Running Windows applications natively and seamlessly on Linux with SeamlessRDP and Virtualbox or KVM

Background

In the past I have written a couple of articles on how to run Windows applications using SeamlessRDP and Sun xVM (Virtualbox) and [Linux KVM](http://www.linux-kvm.org/page/Main_Page Linux KVM) (Kernel-based Virtual Machine). After reviewing both articles I have decided to write a new article encompassing both hypervisors and correcting some of the mistakes I have found as well improvements made by a couple of guys who have done quite a deal of testing: Thomas Hansson and Peter Clarén.

By the way – There is no reason why this guide should not work on other platforms like FreeBSD (Virtualbox, Qemu), Mac OSX (Virtualbox) or Solaris/OpenSolaris (Virtualbox) as long as the host platform is x86 or x64. The guide is centered around Ubuntu but it should be possible to use it for other Linux distributions without much work.

So, what is the reason for this article?

I run Linux on my primary machine (well, on all my machines really) but there are a few Windows application I need to run – Some run under Wine but does not act like in native Windows, some will not run under Wine. The solution was to run a virtual machine with Windows but I did not like the fact that I had to have a complete Windows desktop.

Enter SeamlessRDP. SeamlessRDP is an “extension” of the RDP protocol (originally developed by Cendio AB for their ThinLinc product).

SeamlessRDP makes it possible to run individual applications rather than a full desktop. In this mode, rdesktop creates a X11 window for each window on the server side. The remote applications can be moved, resized and restacked.

Choosing a hypervisor

I deal a lot with virtualization in job and have come to be a great fan of VMware’s line of products. Naturally I have been running VMware Workstation on my computer for a very long time but for this particular task it did not fit my needs (most noticeably it does not have the option to run “headless”) so I had to start looking at alternatives.

I started using VMware Server which worked great in version 1.x but after upgrading to 2.0 I was put of by the fact that is now uses a horrible memory hog of a web interface (which could be disabled but one is then dependent on Virtual Infrastructure Client which is Windows only).

After ditching VMware I ended up with two (equally great) products:

• Sun xVM Virtualbox
  Pros: No problems with kernel modules. Great support for USB devices. RDP based “console”. Great performance using paravirtualized devices. Supports running 64 bit guests on a 32 bit host OS (the host has the be 64 bit of course). Export virtual machines as appliances. Seamless integration of the guests and hosts (using guest additions to provide shared clipboard and dynamic screen resizing)Cons: Not free (there is an open sourced edition which lacks some of the feature described above).
• Linux KVM
  Pros: Part of the kernel. Lots of features (like live migrations). Powerful. Open source
  Cons: Does not support 64 bit guests on 32 bit host OS. Requires Intel VT-x or AMD-V. Though Virtual Machine Manager makes it easier it is not for the average user

Because I use both on a regular basis I will describe how to accomplish the goal using both hypervisors. My guides are based on Ubuntu so you may need to change the commands to match your environment.

Installing and configuring hypervisor

Installing KVM

One important note: KVM requires hardware virtualization support. To check if your computer supports this, run

$ egrep -c '(vmx|svm)' /proc/cpuinfo

The output should be at least 1 – If you know your CPU support VT-x or AMD-v but the above command does not show anything make sure virtualization is enabled in the computer’s BIOS.

KVM is in Ubuntu’s package repository, so installing it easy

$ sudo apt-get install kvm xtightvncviewer

Install Virtualbox

Virtualbox does not require hardware virtualization support but will benefit from it.

Enable Virtualbox’ package repository

$ echo "deb http://download.virtualbox.org/virtualbox/debian jaunty non-free" | sudo tee -a /etc/apt/sources.list
$ wget -q http://download.virtualbox.org/virtualbox/debian/sun_vbox.asc -O- | sudo apt-key add -

and then install Virtualbox:

$ sudo apt-get update
$ sudo apt-get install virtualbox-3.0 rdesktop

Configuring network on the host

Though both Virtualbox and KVM support simple NAT networking we need to be able to connect to the virtual machine and the virtual machine need to be able to connect to the outside network.
Virtualbox now supports bridging to host interfaces but that is not necessarily what we want since that exposes the virtual machine to the outside network (which can cause problems on networks that only allow one MAC address per switch port).

So, we’ll set up a virtual interface on the host and let the host handle DNS, DHCP and IP forwarding (using dnsmasq and iptables).

