vsphere-esxi-vcenter-server-51-security-guide(2)

n ESXi software (hypervisor) in VIB (package) format

n Third-party VIBs

n Third-party drivers

To leverage this capability, your ESXi system must have TPM and TXT enabled. When TPM and TXT are enabled, ESXi measures the entire hypervisor stack when the system boots and stores these measurements in the Platform Configuration Registers (PCR) of the TPM. The measurements include the VMkernel, kernel modules, drivers, native management applications that run on ESXi, and any boot-time configuration options. All VIBs that are installed on the system are measured.

Third-party solutions can use this feature to build a verifier that detects tampering of the hypervisor image, by comparing the image with an image of the expected known good values. vSphere does not provide a user interface to view these measurements.

The measurements are exposed in a vSphere API. An event log is provided as part of the API, as specified by the Trusted Computing Group (TCG) standard for TXT.

vSphere Security

12 VMware, Inc.

Chapter 1 Security for ESXi Systems

Security and Virtual Machines

Virtual machines are the containers in which applications and guest operating systems run. By design, all

VMware virtual machines are isolated from one another. This isolation enables multiple virtual machines to run securely while sharing hardware and ensures both their ability to access hardware and their uninterrupted performance.

Even a user with system administrator privileges on a virtual machine’s guest operating system cannot breach this layer of isolation to access another virtual machine without privileges explicitly granted by the ESXi system administrator. As a result of virtual machine isolation, if a guest operating system running in a virtual machine fails, other virtual machines on the same host continue to run. The guest operating system failure has no effect on:

n The ability of users to access the other virtual machines

n The ability of the operational virtual machines to access the resources they need

n The performance of the other virtual machines

Each virtual machine is isolated from other virtual machines running on the same hardware. Although virtual machines share physical resources such as CPU, memory, and I/O devices, a guest operating system on an inpidual virtual machine cannot detect any device other than the virtual devices made available to it.

Virtual Machine Isolation

Figure 1-2.

Because the VMkernel mediates the physical resources and all physical hardware access takes place through the VMkernel, virtual machines cannot circumvent this level of isolation.

Just as a physical machine communicates with other machines in a network through a network card, a virtual machine communicates with other virtual machines running in the same host through a virtual switch. Further,

a virtual machine communicates with the physical network, including virtual machines on other ESXi hosts,

through a physical network adapter.

VMware, Inc. 13

vSphere Security

Figure 1-3.

Virtual Networking Through Virtual Switches

These characteristics apply to virtual machine isolation in a network context:

n If a virtual machine does not share a virtual switch with any other virtual machine, it is completely isolated from virtual networks within the host.

n If no physical network adapter is configured for a virtual machine, the virtual machine is completely isolated from any physical networks.

n If you use the same safeguards (firewalls, antivirus software, and so forth) to protect a virtual machine from the network as you would for a physical machine, the virtual machine is as secure as the physical

machine.

You can further protect virtual machines by setting up resource reservations and limits on the host. For

example, through the detailed resource controls available in ESXi, you can configure a virtual machine so that it always receives at least 10 percent of the host’s CPU resources, but never more than 20 percent.

Resource reservations and limits protect virtual machines from performance degradation that would result if another virtual machine consumed excessive shared hardware resources. For example, if one of the virtual machines on a host is incapacitated by a denial-of-service (DoS) attack, a resource limit on that machine

prevents the attack from taking up so much of the hardware resources that the other virtual machines are also affected. Similarly, a resource reservation on each of the virtual machines ensures that, in the event of high resource demands by the virtual machine targeted by the DoS attack, all the other virtual machines still have enough resources to operate.

By default, ESXi imposes a form of resource reservation by applying a distribution algorithm that pides the available host resources equally among the virtual machines while keeping a certain percentage of resources for use by other system components. This default behavior provides a degree of natural protection from DoS and distributed denial-of-service (DDoS) attacks. You set specific resource reservations and limits on an

inpidual basis to customize the default behavior so that the distribution is not equal across the virtual machine configuration.

