Some notes about configuring RAID10, LVM, KVM and virt manager on a Debian Lenny server

Recently I’ve achieved a good setup for a virtualized environment, using Debian Lenny as host, with a RAID10, and LVM for managing VM disk images.

The server was a: CPU Intel Xeon X3430 RAM 4GB HD 4x500GB

During the installation, on each of the 4 disks, I created:

• a small /boot partition (~300Mb)
• 10 Gb RAID1 for /
• 1 Gb RAID10 for swap
• remaining space as RAID10, with a big LVM volume on top of it.

Please note: at the end of the installation, you should manually install grub on every disk, because if the first disk get destroyed, you cannot boot your system.

mkdir /boot2 /boot3 /boot4
mount /dev/sdb1 /boot2
mount /dev/sdc1 /boot3
mount /dev/sdd1 /boot4
rsync -av /boot/ /boot2/
rsync -av /boot/ /boot3/
rsync -av /boot/ /boot4/
umount /boot2/ /boot3/ /boot4/
dd if=/dev/sda of=/dev/sdb count=1 bs=512
dd if=/dev/sda of=/dev/sdc count=1 bs=512
dd if=/dev/sda of=/dev/sdd count=1 bs=512

At this point, installing kvm plus virt-manager is straightway:

aptitude install kvm libvirt-bin virt-manager

Remember that Lenny is getting pretty old, so for getting more from your server, you should use the backports.org packages.

Now add your user to the libvirt and kvm system groups (/etc/groups):

[..]
kvm:x:112:bob
libvirt:x:115:bob
[..]

At this point, you should connect to virt-manager GUI. As far as I understood, virt-manager support connections from remote hosts, but the TLS configuration is not so well documented, so you can simply do X11 forwarding or install a VNC server, or NX server, on the host to get the local virt-manager.

What I usually do on my lan from my laptop is:

ssh -X -l myuser myserver.local
virt-manager

And the virt-manager window will popup.

LVM Configuration Edit->Host Details->Storage Add your LVM Volume Group defined during the first setup: from this window, you can create virtual disks for your machines. Using LVM instead of simple disk images give great benefits: less overhead, and the ability to expands images (and filesystems on it) without even rebooting the VM.

Network Configuration You can use both bridged networks and private networks. Bridged networks are used when a VM should have the same subnet address of the other hosts on the local networks.

Bridged networks requires additional configuration on the host to work:

cat /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#auto eth0
#allow-hotplug eth0
#iface eth0 inet static
#        address 192.168.0.4
#         netmask 255.255.255.0
#         gateway 192.168.0.1

auto br0
allow-hotplug br0
iface br0 inet static
         address 192.168.0.4
         netmask 255.255.255.0
         gateway 192.168.0.1
         bridge_ports eth0
         bridge_stp off
         bridge_maxwait 15

Private networks should be use to isolate the virtual machine from the physical networks. You can create a DMZ using strict iptables rules for allowing clients to reach VM inside a private network. You can take a look on the iptables scripts I am using on the host, that use both bridged and private networks.

cat firewall.sh
#! /bin/bash
# By Giovanni Toraldo

LAN='br0'
VLAN='virbr0'
SUBNET='192.168.0.0/24'
VSUBNET='192.168.122.0/24'

## FLUSH
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

## Default Policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# Basic Routing/Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT

## Local Inbound Services
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -A INPUT -p tcp --dport 25 -j ACCEPT # mail
iptables -A INPUT -p udp --dport 123 -j ACCEPT # ntp
iptables -A INPUT -p tcp --dport 80 -s $SUBNET -j ACCEPT # nginx

# VLAN - I accept and route all traffic
iptables -A INPUT -i $VLAN -j ACCEPT
iptables -A INPUT -i $LAN -j ACCEPT
iptables -A FORWARD -i $VLAN -j ACCEPT
iptables -A FORWARD -i $LAN -o $VLAN -j ACCEPT
# Masquerading packets from private networks only!!
iptables -t nat -A POSTROUTING -s $VSUBNET -o $LAN -j MASQUERADE