Effective Web-hosting on Z/Linux Understand the Virtualization Better

Transcription

1 July 2012 Effective Web-hosting on Z/Linux Understand the Virtualization Better

2 2 CONTENTS EXECUTIVE SUMMARY 2 PURPOSE 3 BACKGROUND 3 INFRASTRUCTURE PLANNING FOR VIRTUALIZATION ON SYSTEM Z 4 PREPARING Z/VM & Z/LINUX ON SYSTEM Z 6 WEB-HOSTING ON Z/LINUX SERVER CONSOLIDATION APPROACH 7 WEB-HOSTING ON Z/LINUX FEW SNAPSHOTS OF THE WEBSITE 8 WEB-HOSTING ON Z/LINUX APPROACH AND STEPS [1] 9 WEB-HOSTING APPLICATIONS ON THE INTERNET GUIDELINES 12 WEB-HOSTING APPLICATIONS ON THE INTERNET BENEFITS [2] 12 END NOTE 15 REFERENCES 16 ABOUT THE AUTHOR 16 EXECUTIVE SUMMARY Web-hosting on IBM managed platform (System Z/Linux) through virtualization is an e-business on-demand solution that offers cost effective managed server capacity on an on-demand basis. This whitepaper gives a closer look at how virtualization is done on System Z and thereafter how web-hosting is done on the Z/Linux platform. It also helps in understanding how virtualization and work load management enable server consolidation on the mainframe by running distributed servers. Web-hosting in an IBM managed solution on Z/Linux allows the end customer to replace their physical web, database and application servers with virtual servers running on Linux called as Images under System Z which helps in achieving high utilization levels of 85% or more. This is done through the mainframe speciality engines for improving the server consolidation by connecting different distributed servers in one box and we call it as Data Centre in a box. The main benefits and the reason for web-hosting on IBM managed platform on System Z/Linux is that it helped us: Enable the infrastructure on server consolidation on the mainframe system by consolidating UNIX-based applications on Linux on a mainframe that will help in eliminating numerous UNIX servers (and corresponding human-related management costs)

3 3 Greatly improve the system availability, reliability and security for the applications running on this platform The following activities on Z/Linux were implemented as a part of POC in our Mainframe CoE lab. We have developed a kind of competency which is not found in other companies and is very rare. Each of the virtual images running on System Z/Linux will utilize all the resources such as servers, routers, processors and network in the most efficient way All the virtual Linux Images are completely isolated from within one another on the System Z platform even though they are networked together virtually by Z/VM PURPOSE The purpose of this document is to describe effective webhosting on Z/Linux platform and explain how it helped us in the server consolidation we did as part of POC in our CoE and have implemented the same. The guidelines cover the following areas that can be referred during the implementation phase: Infrastructure planning for virtualization on System Z explained Preparing Z/VM and SUSE Linux on System Z Infrastructure planning for web-hosting applications on Z/Linux platform Guidelines for web-hosting applications on System Z which includes enabling the SSL BACKGROUND Web-hosting on Z/Linux platform includes having the team understand the what, how and why in the Z/Linux environment; why the users need to work in a certain way, why processing must occur in a certain way, how this helps in Z/Linux server consolidation etc. It is important to recognize that users (The Z/OS and Z/VM System Administrator) should have basic administration knowledge on System Z and Linux platform and typical hardware and software information on System Z is needed. Most of the knowledge to be acquired is possessed by the mainframe system administration team who had actually implemented the solutions on the above said platform, thereby gaining more practical knowledge by building this competency through POC in our own HCL mainframe CoE lab. Therefore, it is essential that companies develop an in-depth plan to acquire the information and include the detailed identification and documentation of this knowledge throughout the process.

