vsphere-esxi-vcenter-server-51-security-guide(3)

receive data from outside sources. For example, the company uses External

Network 1 to receive FTP traffic from vendors and allow vendors access to data

stored on externally available servers though FTP. In addition to servicing

Virtual Machine 1, External Network 1 services FTP servers configured on

different ESXi hosts throughout the site.

16 VMware, Inc.

Chapter 1 Security for ESXi Systems

Because Virtual Machine 1 does not share a virtual switch or physical network

adapter with any virtual machines in the host, the other resident virtual

machines cannot transmit packets to or receive packets from the Virtual

Machine 1 network. This restriction prevents sniffing attacks, which require

sending network traffic to the victim. More importantly, an attacker cannot use

the natural vulnerability of FTP to access any of the host’s other virtual

machines.

Internal virtual machines Virtual Machines 2 through 5 are reserved for internal use. These virtual

machines process and store company-private data such as medical records,

legal settlements, and fraud investigations. As a result, the system

administrators must ensure the highest level of protection for these virtual

machines.

These virtual machines connect to Internal Network 2 through their own virtual

switch and network adapter. Internal Network 2 is reserved for internal use by

personnel such as claims processors, in-house lawyers, or adjustors.

Virtual Machines 2 through 5 can communicate with one another through the

virtual switch and with internal virtual machines elsewhere on Internal

Network 2 through the physical network adapter. They cannot communicate

with externally facing machines. As with the FTP server, these virtual machines

cannot send packets to or receive packets from the other virtual machines’

networks. Similarly, the host’s other virtual machines cannot send packets to

or receive packets from Virtual Machines 2 through 5.

DMZ Virtual Machines 6 through 8 are configured as a DMZ that the marketing

group uses to publish the company’s external Web site.

This group of virtual machines is associated with External Network 2 and

Internal Network 1. The company uses External Network 2 to support the Web

servers that use the marketing and financial department to host the corporate

Web site and other Web facilities that it hosts to outside users. Internal Network

1 is the conduit that the marketing department uses to publish content to the

corporate Web site, post downloads, and maintain services like user forums.

Because these networks are separate from External Network 1 and Internal

Network 2, and the virtual machines have no shared points of contact (switches

or adapters), there is no risk of attack to or from the FTP server or the internal

virtual machine group.

By capitalizing on virtual machine isolation, correctly configuring virtual switches, and maintaining network separation, the system administrator can house all three virtual machine zones in the same ESXi host and be confident that there will be no data or resource breaches.

The company enforces isolation among the virtual machine groups by using multiple internal and external networks and making sure that the virtual switches and physical network adapters for each group are

completely separate from those of other groups.

Because none of the virtual switches straddle virtual machine zones, the system administrator succeeds in

eliminating the risk of packet leakage from one zone to another. A virtual switch, by design, cannot leak packets directly to another virtual switch. The only way for packets to travel from one virtual switch to another is under the following circumstances:

n The virtual switches are connected to the same physical LAN.

n The virtual switches connect to a common virtual machine, which could be used to transmit packets.

Neither of these conditions occur in the sample configuration. If system administrators want to verify that no common virtual switch paths exist, they can check for possible shared points of contact by reviewing the

network switch layout in the vSphere Client.

VMware, Inc. 17

To safeguard the virtual machines’ resources, the system administrator lowers the risk of DoS and DDoS attacks by configuring a resource reservation and a limit for each virtual machine. The system administrator further protects the ESXi host and virtual machines by installing software firewalls at the front and back ends of the DMZ, ensuring that the host is behind a physical firewall, and configuring the networked storage resources so that each has its own virtual switch.

Security Resources and Information

You can find additional information about security on the VMware Web site.

The table lists security topics and the location of additional information about these topics.

Table 1-1. VMware Security Resources on the Web

Topic Resource

VMware security policy, up-to-date security

alerts, security downloads, and focus

discussions of security topics

b54cec67b84ae45c3b358c66/security/

Corporate security response policy b54cec67b84ae45c3b358c66/support/policies/security_response

VMware is committed to helping you maintain a secure environment.

