VirtualBox

[mansin]

Hi all,

 

It's been a very long time since this was asked of us and it then it was dropped due lack of interest. It's come full circle now and they want to use Visual Studio and the only way will look at it is through a VM.

 

What I really could do with knowing is how to package (msi) a ready-to-go VM with OS (XP - to keep it light) and any other software they need. Has anyone accomplished this recently (save having to re-invent the wheel).

 

Any guidance much appreciated.

 

Thanks

Manny

[Jawloms]

I'd also be interested in this, with the ability to save their work on their own My Documents folder.

 

Stuart

[synaesthesia]

http://www.edugeek.net/forums/how-do-you-do/95325-virtualbox-image-programming-classes.html

Check and check, lots of info in that thread. Don't package the image, just throw out virtualbox to your clients and host the image on a central file server. Ours is on an SSD dangling off a NAS on USB3 and serves 60 concurrent users fine (windows 7 as the VM guest)

Virtual Studio, Python, Idle, Notepad++ etc to name a few bits on the image. Solid as a rock.

[mansin]

http://www.edugeek.net/forums/how-do-you-do/95325-virtualbox-image-programming-classes.html

Check and check, lots of info in that thread. Don't package the image, just throw out virtualbox to your clients and host the image on a central file server. Ours is on an SSD dangling off a NAS on USB3 and serves 60 concurrent users fine (windows 7 as the VM guest)

Virtual Studio, Python, Idle, Notepad++ etc to name a few bits on the image. Solid as a rock.

 

Thanks for the link. Will go through it (over 12 pages of it :-)). First hurdle, managed to extract the VirtualBox msi but it fails to install, getting msi error 1603. Anyone come across it?

 

Thanks

[jthompson]

Off the top of my head, that might be down to needing a certificate (published by Oracle) to install some drivers. We push that out in the same GPO as the MSI.

[mansin]

Off the top of my head, that might be down to needing a certificate (published by Oracle) to install some drivers. We push that out in the same GPO as the MSI.

 

Thank you jthompson. How does one get hold of this certificate?

[jthompson]

Just as you extracted the MSI, have a look for a certificate file as well. You then need to import that into a relevant GPO (to Computer > Policies > Windows Settings > Security > Public Key Policies > Trusted Publishers Certificates). Can't remember the order these things are processed in, so the computer may need more that one restart to get the MSI installed.

 

The other thread(s) will have bits about vboxmanage.exe, and using that to lock down VirtualBox for end users. We have a computer startup script that includes some fairly complicated looking vboxmanage.exe commands to lock it all down and register the VM with VirtualBox. You'll need to work through all of that to prevent users adding their own VMs (which would be bad news) or modifying the settings of an existing one.

[Arthur]

How does one get hold of this certificate?

A really quick way to get the certificate is to extract it from the EXE or MSI installers using PowerShell. e.g.

 

$Path = "[color="#FF0000"]D:\VirtualBox-5.2.6-r120293-MultiArch_amd64.msi[/color]"
$Certificate = "[color="#FF0000"]D:\VirtualBox.cer[/color]"
[system.IO.File]::WriteAllBytes($Certificate, (Get-AuthenticodeSignature $Path).SignerCertificate.Export([system.Security.Cryptography.X509Certificates.X509ContentType]::Cert))

 

Just change the paths in red.

[mansin]

A really quick way to get the certificate is to extract it from the EXE or MSI installers using PowerShell. e.g.

 

$Path = "[color="#FF0000"]D:\VirtualBox-5.2.6-r120293-MultiArch_amd64.msi[/color]"
$Certificate = "[color="#FF0000"]D:\VirtualBox.cer[/color]"
[system.IO.File]::WriteAllBytes($Certificate, (Get-AuthenticodeSignature $Path).SignerCertificate.Export([system.Security.Cryptography.X509Certificates.X509ContentType]::Cert))

 

Just change the paths in red.

 

Thank you very much for that Arthur. Got the install sorted. Now need to work out the locking down of settings.

[mansin]

I am still going through the original thread but wanted to know a could of things without having to go through all the pages.

 

1) Which Hard disk file type to use (VDI, VHD, VMDK), that will be flexible to future tinkering (additions -subtractions)?