4 4 INFRASTRUCTURE PLANNING FOR VIRTUALIZATION ON SYSTEM Z Why the mainframe is a good strategic platform for virtualization? Most of the world s leading financial institutions run on mainframes due to their best-in-the-industry reliability, availability and security characteristics. The following are the pre-requisites and the infrastructure setup done prior to the installation of Z/VM and Linux Images which eventually led to the virtualization on System Z/Linux: IFL (Integrated Facility for Linux workloads) is an IBM processor dedicated to running the Linux operating system with z/vm. It is installed and activated for Linux workloads in one of the new LPAR. The reason for having a dedicated LPAR is to ensure that Z/LINUX should not have access to other LPARs on the existing mainframe system Z/LINUX LPAR is created and activated through a new name, PAR partition number, PAR channels and devices are allocated to that LPAR Allocate the memory (RAM) in the new LPAR for Z/Linux and do the allocation of hardware resources through the capacity planning Capacity planning was done in such a way that the Z/Linux Image is a Linux-only mode and has been allocated 6MB for the Linux Image The channel path and TCP /IP are activated through IOCDS (I/O Control Data Set) activation and the profile on System Z Dedicated OSA device with the existing channel port were applied to Z/VM to avoid performance issues and Z/Linux Images were created on top of these OSA channel ports. Each Linux Image will have a dedicated IP on the same network segment where Z/VM resides upon We used dedicated formatted DASD of type MOD3 for storage allocation to Z/VM and Z/Linux Gateway IP, DNS needs to be configured during the infrastructure set up of Z/VM and Z/Linux

5 5 Network Linux1 Gateway Server z/vm TCP/IP Linux2 z/vm Fig 1.1: Network Architecture of Z/VM and Z/LINUX Z/VM version 5.4 z/vm LINUX z/os z/os z/vmz LPAR z/os LPAR L I N U X L I N U X L I N U X z/vm LPAR L I N U X OSA ETHERNET CHANNELS SUSE LINUX 64 BIT zaap CP CP CP CP IFL IFL ziip SMC Z9BC IBM Machine HMC HCLZ9BC MAINFRAME SYSTEM Fig 1.2: HCL Mainframe Architecture involving Z/VM, Z/LINUX and Z/OS The above mentioned diagram is part of the HCL mainframe Infrastructure diagram and was done by the HCL mainframe solutions COE team. We have used OSA express card which is of device type OSD and the link type is QDIOETHERNET From the infrastructure to the operating system, System Z virtualization is done on multiple layers of security that offers protection to the virtual environment. Dedicated firewalls and routers are part of every customer s environment providing isolation from other customers, allowing only necessary internet traffic. As shown in the diagram below, each customer has a dedicated firewall/ router to support their individual security needs:

6 6 Fig 1.3: Linux Instances under Virtual Network Firewall PREPARING Z/VM & Z/LINUX ON SYSTEM Z Z/VM is implemented on System Z to run multiple Linux Images on the existing infrastructure to support various applications to users in a virtualized environment. After IFL (Integrated Facility for Linux) processor is activated on the new LPAR, Z/VM will be installed Z/VM will reside on a separate dedicated IP segment on a dedicated OSA device and OSA channel The new LPAR, named as ZNLA, can have multiple Linux Images residing on the dedicated IPs Open the 3270 console on HMC (Hardware Management Console) and load the Z/VM CD from the CD-ROM by giving /CPDVD command which will take around 6 minutes to Z/VM to boot up from memory and the installation is started All the necessary components of Z/VM are installed during this process as mentioned below in the installation components type Installation Component Type LPAR Name OSA Device Name OSA Device Channel Address Subnet Mask Network Device Type Port Name Gateway IP Address DNS server IP IP Address for FTP server User Name for FTP method Password for the FTP method Z/Linux DASD Volumes Table 1: Installation Components for Z/Linux

7 7 WEB-HOSTING ON Z/LINUX SERVER CONSOLIDATION APPROACH 64% of the Top100 System Z clients are running Linux on mainframes and more than 3000 applications are available for Linux on System Z. Fig 1.4: Z/Linux server consolidations on System Z In one of our practical experiences, web-hosting Java-based applications on System Z/Linux was done through the virtualization on Z/VM and it eventually lead to server consolidation on System Z. The Linux web server offers the power and bandwidth for hosting the web-based applications on the internet without any cost involved. We have added additional security features such as anti-virus scanner for Linux which detects all vulnerabilities for the application hosted on internet and SSL-based encryption by protecting customer data and their transactions. The Linux web server is based on the Apache Plat web server. What were the tools used for porting the web-based applications on System Z/Linux? Apache Tomcat An open source software implementation of the Java Servlet and Java Server pages technologies. Download the Apache Tomcat from the open source and install the version applicable to System Z on the type of Linux-based OS (For Example: SUSE / Red Hat) and install the software We installed the SSH Client, Putty telnet software to connect to the Linux Image

