I have a need to run multiple 2008 R2 VMs under the free esxi. Storage will be local to the host. As I understand it, BitLocker is not a supported option in a VM environment from either Microsoft or VMware's perspective.
What are my options?
6
-
Since you run your VMs on free ESXi, support is obviously completely unimportant to you. So why ask this question?– Mario LenzAug 24, 2014 at 19:43
-
Just to clarify my point of view: If you have non-BitLocker problems on free ESXi, you don't have support. So why bother about support when there are BitLocker problems?– Mario LenzAug 24, 2014 at 20:20
-
Getting support from Microsoft or VMware is not the issue; however, finding a practical (and inexpensive) option that will work to satisfy encryption requirements is. It appears per what I've read elsewhere that Bitlocker can work, I was wondering what other solutions were possible.– KendorAug 24, 2014 at 20:47
-
A few months ago I would have said truecrypt...but now I don't know what to recommend.– GrantAug 25, 2014 at 0:51
-
Since a VM doesn't have a TPM you understand that you basically must provide some kind of key/password at the time the VM boots? You understand and accept that if the hypervisor is compromised, then potentially the attacker could steal the volume keys and/or decrypted data directly out of memory? I have used bitlocker in testing VMs, it seems to work perfectly fine, but there is no good reason to support or any other FDE solution because of the above 2 issues.– ZoredacheAug 25, 2014 at 1:15
|
Show 1 more comment
1 Answer
If you're looking for an optimal full volume encryption solution, I'm not aware of one. An optimal solution would provide encryption on the host/storage level. This is easy to do with Hyper-V, but not so much with ESX. I'm surprised Microsoft does not use this more in Hyper-V marketing, but the reality is this scenario sadly demonstrates how important security is to most organizations/vendors when it comes to making decisions - not as important as the talk.
When Microsoft and VMWare say that they do not support it, what they mean is you should not use BitLocker at the guest level due to it is not an optimal solution. This is due to it possible to get a memory snapshot of a guest memory using a utility like vss2core.exe, which could facilitate attacking the encryption keys. Not trivial, but definitely something a determined adversary could do.
Otherwise, BitLocker works well on a guest. One caveat is you should not use dynamically expanding disks due to 2008 R2 will encrypt all the data and would instantly max out your disk. You can even put the Startup key (not the Recovery key) on a virtual floppy or the system partition to enable unattended startup. Note that the Startup key does not enable Recovery (aka decryption) of the data. You also need to enable a GPO setting for "Require additional authentication at startup" due to by default you need a TPM chip to enable BitLocker for an operating system volume.
answered Aug 25, 2014 at 11:50