 

2) Once created the VM with all the applications, do you have to create multiple copies of this VM (image) or can simply deploy the single VM to all the computers in the suite?

 

3) Then comes the locking down of settings/using VBoxSDL to keep things to minimum. How best to do this?

 

Thanks for all the assistance so far.

Manny

[jthompson]

I am still going through the original thread but wanted to know a could of things without having to go through all the pages.

 

1) Which Hard disk file type to use (VDI, VHD, VMDK), that will be flexible to future tinkering (additions -subtractions)?

 

2) Once created the VM with all the applications, do you have to create multiple copies of this VM (image) or can simply deploy the single VM to all the computers in the suite?

 

3) Then comes the locking down of settings/using VBoxSDL to keep things to minimum. How best to do this?

 

Thanks for all the assistance so far.

Manny

 

1. VDI is the default for VirtualBox, so we've used that.
   
2. You can do either, I believe. We've decided to place a copy onto each machine, as the files can be quite large to work with over the network. It makes for more work when deploying or updating it, however.
   
3. We use vboxmanage.exe commands in a logon script. This includes denying access to the main management GUI, so we also have to provide users with a ready-made shortcut in their Start menu for launching the VM. I can share the commands we use with you over DM if you like, to give you more of a starting point.
   
4. 
   

[mansin]

So, finally have Windows 7 and applications installed. The next step of locking down, which one to use, vboxmanage or vboxsdl? Where can I find vboxmanage commands and does it also include setting to revert the image back to default after use?

 

Thanks

Manny

[BOOT]

VBoxSDL is being removed in future releases.

Manual for VBoxManage is here:

https://www.virtualbox.org/manual/ch08.html

[mansin]

So, who has got Visual Studio 2015 installed on Windows 7 VM? Hitting this snag:

 

 

Seems like a non starter

[synaesthesia]

is the win7 fully updated with sp1?

[mansin]

is the win7 fully updated with sp1?

 

Thanks for that. After updating Windows, VS is now installing. I Never realised how BIG it is to install.

 

I'm getting the feeling that with just VS installed the image is going to be near 50GB. Anyone with VS 2015 installed, how big is your image?

 

Thanks

Manny

[mavhc]

Why are you using a VM?

[BOOT]

Why are you using a VM?

Why wouldn't you?

It's takes like 5 minutes to find and run an exploit from source code...

[mansin]

Why are you using a VM?

 

VM = Virtual Machine (using VirtualBox)

 

Maybe your confusing it with VMware?

[mavhc]

Yes, why are you using Virtual Machines to run Visual Studio?

 

https://msdn.microsoft.com/en-us/library/jj662724.aspx

 

What kind of exploits? Better fix those anyway, or a hacker will use them to ransomware you, or whatever

[jthompson]

Preventing users from running custom code on networked machines has to be a good idea, surely?

[synaesthesia]

Our image is 16gb with virtual studio, python, netbeans, idle and a couple of odds and ends. Used w7 lite to strip out the unnecessary gubbins and there's a few cleaner tools to get rid of old update caches.

 

For us it's not so much the security; I even put Wireshark on a machine for one of our kids to play with last week, confident enough to not be that worried. It's more about providing a close to real-world user environment with full admin access, which I feel is important for aspiring coders.

[free780]

Visual Studio is a beast. It's not supported on LTSC, Windows 7 is EOL in 2020. I'd try and leverage the new features in Windows Defender to mitigate 0 days. Keep everything up to date including Visual Studio. Unless you have a lot of resources for a dedicated VM Host to run Windows 10 SAC.

[mavhc]

Just use python here, so not found anything that needs admin access, they can use cmd line anyway, and pip will install packages per user.

 

Real world coding these days is rarely about making an exe file. Not looked into using containers yet for limited users.

[mansin]

Our image is 16gb with virtual studio, python, netbeans, idle and a couple of odds and ends. Used w7 lite to strip out the unnecessary gubbins and there's a few cleaner tools to get rid of old update caches.

 

For us it's not so much the security; I even put Wireshark on a machine for one of our kids to play with last week, confident enough to not be that worried. It's more about providing a close to real-world user environment with full admin access, which I feel is important for aspiring coders.

 

Do you have a link to download Win 7 lite? Also, did you use 32 or 64bit?

 

Thanks

Manny