8 8 Installation of Java (SDK Software Development Kit) is needed to have Java Run-time Environment (JRE) to run Java-based applications and applets through Apache Tomcat web server. Moving Java applications to Linux platform is quite straightforward as mentioned below The latest version of JAVA SDK is available on Sun s Java website CLAM AV product An anti-virus open source tool kit for Linux-based applications designed especially for scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates The following procedures need to be done for running Java-based applications on Apache Tomcat web server in the Linux OS: Step 1: JAVA_HOME= /path/to/your/java/installation/ directory Step 2: export JAVA_HOME Step 3: Start Tomcat, go to /home/tomcat/tomcat/conf/catlina.sh Step 4: If setup is fine then your telnet to port 8080 should connect by browsing through and the default welcome page will appear. Tomcat by default runs on port 8080 Step 5: As a final test, see if you can login to the Tomcat manager application, which lets you manage your application by going through and login using the credentials of the admin user that was added in the tomcat-users. xml file Installation of VS FTP VSFTP is a licensed FTP server for Linux and its secure and extremely fast. It uses normal, unencrypted usernames and passwords for authentication WEB-HOSTING ON Z/LINUX FEW SNAPSHOTS OF THE WEBSITE Snapshot of the website hosted on the internet

9 9 WEB-HOSTING ON Z/LINUX APPROACH AND STEPS [1] The https certificate needs to be deployed on the URL which is being hosted on the internet. The SSL certificate needs to be an authorized for the certified vendor such as VeriSign. The SSL protocol aims to provide solutions to two simple security problems: How can we securely transmit data between two parties in such a way that only the two parties can read it? How can one (or more) of the parties involved prove that they are actually the entity we want to grant the ability to decrypt our encrypted transmission? Setting up SSL for Tomcat can be divided into two main tasks: Creating a functional key store Configuring the Tomcat connectors and applications Step 1: Creating a key store A key store is a place where the cryptographic keys and certificates can be stored. It is created as a file and can be used to store the SSL keys and certificates for Tomcat for SSL communications. You can create a new key store using the program called key tool which comes along with the JDK. Issue the following command (highlighted in yellow) to create a new key store: $JAVA_HOME/bin/keytool -genkey -alias [youralias] -keyalg RSA -keystore [/preferred/keystore/path] Note: Before issuing the command set appropriate paths needed (highlighted in blue) Remove the [] brackets while issuing the above command Ensure whether the path of program key tool is correct In the preferred key store path you should enter the filename with the extension.jks as shown below Use an alias and path of your choice Ex: /opt/ibm/java-s390x # jre/bin/keytool genkey alias tomcat keyalg RSA keystore /opt/ibm/java-s390x/keystore.jks

10 10 Step 2: Once you issue the above command it will ask for the key store password Enter a password of your choice (Do not forget it) After this it will ask for the information like NAME, COMPANY NAME, CITY, STATE etc. Fill in whatever details is needed. Please give the accurate details as you have to submit this to CA to obtain the certificate. NAME should be the name of the URL which you like to host under https protocol. In our case, we gave modernmainframe.hcl.com Finally it will ask for key password. Press Enter without entering anything Check for the key tool program and if it resides in JRE/bin folder specify the same and it will be created in the path specified as shown below: Creating a Certificate Signing Request (CSR): As discussed earlier, you can use the same key tool program to generate a CSR file too. Issue the following commands: $JAVA_HOME/bin/keytool -certreq -keyalg RSA -alias [youralias] -file [yourcertificatname].csr -keystore [path/to/your/keystore] Note: Enter an alias and certificate name of your choice Remove [] brackets Specify key store path along with filename and extension

