Virtualbox + image for programming classes

[mulderite]

I'm having difficulty trying to successfully map user's H: drives from within an Ubuntu VM in VirtualBox. I've set up the VM with an immutable disk, installed the guest additions and created a shared folder like this:

 

 

Folder Path: H:\mywork

Folder Name: mywork

 

Auto-mount enabled.

 

 

When I boot up the VM (logged into Windows 7 with a test user account) the H drive shows up in Ubuntu but when I select it I get the following message:

 

"The location could not be displayed. You do not have the permissions necessary to view the contents of "sf_mywork"

 

Unfortunately I just cannot work out what permissions it is complaining about to sort this issue out. I've read posts in other forums about setting user access within the 'vboxsf' group, but it only mentions scenarios of individual usernames and not a 'wildcard' setting.

 

Can anyone help?

[Steve21]

It's the username within Ubuntu, so whatever the account name you gave them in the VM

 

Think of it like this: Windows 7 shares a folder to Ubuntu. Virtualbox allows any user called vboxsf (group) to connect to said share. Ubuntu needs to add it's user to that group

 

99% sure thats the way I did it, but can dig out my documentation if not

 

Steve

[mulderite]

It's the username within Ubuntu, so whatever the account name you gave them in the VM

 

Think of it like this: Windows 7 shares a folder to Ubuntu. Virtualbox allows any user called vboxsf (group) to connect to said share. Ubuntu needs to add it's user to that group

 

99% sure thats the way I did it, but can dig out my documentation if not

 

Steve

 

Ok... so I just need to add the username I used in my VM (which was 'Linux' - creative or what??) into the vboxsf group?

[Steve21]

Aye, If you look on the Ubuntu machine (not win7) virtualbox should have made a new security group and add it into there.

 

So Sudo.... etc etc

 

Sure that was it but like I said if you can't get it i'll try to find my original instructions when I did ours

 

Steve

[kennysarmy]

Not sure I can add anything....as we were using a Windows 7 host to run another Windows 7 sandbox environment , no linux involved !

 

I have found this in our tech.notes though...

 

Fixes for Potential Issues

 

H:/ Drive Shared Folder Disappears

 

If the shared folder disappears for users to be able to access their H:/ drive, follow these steps in order to fix the issue.

 

1.) Open up the Command Prompt

2.) Type in "cd C:/Program Files/Oracle/VirtualBox/"

"VBoxManage setextradata global GUI/Customizations MenuBar,StatusBar"

3.) Open up the Oracle Virtual Sandbox and select the "Devices" tab on the top bar.

4.) Select "Install Guest Additions"

5.) Go to "My Computer" and open up the Oracle CD that has now appeared in the drive.

6.) Execute "VboxWindowsAdditions.exe" and use all the defaults.

7.) Shutdown the Virtual Environment, and open the Command Prompt

8.) Type in "cd C:/Program Files/Oracle/VirtualBox/"

"VBoxManage setextradata global GUI/Customizations noMenuBar,noStatusBar"

 

9.) Restart the Sandbox, and the H:/ drive should now appear.

10.) Test as a student to see if it has worked; ensure you check to make sure t

all menus are disabled.

[mulderite]

Thanks for the assistance chaps. It was, as stated, the fact that I'd not added the username I had set up in the Linux VM to the VBOXSF group that was preventing the H: share from working.

[Disease]

 

which also needs this batch file to exist called:

 

sandbox-settings.bat

@echo off

:: To be used in conjuction with: Oracle Virtual Machine Script NEW.bat

:: This script runs as a new window so that it can take advantage of the new vbox commands, after installation.

:: No user input or echoing is used as this script will only run for a few seconds, and the main one takes precedence.

C:

cd "C:\Program Files\Oracle\VirtualBox"

:: Uses the Virtual Box command line to disable all menu and status bars on the virtual operating system.

VBoxManage.exe setextradata global GUI/Customizations noMenuBar,noStatusBar

:: When moving a virtual box from one computer to another, the virtual media needs to be disconnected, and reconnected, or it will be unable

:: to recongise the image on the new machine. This was previously done manually, but can now be automated.

:: The following command disconnects the virtual media from port 0, of the SATA interface.

VBoxManage.exe storageattach "Sandbox Clone" --storagectl "SATA" --port 0 --device 0 --medium none

:: Re-attaches the virtual media to the operating system, and sets it so that it can be written to. This will allow the VM to start-up.

VBoxManage.exe storageattach "Sandbox Clone" --storagectl "SATA" --device 0 --port 0 --type hdd --mtype normal --medium "C:\sandbox\Sandbox Clone-disk1.vdi"

cd "C:\Program Files\Oracle\VirtualBox"

:: PLEASE READ

:: The first time the Virtual Box is started via this script, the image has a scheduled task that is set to run when the first user logs in.

:: It will run a .exe file on the Desktop which will activate Windows, delete itself, and shut-down the computer.

