VMWare

VMware requirements:

  • ESX & ESXi version 5 and up

  • VMware Workstation

  • VMware Player

Import virtual appliance

  1. Users of CipherMail Professional or Webmail Messenger, should download the VMware virtual machine from https://portal.ciphermail.com. For the community edition, download the VMware version from https://www.ciphermail.com/downloads-virtual-appliance.html.

  2. Unzip the downloaded zip file.

  3. Import the virtual appliance using the tool that comes with your VMware product. For example with the vSphere client, select the menu option “Deploy OVF Template…” and select the ovf file to import.

  4. To prevent swapping because of memory overcommitment, reserve all memory for the virtual machine.

Tip

VMWare memory reservation can be set using the following procedure:

  1. Select settings of the virtual appliance

  2. Select resources tab and finally

  3. Select memory and set reservation to the limit based on parent resource pool or current host. For more information on running a JVM on ESX see http://www.vmware.com/resources/techresources/1087

Time synchronization

The virtual appliance keeps its clock in sync with NTP servers using chrony. The VMware Tools (open-vm-tools), which are also installed on the virtual appliance, can synchronize the clock of the virtual machine with the clock of the ESXi host as well. If both are active, and the clock of the ESXi host differs from the NTP time, the two keep correcting the clock towards a different time, and the clock of the virtual appliance can be off by a second or more, ahead or behind, changing over time. A correct clock is required for certificate and CRL validity checks, 2FA codes, and log timestamps.

To prevent this, disable the periodic time synchronization of the VMware Tools, and let chrony keep the time:

  1. Select settings of the virtual appliance (“Edit Settings”).

  2. Select “VM Options” and expand “VMware Tools”.

  3. Uncheck “Synchronize guest time with host”. Newer vSphere versions have two options instead: uncheck “Synchronize time periodically”, and leave “Synchronize at startup and resume” checked.

Alternatively, run the following command on the console of the virtual appliance:

sudo vmware-toolbox-cmd timesync disable

vmware-toolbox-cmd timesync status shows whether the periodic time synchronization is enabled.

Note

The VMware Tools still synchronize the clock with the ESXi host after events such as resuming a suspended virtual machine, reverting to a snapshot or a vMotion migration. Make sure the ESXi host itself synchronizes its clock with NTP (in the vSphere client: select the host, then “Configure”, “System”, “Time Configuration”).

Use chronyc tracking to check the offset of the clock. To correct a large offset immediately, instead of slowly, run:

sudo chronyc makestep