Security issues are corrected in a timely manner. The VMware Security

Response Policy states our commitment to resolve possible

vulnerabilities in our products.

Third-party software support policy b54cec67b84ae45c3b358c66/support/policies/

VMware supports a variety of storage systems, software agents such as

backup agents, system management agents, and so forth. You can find

lists of agents, tools, and other software that supports ESXi by searching

b54cec67b84ae45c3b358c66/vmtn/resources/ for ESXi compatibility

guides.

The industry offers more products and configurations than VMware can

test. If VMware does not list a product or configuration in a compatibility

guide, Technical Support will attempt to help you with any problems,

but cannot guarantee that the product or configuration can be used.

Always evaluate security risks for unsupported products or

configurations carefully.

General information about virtualization and security VMware Virtual Security Technical Resource Center b54cec67b84ae45c3b358c66/go/security/

Compliance and security standards, as well as

partner solutions and in-depth content about

virtualization and compliance

b54cec67b84ae45c3b358c66/go/compliance/

Information about VMsafe technology for protection of virtual machines, including a list of partner solutions b54cec67b84ae45c3b358c66/go/vmsafe/

vSphere Security

18 VMware, Inc.

Securing ESXi Configurations2 You can take measures to promote a secure environment for your ESXi hosts, virtual machines, and iSCSI

SANs. Consider network configuration planning from a security perspective and the steps that you can take to protect the components in your configuration from attack.

This chapter includes the following topics:

n“Securing the Network with Firewalls,” on page 19

n“Securing Virtual Machines with VLANs,” on page 24

n“Securing Standard Switch Ports,” on page 29

n“Internet Protocol Security,” on page 30

n“Securing iSCSI Storage,” on page 34

n“Cipher Strength,” on page 36

n“Control CIM-Based Hardware Monitoring Tool Access,” on page 36

Securing the Network with Firewalls

Security administrators use firewalls to safeguard the network or selected components in the network from intrusion.

Firewalls control access to devices within their perimeter by closing all communication pathways, except for those that the administrator explicitly or implicitly designates as authorized. The pathways, or ports, that

administrators open in the firewall allow traffic between devices on different sides of the firewall.

I MPORTANT The ESXi firewall in ESXi 5.0 does not allow per-network filtering of vMotion traffic. Therefore,

you must install rules on your external firewall to ensure that no incoming connections can be made to the vMotion socket.

In a virtual machine environment, you can plan your layout for firewalls between components.

n Physical machines such as vCenter Server systems and ESXi hosts.

n One virtual machine and another—for example, between a virtual machine acting as an external Web server and a virtual machine connected to your company’s internal network.

n A physical machine and a virtual machine, such as when you place a firewall between a physical network adapter card and a virtual machine.

VMware, Inc. 19

vSphere Security

How you use firewalls in your ESXi configuration is based on how you plan to use the network and how secure any given component needs to be. For example, if you create a virtual network where each virtual machine is dedicated to running a different benchmark test suite for the same department, the risk of unwanted access from one virtual machine to the next is minimal. Therefore, a configuration where firewalls are present between the virtual machines is not necessary. However, to prevent interruption of a test run from an outside host, you might set up the configuration so that a firewall is present at the entry point of the virtual network to protect the entire set of virtual machines.

Firewalls for Configurations with vCenter Server

If you access ESXi hosts through vCenter Server, you typically protect vCenter Server using a firewall. This firewall provides basic protection for your network.

A firewall might lie between the clients and vCenter Server. Alternatively, vCenter Server and the clients can

搜索“diyifanwen.net”或“第一范文网”即可找到本站免费阅读全部范文。收藏本站方便下次阅读，第一范文网，提供最新实用文档vsphere-esxi-vcenter-server-51-security-guide(3)全文阅读和word下载服务。