11 11 On successful execution, you will get a file called modernmf.csr in the path specified above. This file is submitted to CA (Certification Authority) for obtaining the certificate. CA will provide the certificate files with extension.cer which has the root certificate as well. Importing the certificate to local key store and installing the new certificate: As we now have both the new certificate and CA certificate, FTP both the certificates into Linux From the new certificate export the root certificate and issue the following command: keytool -import -alias root keystore [path/ to/your/keystore]-trustcacerts-file [path/to/the/root certificate] Note: Remove [] brackets Specify the keystore path with filename and extension Specify the root certificate path with extension Example: /opt/ibm/java-s390x # jre/bin/keytool -import -alias rootca -keystore /opt/ibm/java-s390x-60/keystore.jks -trustcacerts -file / opt/ibm/java-s390x-60/rootcert.cer It will prompt for SSL password. Give the password which you gave earlier It will ask a message to trust the certificates. Type Yes The certificate will be updated once it is done

12 12 WEB-HOSTING APPLICATIONS ON THE INTERNET GUIDELINES Following are the guidelines used for the web-hosting applications on the internet and the applications that reside on the Z/Linux platform: A valid SSL certificate needs to be deployed on the URL The latest web server, application server and DB server is suggested to be used Log Information on User accounting, IP accounting and application access to be tracked per session and must be available Log forwarding to log correlation unit is mandatory for Security Incident Management Session time-out to be kept for the web page as default when it is idle for some time Authentication mechanism to be made available in the application for the web page which is being hosted on the internet for security reasons Implementation of password policy for all user accounts that exists in the application must be implemented Application needs to be secured before it is being hosted on the internet and hence testing the application (Vulnerability Testing) plays a major role here. The contents of the application need to be thoroughly verified and to make sure that not much companies confidential data are being shared The necessary bandwidth needs to be allocated for the application which is hosted on the internet WEB-HOSTING APPLICATIONS ON THE INTERNET BENEFITS [2] The following are the benefits for web-hosting applications on the internet as well as on the server consolidation approach. According to the study done by IBM, It has helped them in server consolidation on the mainframe system by consolidating Linux based workloads for the applications running on a mainframe platform. This study done by IBM was taken from IBM case studies and success stories. IBM had done some marketing and research on server consolidation with 62 Linux servers and consolidated to one IFL which resulted in reduction in licensing costs, labour costs. The below details were taken by IBM s findings on Mainframe Total Cost of ownership issues

13 13 Example: $5,000 = $310,000 this is for 62 Linux Servers For one IFL processor with high Utilization, 1@ $125,000 = $125,000 It also helps in eliminating numerous LINUX/ UNIX servers (and corresponding human-related management costs) which involves system administration tasks on the Linux servers It will greatly improve the system availability, reliability and security for the applications running on this platform Optimized for Linux environment to have open source tools on System Z environment with good management interface Maintenance is easy for handling various issues in a single box (System Z/Linux) since it is developed under the virtualization concept Support for z/linux administration to support all the open source products for web-hosting is easy High Availability since it is under System Z hardware without down-time and no threats to security Lower TCO in terms of infrastructure setup and other software licensing costs as well How other speciality engines make server consolidation more attractive and their advantages are: Speciality Engines ziip, zaap and IFL reduce the operating costs to a great extent as IBM does not charge any license fees for MIPS consumption on these processors. As z/linux runs on IFL, there is no recurring MIPS cost for the applications running on z/linux. Special assist processors for System Z are: For Java workloads (zaap) The Web Sphere application server using zaap processor on the mainframe is cheap when used in the distributed environment along with the software licensing costs and server maintenance costs For example, consolidating at least up to 85% new Web Sphere applications and Java workloads on the mainframe lowers the cost of acquisition such as operating costs, hardware, MIPS and TCO costs.for selected DB2 workloads, (ziip) processor is used in parallel queries (Data Warehouse scenario) where we can have up to 40% workloads to be ziip-able. Also, in Database server scenarios where workloads are high it can be ziip able for queries received via DRDA remote access protocol Offloads to speciality processors reduce software load and charges on general purpose processors

14 14 Economics of Offloading The following considerations contribute to server proliferation when they are offloaded: De-multiplexing of applications to dedicated servers: One application workload per server group Peak-to-average provisioning yields low utilization Additional provision for expected growth in out years (no capacity on demand) Batch workload may stress I/O capabilities Separate servers for production, failover, development/test, disaster recovery Infrastructure servers for systems management Processing comparisons: Language expansion (CICS/COBOL path lengths are highly optimized) Conversion factor (MIPS to TPM-C or RPE) worsens as I/O rates increase Oracle RAC inefficiencies compared to DB2 Other TCO considerations 3 5 year lifetime for distributed servers requires repurchase Dual environments during migration Partial offloads eliminate the lowest cost MIPS first As mentioned below, the table shows how the customers have been benefited while consolidating to z/linux and this is taken from IBM s success stories and case studies. All information from table 2 has been obtained from IBM website.

