple redundant, or more, secure web remote management plus no open port remote assistance all automatic and out of the box and that almost no one else offers that. So I totally understand that I'm coming from a unique starting point as that is what we use today. I don't expect Hyper-V to compete with the Scale at that level, it's just not the same level of system. But I'm pretty sure it's not falling as far short of it as we are seeing. My guess is that there is a good PowerShell method to do this that just has to be figured out. Once ours is up, I'll be playing with it.
I've not come across a need to do it in that way. But I agree there's got to be a way.
What about via IPv6? Just a shot from the hip.
Or, what about SolarWinds? I haven't looked at that part of it.
I'm sure someone makes a third party tool to do this. I'm really hopeful that there is a native one. I'm 100% cool with CLI only management, but that doesn't work for the VM install step, though. Not that I know of, anyway.
-
@scottalanmiller you already posted along to this answer.l back in the beginning of the thread.
At lileast that is how that link read to me.
-
@scottalanmiller said in Managing Hyper-V:
https://powertoe.wordpress.com/2012/03/13/powerbits-8-opening-a-hyper-v-console-from-powershell/
This power shell while remotely connected with ScreenConnect or native RDP.
-
@JaredBusch said in Managing Hyper-V:
@scottalanmiller you already posted along to this answer.l back in the beginning of the thread.
At lileast that is how that link read to me.
That's my hope, I need to try it out. Fingers crossed.
-
@JaredBusch said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
https://powertoe.wordpress.com/2012/03/13/powerbits-8-opening-a-hyper-v-console-from-powershell/
This power shell while remotely connected with ScreenConnect or native RDP.
-
-
@dbeato said in Managing Hyper-V:
@scottalanmiller How about SVCMM?
https://technet.microsoft.com/en-us/library/gg610646(v=sc.12).aspx
https://technet.microsoft.com/en-us/library/jj863389(v=ws.11).aspxRight, for the big money, that's there. That I knew. And you could argue that Scale isn't cheap like Hyper-V, which is free, so it's a valid point.
-
This shows some promise.
https://cloudbase.it/using-freerdp-to-connect-to-the-hyper-v-console/
-
@scottalanmiller This is almost like doing RDP to it. FreeRDP is like Rdesktop at best but I guess it has Powershell so that is an upside.
-
@scottalanmiller said in Managing Hyper-V:
@brianlittlejohn said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@Tim_G said in Managing Hyper-V:
If it's off domain, you have to perform a couple quick extra steps that can be put into a script.
I've never tried to use RSAT over a WAN, seems like a bad idea
I use it over a vpn to our office in OKC... it works a little slow, but it works.
VPN is just another term for the LAN, just a slow portion of it. That's still LAN security as a model, which we don't do here.
So how do you do it with SCALE? You leave the web interface public facing?
-
@dbeato said in Managing Hyper-V:
@scottalanmiller This is almost like doing RDP to it. FreeRDP is like Rdesktop at best but I guess it has Powershell so that is an upside.
It IS RDP to it, which is a perfect solution in my mind, if it works.
-
@stacksofplates said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@brianlittlejohn said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@Tim_G said in Managing Hyper-V:
If it's off domain, you have to perform a couple quick extra steps that can be put into a script.
I've never tried to use RSAT over a WAN, seems like a bad idea
I use it over a vpn to our office in OKC... it works a little slow, but it works.
VPN is just another term for the LAN, just a slow portion of it. That's still LAN security as a model, which we don't do here.
So how do you do it with SCALE? You leave the web interface public facing?
Yes, that's the idea. Properly secured web is the same as a VPN, but limited to a single task. So equal or more secure. Scaling, now that requires some kind of automation to handle it, but can be done.
-
@scottalanmiller said in Managing Hyper-V:
@stacksofplates said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@brianlittlejohn said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@Tim_G said in Managing Hyper-V:
If it's off domain, you have to perform a couple quick extra steps that can be put into a script.
I've never tried to use RSAT over a WAN, seems like a bad idea
I use it over a vpn to our office in OKC... it works a little slow, but it works.
VPN is just another term for the LAN, just a slow portion of it. That's still LAN security as a model, which we don't do here.
So how do you do it with SCALE? You leave the web interface public facing?
Yes, that's the idea. Properly secured web is the same as a VPN, but limited to a single task. So equal or more secure. Scaling, now that requires some kind of automation to handle it, but can be done.
True but now your only barrier is the login page. So any vulnerabilities in whatever language it's in (e.g. PHP) is the only barrier.
-
@stacksofplates said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@stacksofplates said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@brianlittlejohn said in Managing Hyper-V:
@scottalanmiller said in Managing Hyper-V:
@Tim_G said in Managing Hyper-V:
If it's off domain, you have to perform a couple quick extra steps that can be put into a script.
I've never tried to use RSAT over a WAN, seems like a bad idea
I use it over a vpn to our office in OKC... it works a little slow, but it works.
VPN is just another term for the LAN, just a slow portion of it. That's still LAN security as a model, which we don't do here.
So how do you do it with SCALE? You leave the web interface public facing?
Yes, that's the idea. Properly secured web is the same as a VPN, but limited to a single task. So equal or more secure. Scaling, now that requires some kind of automation to handle it, but can be done.
True but now your only barrier is the login page. So any vulnerabilities in whatever language it's in (e.g. PHP) is the only barrier.
That can be done at the server level, too. But not ideal. Or can be done with keys and not a login. All the same limitations as any VPN.
-
But all VPN solutions have that limitation. The difference here is that the limitation only exists for this one thing, rather than the entire network.
-
@scottalanmiller said in Managing Hyper-V:
But all VPN solutions have that limitation. The difference here is that the limitation only exists for this one thing, rather than the entire network.
My point is I don't understand why you go with salt because of the concern of security with SSH but you leave a web page open directly to the internet.
I trust SSH on a bastion host which gets daily updates and bug fixes more than I trust a web page that gets development but not daily updates.
-
@stacksofplates said in Managing Hyper-V:
My point is I don't understand why you go with salt because of the concern of security with SSH but you leave a web page open directly to the internet.
Because I can turn access on and off with Salt.
