Allan Willems Joergensen – OnDemand

Background

In the past I have written a couple of articles on how to run Windows applications using SeamlessRDP and Sun xVM (Virtualbox) and Linux KVM (Kernel-based Virtual Machine). After reviewing both articles I have decided to write a new article encompassing both hypervisors and correcting some of the mistakes I have found as well improvements made by a couple of guys who have done quite a deal of testing: Thomas Hansson and Peter Clarén.

By the way – There is no reason why this guide should not work on other platforms like FreeBSD (Virtualbox, Qemu), Mac OSX (Virtualbox) or Solaris/OpenSolaris (Virtualbox) as long as the host platform is x86 or x64. The guide is centered around Ubuntu but it should be possible to use it for other Linux distributions without much work.

So, what is the reason for this article?

I run Linux on my primary machine (well, on all my machines really) but there are a few Windows application I need to run – Some run under Wine but does not act like in native Windows, some will not run under Wine. The solution was to run a virtual machine with Windows but I did not like the fact that I had to have a complete Windows desktop.

Enter SeamlessRDP. SeamlessRDP is an “extension” of the RDP protocol (originally developed by Cendio AB for their ThinLinc product).

SeamlessRDP makes it possible to run individual applications rather than a full desktop. In this mode, rdesktop creates a X11 window for each window on the server side. The remote applications can be moved, resized and restacked.

Choosing a hypervisor

I deal a lot with virtualization in job and have come to be a great fan of VMware’s line of products. Naturally I have been running VMware Workstation on my computer for a very long time but for this particular task it did not fit my needs (most noticeably it does not have the option to run “headless”) so I had to start looking at alternatives.

I started using VMware Server which worked great in version 1.x but after upgrading to 2.0 I was put of by the fact that is now uses a horrible memory hog of a web interface (which could be disabled but one is then dependent on Virtual Infrastructure Client which is Windows only).

After ditching VMware I ended up with two (equally great) products:

• Sun xVM Virtualbox
  Pros: No problems with kernel modules. Great support for USB devices. RDP based “console”. Great performance using paravirtualized devices. Supports running 64 bit guests on a 32 bit host OS (the host has the be 64 bit of course). Export virtual machines as appliances. Seamless integration of the guests and hosts (using guest additions to provide shared clipboard and dynamic screen resizing)Cons: Not free (there is an open sourced edition which lacks some of the feature described above).
• Linux KVM
  Pros: Part of the kernel. Lots of features (like live migrations). Powerful. Open source
  Cons: Does not support 64 bit guests on 32 bit host OS. Requires Intel VT-x or AMD-V. Though Virtual Machine Manager makes it easier it is not for the average user

Because I use both on a regular basis I will describe how to accomplish the goal using both hypervisors. My guides are based on Ubuntu so you may need to change the commands to match your environment.

Installing and configuring hypervisor

Installing KVM

One important note: KVM requires hardware virtualization support. To check if your computer supports this, run

The output should be at least 1 – If you know your CPU support VT-x or AMD-v but the above command does not show anything make sure virtualization is enabled in the computer’s BIOS.

KVM is in Ubuntu’s package repository, so installing it easy

Install Virtualbox

Virtualbox does not require hardware virtualization support but will benefit from it.

Enable Virtualbox’ package repository

and then install Virtualbox:

Configuring network on the host

Though both Virtualbox and KVM support simple NAT networking we need to be able to connect to the virtual machine and the virtual machine need to be able to connect to the outside network.
Virtualbox now supports bridging to host interfaces but that is not necessarily what we want since that exposes the virtual machine to the outside network (which can cause problems on networks that only allow one MAC address per switch port).

So, we’ll set up a virtual interface on the host and let the host handle DNS, DHCP and IP forwarding (using dnsmasq and iptables).

First, install the needed software

Ubuntu tries to keep security really tight so be default only root is allowed to access tun/tap devices. To fix this we create a udev rule to allow group access to those devices

Next create a interface configuration for a tap interface which will spawn a dedicated instance of dnsmasq when the interface is initialized (with Virtualbox it is also possible to use a bridge interface but since it does not work with KVM I will use tap for both) – Add this to /etc/network/interfaces:

test if it works

You also need to add any users running virtual machines to the group uml-net:

(It will not work until the user logs on after adding her to the group)

In order for the virtual machine to reach the outside network we need to set up IP forwarding; I use Uncomplicated Firewall because it is very simple to use.

1. Edit /etc/default/ufw and change DEFAULT_FORWARD_POLICY from DROP to ACCEPT
2. Edit /etc/ufw/sysctl.conf and enable the line net/ipv4/ip_forward=1 (remove the # in front of the line)
3. Add the following lines to /etc/ufw/before.rules (right after the comments at the top):
   # nat Table rules
   *nat
   :POSTROUTING ACCEPT [0:0]
   
   # NAT all traffic coming from 192.168.10.0/24 going through any interface.
   -A POSTROUTING -s 192.168.10.0/24 -j MASQUERADE
   
   # don't delete the 'COMMIT' line or these nat table rules won't
   # be processed
   COMMIT
4. In the same file (/etc/ufw/before.rules), locate the line -A ufw-before-output -o lo -j ACCEPT and add these lines right after:
   -A ufw-before-input -i tap0 -j ACCEPT
   -A ufw-before-output -o tap0 -j ACCEPT

Getting things running

Converting an existing VMware virtual machine

Both KVM and Virtualbox support vmdk files so there is no need convert the disk files, just adjust the virtual machine creation to point at the vmdk file instead.