:: This process will all happen automatically and no user interaction is necessary. The reason this could not be completely done through the command line

:: is that Windows scans the hardware of each new computer to manage its licensing. By having a portable VM that is immutable, it will constantly

:: require you to restart your computer, and enter a new activation code. Therefore, each workstation is validated, and licensed by Windows separately,

:: before being made immutable through this process.

 

:: The script will hold until the VirtualBox executable shuts down, once the scheduled task completes.

start /wait virtualbox.exe --startvm "Sandbox Clone"

:: Disconnects the current virtual media so that it can be made immutable.

VBoxManage.exe storageattach "Sandbox Clone" --storagectl "SATA" --port 0 --device 0 --medium none

:: Re-attaches the virtual media as an immutable media, so that it cannot be altered, and will always revert back to its original state.

VBoxManage.exe storageattach "Sandbox Clone" --storagectl "SATA" --device 0 --port 0 --type hdd --mtype immutable --medium "C:\sandbox\Sandbox Clone-disk1.vdi"

:: Disconnects the network connection between the Virtual Box and the host machine, once Windows has authenticated the license.

VBoxManage modifyvm "Sandbox Clone" --nic1 none

cd "C:\Program Files\Oracle\VirtualBox"

:: Starts the Virtual Box a final time so that the technician can do a final check on whether it is operating correctly.

start /wait virtualbox.exe --startvm "Sandbox Clone"

exit

 

Hi Kenny,

 

Working through your script and I have a small problem with the second part sandbox-settings, I have obviously missed something

 

The first part works flawlessly and installs VirtualBox and creates the sandbox folder and copies all the files, when it moves on to the second script it says Virtual Machine Sandbox_clone not found. Do I have to create the virtual machine first for the script to find it or should it all be automated?

 

If I create the VM first then it just says VM already exists, as I say I have probably missed a step somewhere can you give me a nudge in the right direction

 

Thanks

Edited June 9, 2016 by Disease

[kennysarmy]

In my first script - location J:\_admin software\Virtual Box\sandbox contains the file Sandbox Clone-disk1.vdi

 

Does yours?

[kennysarmy]

Hi Kenny,

 

Working through your script and I have a small problem with the second part sandbox-settings, I have obviously missed something

 

The first part works flawlessly and installs VirtualBox and creates the sandbox folder and copies all the files, when it moves on to the second script it says Virtual Machine Sandbox_clone not found. Do I have to create the virtual machine first for the script to find it or should it all be automated?

 

If I create the VM first then it just says VM already exists, as I say I have probably missed a step somewhere can you give me a nudge in the right direction

 

Thanks

 

ALso I guess to troubleshoot you could just enter each line of code in manually to a command prompt and let us know the outcome...

[Disease]

In my first script - location J:\_admin software\Virtual Box\sandbox contains the file Sandbox Clone-disk1.vdi

 

Does yours?

 

Yes it all there, will try each line and get back, thanks

[mrbios]

I notice there's a few mapped drive issues above, not sure mine is similar though...

 

My users seem to be getting an issue whereby you startup the VM, it creates the Virtual folder in their H drive if it doesn't exist, vm loads fine, but no mapped drive appears in the VM. However all i need to do to fix this is restart the VM, then it works fine until the next kid logs on. Any ideas on a fix for that one?

 

It's only minor, but an irritation nonetheless.

[Steve21]

We create the folder in advance via GPO. (At my old place that's how I set it). Therefore it's there in advance for the mapping to apply instantly

 

Steve

[mrbios]

We create the folder in advance via GPO. (At my old place that's how I set it). Therefore it's there in advance for the mapping to apply instantly

 

Steve

 

Even when the folder already exists in their home folder it still fails to map the drive first time until the vm is restarted a second time during that logon session. Very strange.

[Steve21]

Even when the folder already exists in their home folder it still fails to map the drive first time until the vm is restarted a second time during that logon session. Very strange.

 

How are you doing the mapping, automount on Windows?

 

Steve

[mulderite]

Hi,

 

I'm running Ubuntu via Virtualbox on a Windows 7 host with a 'host only' network adapter and the teacher has requested internet access within the VM. His reasoning for this is that there are certain tasks the students will be required to do in the course that will require internet connectivity (e.g. running 'sudo apt-get' commands). I've read posts on other forums about getting this to work by configuring two network adapters for the VM (one as 'host only', the other as 'NAT') but I still can't get it locked down.

 

Any help would be appreciated.

Thanks.

Edited July 22, 2016 by mulderite

[flyinghaggis]

Hi,

 

I'm running Ubuntu via Virtualbox on a Windows 7 host with a 'host only' network adapter and the teacher has requested internet access within the VM. His reasoning for this is that there are certain tasks the students will be required to do in the course that will require internet connectivity (e.g. running 'sudo apt-get' commands). I've read posts on other forums about getting this to work by configuring two network adapters for the VM (one as 'host only', the other as 'NAT') but I still can't get it locked down.

 

Any help would be appreciated.

Thanks.