First, install the needed software

$ sudo apt-get install dnsmasq ufw uml-utilities

Ubuntu tries to keep security really tight so be default only root is allowed to access tun/tap devices. To fix this we create a udev rule to allow group access to those devices

$ echo "KERNEL=="tun[0-9]*",GROUP="uml-net" MODE="0660"" | sudo tee -a /etc/udev/rules.d/40-permissions.rules
$ sudo udevadm control --reload-rules

Next create a interface configuration for a tap interface which will spawn a dedicated instance of dnsmasq when the interface is initialized (with Virtualbox it is also possible to use a bridge interface but since it does not work with KVM I will use tap for both) – Add this to /etc/network/interfaces:

auto tap0
iface tap0 inet static
         address 192.168.10.1
         netmask 255.255.255.0
         up /usr/sbin/dnsmasq --interface=${IFACE}  --except-interface=lo,eth0,wlan0,ath0 --bind-interfaces --user=nobody \
         --dhcp-range=kvm,192.168.10.150,192.168.10.250,255.255.255.0,192.168.10.255,8h \
         --domain=kvm.lan --pid-file=/var/run/${IFACE}_dnsmasq.pid --conf-file
         tunctl_user nobody

test if it works

$ sudo ifup tap0
$ ps aux | grep dnsmasq | grep -c kvm
1

You also need to add any users running virtual machines to the group uml-net:

$ sudo adduser <user> uml-net

(It will not work until the user logs on after adding her to the group)

In order for the virtual machine to reach the outside network we need to set up IP forwarding; I use Uncomplicated Firewall because it is very simple to use.

1. Edit /etc/default/ufw and change DEFAULT_FORWARD_POLICY from DROP to ACCEPT
2. Edit /etc/ufw/sysctl.conf and enable the line net/ipv4/ip_forward=1 (remove the # in front of the line)
3. Add the following lines to /etc/ufw/before.rules (right after the comments at the top):
4. In the same file (/etc/ufw/before.rules), locate the line -A ufw-before-output -o lo -j ACCEPT and add these lines right after:

   -A ufw-before-input -i tap0 -j ACCEPT
   -A ufw-before-output -o tap0 -j ACCEPT
   

Getting things running

Converting an existing VMware virtual machine

Both KVM and Virtualbox support vmdk files so there is no need convert the disk files, just adjust the virtual machine creation to point at the vmdk file instead.

Windows can be quite picky when it comes to hardware so moving a virtual machine to a new hypervisor will most likely result in BSOD. If this happens find a Windows XP install CD, boot from it and repair your Windows XP installation.

Creating a virtual machine

Using KVM

Create the script $HOME/bin/kvm-windows:

Change HD, NIC1MAC, KB and CPU to match your needs.

Last step is to create a virtual disk:

$ kvm-img create -f qcow2 $HOME/path/to/Windows.img

before booting the virtual machine

$ kvm-windows -cdrom /path/to/WindowsXP.iso -boot d

and connecting to the “console”

$ xtightvncviewer :1

Continue to installing Windows

Using Virtualbox

We will create the virtual machine from the shell – simply because it is easier.

$ VBoxManage createvm --name "Windows" --register
$ VBoxManage createhd --filename "Windows.vdi" --size 10000 --remember
$ VBoxManage modifyvm "Windows" --memory "512MB" --hda "Windows.vdi" --dvd /path/to/WindowsXP.iso --acpi on --boot1 dvd --nic1 bridged --bridgeadapter1="tap0" --vrdp on --vrdpport 1337

Boot the virtual machine (this has to be done from the shell to run the “console” as a RDP service):

$ VBoxManage startvm Windows -type vrdp

and then connect to the “console”

$ rdesktop localhost:1337

Continue to installing Windows

Installing and configuring Windows XP

The installation of Windows XP is no different than any other install so I will not go into that.

KVM: Installing paravirtualized network driver

Download the driver disc, shut down the virtual Windows machine, change the variable NET to read:

NET="-net nic,model=virtio,macaddr=$NIC1MAC,vlan=0 -net tap,vlan=0,ifname=tap0,script=no"

and then boot Windows again

$ kvm-windows -cdrom NETKVM-20081229.iso

when Windows asks for a driver for the new network interface device, point to the CD-ROM.

Virtualbox: Installing guest additions

Shut down the virtual Windows machine, then from the shell run

$ VBoxManage modifyvm "Windows" --dvd /usr/share/virtualbox/VBoxGuestAdditions.iso

Boot Windows again

$ VBoxManage startvm Windows -type vrdp

and then connect to the “console”

$ rdesktop localhost:1337

Inside Windows, open the CD-ROM drive and select VBoxWindowsAdditions.exe and follow the instructions.

Configuring and tuning Terminal Services

Terminal Services is called Remote Access in Windows XP – enable it in Start → Control Panel → System → Remote Access.

One downside is that someone needs to log on before XP punches a hole in the firewall. To circumvent this either manually add an exception for the RDP service or simply turn of the firewall (that’s what I did since the host will be protected by the host’s firewall as well as the NAT feature of VirtualBox).

One of the more annoying limitations in Windows XP is that the color depth by default is limited to 16 bits.

To change this open the Group Policy Editor (Start → Run → gpedit.msc) and navigate to Administrative Template → Windows Components → Terminal Services and change the limit:

There are a few other parameters one can change, feel free to poke around.

To be able to connect to the Windows machine using RDP you need to set a password for the user you wish connect as.

Assign a static IP to your virtual machine, this will make it easier to create the scripts further down in this article.

Install and configure SeamlessRDP

The main component in this setup is SeamlessRDP which allows one to launch a single application using RDP (remote desktop) and open only the window of that application. The drawback (with Windows XP) is that you are only allowed to open one session which means you can only launch one application at the same time.