Security and the Virtual Networking Layer

The virtual networking layer includes virtual network adapters and virtual switches. ESXi relies on the virtual networking layer to support communications between virtual machines and their users. In addition, hosts use the virtual networking layer to communicate with iSCSI SANs, NAS storage, and so forth.

The methods you use to secure a virtual machine network depend on which guest operating system is installed, whether the virtual machines operate in a trusted environment, and a variety of other factors. Virtual switches provide a substantial degree of protection when used with other common security practices, such as installing firewalls.

14 VMware, Inc.

Chapter 1 Security for ESXi Systems

ESXi also supports IEEE 802.1q VLANs, which you can use to further protect the virtual machine network or storage configuration. VLANs let you segment a physical network so that two machines on the same physical network cannot send packets to or receive packets from each other unless they are on the same VLAN.

Creating a Network DMZ on a Single ESXi Host

One example of how to use ESXi isolation and virtual networking features to configure a secure environment is the creation of a network demilitarized zone (DMZ) on a single host.

Figure 1-4. DMZ Configured on a Single ESXi Host

External Network Internal Network

In this example, four virtual machines are configured to create a virtual DMZ on Standard Switch 2:

n Virtual Machine 1 and Virtual Machine 4 run firewalls and are connected to virtual adapters through standard switches. Both of these virtual machines are multi homed.

n Virtual Machine 2 runs a Web server, and Virtual Machine 3 runs as an application server. Both of these virtual machines are single-homed.

The Web server and application server occupy the DMZ between the two firewalls. The conduit between these elements is Standard Switch 2, which connects the firewalls with the servers. This switch has no direct

connection with any elements outside the DMZ and is isolated from external traffic by the two firewalls.

From an operational viewpoint, external traffic from the Internet enters Virtual Machine 1 through Hardware Network Adapter 1 (routed by Standard Switch 1) and is verified by the firewall installed on this machine. If the firewall authorizes the traffic, it is routed to the standard switch in the DMZ, Standard Switch 2. Because the Web server and application server are also connected to this switch, they can serve external requests.

Standard Switch 2 is also connected to Virtual Machine 4. This virtual machine provides a firewall between the DMZ and the internal corporate network. This firewall filters packets from the Web server and application server. If a packet is verified, it is routed to Hardware Network Adapter 2 through Standard Switch 3. Hardware Network Adapter 2 is connected to the internal corporate network.

When creating a DMZ on a single host, you can use fairly lightweight firewalls. Although a virtual machine in this configuration cannot exert direct control over another virtual machine or access its memory, all the

virtual machines are still connected through a virtual network. This network could be used for virus

propagation or targeted for other types of attacks. The security of the virtual machines in the DMZ is equivalent to separate physical machines connected to the same network.

VMware, Inc. 15

vSphere Security

Creating Multiple Networks Within a Single ESXi Host

The ESXi system is designed so that you can connect some groups of virtual machines to the internal network, others to the external network, and still others to both—all on the same host. This capability is an outgrowth of basic virtual machine isolation coupled with a well-planned use of virtual networking features.

External Networks, Internal Networks, and a DMZ Configured on a Single ESXi Host

Figure 1-5.

Network 1Network 2Network 2Network 1

In the figure, the system administrator configured a host into three distinct virtual machine zones: FTP server, internal virtual machines, and DMZ. Each zone serves a unique function.

FTP server Virtual Machine 1 is configured with FTP software and acts as a holding area

for data sent to and from outside resources such as forms and collateral

localized by a vendor.

This virtual machine is associated with an external network only. It has its own

virtual switch and physical network adapter that connect it to External

Network 1. This network is dedicated to servers that the company uses to

搜索“diyifanwen.net”或“第一范文网”即可找到本站免费阅读全部范文。收藏本站方便下次阅读，第一范文网，提供最新实用文档vsphere-esxi-vcenter-server-51-security-guide(2)全文阅读和word下载服务。