 

We had an idea that we could fit an extra physical network card to the computers running Virtualbox then set the host to be connected to the main network via NIC#1 and then route the VM through the second NIC which would be on a separate VLAN on our physical network which only has access to the internet and nothing else on site. That would keep the host usable no the main network whilst still isolating the VM with only internet access. It's not without its failings though as it means that pupils could easily swap the network connections over if they wanted to mess around plus we'd maybe need to setup some kind of authentication to track which pupils are accessing what otherwise we'd be unable to log which specific pupils were accessing stuff online.

 

It feels like a pretty complicated arrangement though so I'd be interested to know whether there's a simpler way to achieve this using software alone? As more stuff moves into the cloud our computing department have been pressuring us to get internet access for the VM's as well but I cant think of a secure way to do it!

Edited July 22, 2016 by flyinghaggis

[Steve21]

Why are you giving the sandbox a card to host at all? There's no need for it to talk to the host if you're using a shared folder for files via virtualbox. (Unless there's something odd you're doing as that pretty much removes all the point of the sandbox as the VM isn't secure )

 

In regards to the internet access there's lots of options, but depends on how complicated you want to make it, and what you're comfortable with doing

 

Option 1) Add 2 IPs to your hosts network card, one on each VLAN (tag the port with both), assign one card for the host to the primary, and the secondary IP to the VM that's on another vlan.

Option 2) Start playing with UDP tunnels from the VM, then have a "server VM" that's the one that's doing the routing to the internet upstream of the VMs.

Option 3) Use the NAT option for internet access and restrict the ports forwarded to 80 etc (or whatever APT uses)

Option 4) Run a local APT cache server and direct the VMs to that (but depends if you want other internet etc)

etc etc

 

Steve

[flyinghaggis]

I guess in our specific situation we want to give pupils general internet access via the VM for a variety of tasks and access Google Apps resources (so to more than just APT software) but prevent them from having access to the host computer or anywhere else on the network other than the internet gateway.

 

So something along the lines of option 1 or 2 is probably what we'd need to do? I hadn't actually realised you could tag with specific VLANs from within Virtualbox.

Edited July 22, 2016 by flyinghaggis

[flyinghaggis]

I've just noticed that some of our pupils have found a way to launch "vboxmanage.exe" without the restrictions in place by pinning the Virtualbox app to their taskbar after it has been run and launching it from there!

 

Has anyone else noticed this issue and can anyone think of a way to block this?

[Steve21]

There is no official way. If you disable vboxmanage you break all of virtualbox, and they "could" even remove the restrictions you put in place if they copy the commands.

 

The way we were looking at it doing it for total lock down is by using a custom app to launch virtualbox under another local user account, then restricting vboxmanage so no students can access it.

 

This way they run the custom-app that launches vbox, but can't launch the vboxmanage

 

Steve

[flyinghaggis]

There is no official way. If you disable vboxmanage you break all of virtualbox, and they "could" even remove the restrictions you put in place if they copy the commands.

 

The way we were looking at it doing it for total lock down is by using a custom app to launch virtualbox under another local user account, then restricting vboxmanage so no students can access it.

 

This way they run the custom-app that launches vbox, but can't launch the vboxmanage

 

Steve

 

We have a separate app to launch vbox with the restrictions in place so they aren't using the executable as I didn't' want to pupils to have access to the batch file script which they could easily view. Like yourself I also thought about running this app with another user account in order to block the pupils launching it directly under their own.

 

However, the issue we have with this is that it'll break access to the pupils own home documents area (with is linked to a mapped drive) meaning they won't be able to transfer files back and forth from the host to the VM.

[Steve21]

The problem is as you say they can still just create a shortcut to vboxmanage and run their own disables etc, or even worse creating their own stuff

 

The long-winded way (and bodgy but it works fine via testing) way we were going to do it, is effectively when said student runs "customApp" it asks for username/password, it's then mapping said mapped drive (N) using the local account, but to the server based on the real user if that makes sense. So within virtualbox N:\ is still the actual user area of the real user. (This is then disconnected at the end of the of the session as part of the program closing task)

 

Think of it as a net use running under local account but using real account username/password. This means Jim can still write a file to the shared VM folder, this'll then write back via local users netuse to Jims area etc.

 

If that makes any sense

 

Steve

[Steve21]

On a side note, the other cleaner option I was trying to look at but never finished as I left the old place was creating a custom vboxmanage wrapper, that checks who's launching it.

 

If it's direct from said user it blocks it, if it's via virtualbox.exe/"insert custom app" etc launching it as a process thread it'd allow it.

 

The logic seems to work but never finished the testing if you fancied an idea

 

Steve

[flyinghaggis]

@Steve21 Thanks for the tips. I'll have a think and see if I can put together something.

[mrbios]

Revisiting my issue with the Virtual folder not mapping on startup...

 

When the VM is started up, the drive doesn't map, yet the folder is created (be it GP or script, both work to create the folder) the VM then starts up with no drive. If i shutdown the VM, then start it back up again i get exactly the same issue...the only way i can make it work is if i startup the VM, then restart the VM (so virtualbox never closes) the drive them maps correctly after the restart.

 

Anyone had this issue? It's frustrating me! I've tried installing the virtualbox extensions and guest additions stuff but that didn't help.