Luckily someone grew tired of this and has made a patch to both rdesktop and SeamlessRDP that makes it possible to launch more than one application over the same SeamlessRDP session.

Installing rdesktop from CVS

First make sure that you have all the required packages for building rdesktop

$ sudo apt-get build-dep rdesktop cvs

Download rdesktop from CVS

$ cvs -d:pserver:[email protected]:/cvsroot/rdesktop login
$ cvs -z3 -d:pserver:[email protected]:/cvsroot/rdesktop co -P rdesktop

Download the patch to the checked out source

$ cd rdesktop<br /> $ wget http://www.fontis.com.au/system/files/rdesktop.patch

Patch the source

$ patch -p2 < rdesktop.patch

Compile the source and install (install it as rdesktop-cvs to not interfere with the Ubuntu package)

$ ./bootstrap
$ ./configure
$ make
$ sudo make install
$ sudo mv /usr/local/bin/rdesktop /usr/local/bin/rdesktop-cvs

Installing the Windows component

Download the updated SeamlessRDP program and unpack it to c:\seamlessrdp inside the virtual machine.

Making it all come together

To ease the execution of Windows programs I’ve created a small script called $HOME/bin/winrun:

What this script does it to check for a socket file; if it does not exist rdesktop connects the same way as the standard client. If it does exist rdesktop uses the socket and the existing connection to create another window.

Similarly I have a script to connect to the Windows desktop when I need to do some maintenance

#!/bin/bash

RHOST="192.168.10.10"
VM="Windows"

rdesktop -k da -u <username> -p <password>  -g 90% -T $VM -z -x b $RHOST

Sharing data between the host and guest

When running KVM

Remote Desktop resource redirection

This is the easiest way of sharing data but it has some drawbacks.

Enable it by adding this to RDESKTOP_ARGS in winrun: -r disk:Home=$HOME

This will make your entire home directory available to your virtual machine but only when you are connected and not with an assigned drive letter.

Samba

One could also use a Samba server on the host (for better performance when transfering files)

$ sudo apt-get install samba

By default the section in /etc/samba/smb.conf concerning home directories is commented out

[homes]
   comment = Home Directories
   browseable = no
   read only = no
   create mask = 0700
   directory mask = 0700
   valid users = %S

Be sure to reload the Samba service

$ sudo service samba reload

Then map the home share inside the virtual machine

net use h: \\192.168.1.1\username

When running Virtualbox

The same methods can be used as with KVM but it is a lot smarter to use Shared Folders.

Shut down the virtual machine then run (in a shell on the host):

$ VBoxManage sharedfolder add "Windows" --name Home --hostpath $HOME

Boot Windows again

$ VBoxManage startvm Windows -type vrdp

and then connect to the “console”

$ rdesktop localhost:1337

Inside Windows, run the following command to map the shared folder

net use h: \\vboxsrv\home

Tips and tricks

Running Explorer in seamless mode

If you try to run explorer.exe using the winrun method you will get the entire desktop. This is because the first explorer.exe launched will be always be used as the “shell” (or desktop).

To get around this, download Litestep, install it and set it as the shell for Windows. Now you are able to run explorer.exe and only get the file manager window presented in Linux.

Running any Windows program as a service

This might come in handy if you need a particular program running (this could be an VPN client needed to access resources from within Windows). In my example I will use the Aventail Connect Client.

Install and configure the program you wish to run as a service. Make sure it works as expected.

Download svcany.zip and unpack in your virtual machine. This example uses C:\srvany

Create a new service

c:\srvany\instsrv "Aventail Connect Client" c:\srvany\srvany.exe

Open regedit (Start → Run → regedit) and nagivate to HKEY_LOCAL_MACHINE → System → CurrentControlSet → Services → Aventail Connect Client.

Add a new key (Edit → New → Key) called Parameters and under this new key add a new string called Application with the content C:\Program Files\Aventail\Connect\as32.exe (this string has to match your program).

That’s it.

Errors (and fixes)

A comment in one of the old articles asked:

When I run winrun I get this error:

VirtualBox Command Line Management Interface Version 2.1.4_OSE
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.

[!] FAILED calling a->virtualBox->OpenRemoteSession(a->session, uuid, sessionType, env, progress.asOutParam()) at line 2731!
[!] Primary RC = NS_ERROR_INVALID_ARG (0×80070057) – Invalid argument value
[!] Full error info present: true , basic error info present: true
[!] Result Code = NS_ERROR_INVALID_ARG (0×80070057) – Invalid argument value
[!] Text = Invalid session type: ‘vrdp’
[!] Component = Machine, Interface: IMachine, {ea6fb7ea-1993-4642-b113-f29eb39e0df0}
[!] Callee = IVirtualBox, {339abca2-f47a-4302-87f5-7bc324e6bbde}
/home/george/bin/winrun: line 22: 4422 Segmentation fault $RDESKTOP $RDESKTOP_ARGS -s “$SRDP $*” $RHOST

That is because you are using the Open Source Editition (OSE) of Virtualbox which does not have a RDP server build in.