Windows can be quite picky when it comes to hardware so moving a virtual machine to a new hypervisor will most likely result in BSOD. If this happens find a Windows XP install CD, boot from it and repair your Windows XP installation.

Creating a virtual machine

Using KVM

Create the script $HOME/bin/kvm-windows:

Change HD, NIC1MAC, KB and CPU to match your needs.

Last step is to create a virtual disk:

before booting the virtual machine

and connecting to the “console”

Continue to installing Windows

Using Virtualbox

We will create the virtual machine from the shell – simply because it is easier.

Boot the virtual machine (this has to be done from the shell to run the “console” as a RDP service):

and then connect to the “console”

Continue to installing Windows

Installing and configuring Windows XP

The installation of Windows XP is no different than any other install so I will not go into that.

KVM: Installing paravirtualized network driver

Download the driver disc, shut down the virtual Windows machine, change the variable NET to read:

and then boot Windows again

when Windows asks for a driver for the new network interface device, point to the CD-ROM.

Virtualbox: Installing guest additions

Shut down the virtual Windows machine, then from the shell run

Boot Windows again

and then connect to the “console”

Inside Windows, open the CD-ROM drive and select VBoxWindowsAdditions.exe and follow the instructions.

Configuring and tuning Terminal Services

Terminal Services is called Remote Access in Windows XP – enable it in Start -> Control Panel -> System -> Remote Access.

One downside is that someone needs to log on before XP punches a hole in the firewall. To circumvent this either manually add an exception for the RDP service or simply turn of the firewall (that’s what I did since the host will be protected by the host’s firewall as well as the NAT feature of VirtualBox).

One of the more annoying limitations in Windows XP is that the color depth by default is limited to 16 bits.

To change this open the Group Policy Editor (Start -> Run -> gpedit.msc) and navigate to Administrative Template -> Windows Components -> Terminal Services and change the limit:

Setting maximum colour depth for Terminal Services

There are a few other parameters one can change, feel free to poke around.

To be able to connect to the Windows machine using RDP you need to set a password for the user you wish connect as.

Assign a static IP to your virtual machine, this will make it easier to create the scripts further down in this article.

Install and configure SeamlessRDP

The main component in this setup is SeamlessRDP which allows one to launch a single application using RDP (remote desktop) and open only the window of that application. The drawback (with Windows XP) is that you are only allowed to open one session which means you can only launch one application at the same time.

Luckily someone grew tired of this and has made a patch to both rdesktop and SeamlessRDP that makes it possible to launch more than one application over the same SeamlessRDP session.

Installing rdesktop from CVS

First make sure that you have all the required packages for building rdesktop

Download rdesktop from CVS

Download the patch to the checked out source

Patch the source

Compile the source and install (install it as rdesktop-cvs to not interfere with the Ubuntu package)

Installing the Windows component

Download the updated SeamlessRDP program and unpack it to c:\seamlessrdp inside the virtual machine.

Making it all come together

To ease the execution of Windows programs I’ve created a small script called $HOME/bin/winrun:

What this script does it to check for a socket file; if it does not exist rdesktop connects the same way as the standard client. If it does exist rdesktop uses the socket and the existing connection to create another window.

Similarly I have a script to connect to the Windows desktop when I need to do some maintenance

Sharing data between the host and guest

When running KVM

Remote Desktop resource redirection

This is the easiest way of sharing data but it has some drawbacks.

Enable it by adding this to RDESKTOP_ARGS in winrun:

This will make your entire home directory available to your virtual machine but only when you are connected and not with an assigned drive letter.

RDP resource redirection active

Samba

One could also use a Samba server on the host

By default the section in /etc/samba/smb.conf concerning home directories is commented out

Be sure to reload the Samba service

Then map the home share inside the virtual machine

When running Virtualbox

The same methods can be used as with KVM but it is a lot smarter to use Shared Folders.

Shut down the virtual machine then run (in a shell on the host):

Boot Windows again

and then connect to the “console”

Inside Windows, run the following command to map the shared folder

Tips and tricks

Running Explorer in seamless mode

If you try to run explorer.exe using the winrun method you will get the entire desktop. This is because the first explorer.exe launched will be always be used as the “shell” (or desktop).

To get around this, download Litestep, install it and set it as the shell for Windows. Now you are able to run explorer.exe and only get the file manager window presented in Linux.

Running any Windows program as a service

This might come in handy if you need a particular program running (this could be an VPN client needed to access resources from within Windows). In my example I will use the Aventail Connect Client.

Install and configure the program you wish to run as a service. Make sure it works as expected.

Download svcany.zip and unpack in your virtual machine. This example uses C:\srvany

Create a new service

Open regedit (Start -> Run -> regedit) and nagivate to HKEY_LOCAL_MACHINE -> System -> CurrentControlSet -> Services -> Aventail Connect Client. Add a new key (Edit -> New -> Key) called Parameters and under this new key add a new string called Application with the content “C:\Program Files\Aventail\Connect\as32.exe” (this string has to match your program).

Edit service

That’s it.

Errors (and fixes)

A comment in one of the old articles asked: When I run winrun I get this error:

That is because you are using the Open Source Editition (OSE) of Virtualbox which does not have a RDP server build in.