15 15 US-based bank Customer US-based insurance and financial services company with revenue of US$21 billion Bank in Russia An IT Corporation with revenue of EUR 6 billion Europe s leading independent provider of IT infrastructure services with revenue of GBP 2 billion Benefits achieved on consolidating to z/linux Moving to SUSE Linux Enterprise Server on System Z, helped achieve US$1.8 million in the first year and an estimated US$9.6 million through Achieved US$15 million cost savings over three years by consolidating workloads onto its virtualized infrastructure. By consolidating to IBM System Z 9 EC running z/os and z/linux, the bank saves $400 million per year. Running multiple Linux environments on a single ELS can potentially reduce the TCO by up to 80%, compared to a traditional distributed x86 environment. The ELS can host thousands of virtual Linux environments within a single physical footprint improving energy efficiency by up to 90% and supporting Green IT objectives. Powerful IBM Integrated Facility for Linux (IFL) processors reduce the cost of per-processor licensed software (such as Oracle) by up to 97%. IBM z/vm enables new Linux environments to be provisioned in minutes with no need to procure new hardware, increasing enterprise agility. END NOTE Table 2: IBM customer success stories on Z/Linux server consolidation Defining a long-term vision and the roadmap for its execution are the utmost priorities for any CIO. This can be achieved only if the CIOs and IT managers outsource the IT work of legacy applications to a service provider. This gives them more bandwidth to work on strategic things. To make the outsourcing model successful for legacy applications, knowledge acquisition by the service provider becomes an important activity in outsourcing. It should be planned and executed to ensure that coverage is complete and the model is risk free and cost effective.

16 16 REFERENCES Figure The online z/vm Library Figure 1.2 The source is taken from HCL Mainframe Solutions COE team Figure Figure The online z/vm Library Table 1 This source is taken from the red book of IBM: Linux for IBM zseries and S/390: Distributions Table 2 [1] Web-hosting on Z/Linux Approach and Steps [2] Web hosting Applications on the internet Benefits ABOUT THE AUTHOR Praveen Edward Jaikumar is part of the Mainframe Solution CoE team, leading the team in Modern Mainframe and Administration. He has 12 years of experience in various areas of System Administration on Z/OS, Z/VM and Z/Linux. In the past, he has worked in several large engagements on Mainframe Infrastructure planning, administration of the project in Systems operations and administration sort projects across various technologies.

17 17 About HCL About HCL Technologies HCL Technologies is a leading global IT services company, working with clients in the areas that impact and redefine the core of their businesses. Since its inception into the global landscape after its IPO in 1999, HCL focuses on transformational outsourcing, underlined by innovation and value creation, and offers integrated portfolio of services including software-led IT solutions, infrastructure management, engineering and R&D services and BPO. HCL leverages its extensive global offshore infrastructure and network of offices in 26 countries to provide holistic, multiservice delivery in key industry verticals including Financial Services, Manufacturing, Consumer Services, Public Services and Healthcare. HCL takes pride in its philosophy of Employees First, Customers Second which empowers our 82,464 transformers to create a real value for the customers. HCL Technologies, along with its subsidiaries, has reported consolidated revenues of US$ 4.0 billion (Rs. 19,412 crores), as on 31 March 2012 (on LTMbasis). For more information, please visit About HCL Enterprise HCL is a $6.2 billion leading global technology and IT enterprise comprising two companies listed in India - HCL Technologies and HCL Infosystems. Founded in 1976, HCL is one of India s original IT garage start-ups. A pioneer of modern computing, HCL is a global transformational enterprise today. Its range of offerings includes product engineering, custom & package applications, BPO, IT infrastructure services, IT hardware, systems integration, and distribution of information and communications technology (ICT) products across a wide range of focused industry verticals. The HCL team consists of over 90,000 professionals of diverse nationalities, who operate from 31 countries including over 500 points of presence in India. HCL has partnerships with several leading global 1000 firms, including leading IT and technology firms. For more on HCL, please visit