Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On our network (1.0/24) we have a number of servers. One of those servers is running VMware ESX with three virtual machines which are hosting various websites and applications to the outside world.

Currently the server and each of the VM's have their own local IP address on the same subnet and physical switch as the rest of the network.

I am wondering about the security implications of this. I want to be safe in the knowledge that I haven't left any gaping security holes open. I presume that because the VM's are online and are advertised online that it wouldn't take much effort to trace the local IP and instantly see the other devices (assuming the intruder had a reasonable level of skill & knowledge).

I know that the Netgear prosafe switches that we use support VLANS, and I know the Draytek Vigor 2820 router we use supports both VLANS and a second subnet(?).

I am wondering what the "normal" solution would be and if I need to go as far as setting VLANS up or whether some firewall rules could do this?

share|improve this question

4 Answers 4

up vote 2 down vote accepted

I'm not sure if you're asking for general guidance on locking systems down or asking if anything special has to take place because of the virtualisation, so I'm going to try and address both issues.

Nothing magical happens here, either good or bad, just because these machines are virtual guests; how would you secure the machines if they were physical servers? Ok then, you still do that (and my version of "that" is outlined below).

Each virtual guest should be secured as you would normally, and you should be wary of hosting any software on the internet-facing virtual machines that expose the workings of the virtual hosts (for example, don't install the VMWare management console on one of them, don't directly expose the virtual server storage, etc).

What typically should happen is that you protect your servers via a firewall with a "default deny"(1) policy that only exposes the services you wish to expose to the Internet. If you haven't got a decent firewall and/or you haven't configured it in a "default deny" configuration then you need to do this right now.

With that done, you now have a minimal "attack surface", which means you can concentrate most of your energy on securing and monitoring and patching these services that have been exposed to the outside world.

Your virtual hosts should remain secure because you've only exposed a few services on a few virtual guests, so the IP addresses of the virtual hosts themselves are not exposed to the Internet.

Having said all that, it's not a bad idea to use the VLAN facility you mention to place the IP addresses you're exposing for the internet facing virtual guests in their own isolated vlan away from any management interfaces for the virtual hosts and any other servers/infrastructure you may have.

It may also be worth considering tools like tripwire to monitor your systems for changes, if you're worried.

(1) Default Deny is a firewall policy/set of rules that ensures that everything is blocked by default and that you only open the ports/services that you need to open. This should ensure that only the services that absolutely need to be exposed are exposed, and while it is not a security panacea, it does greatly improve your chances of keeping your servers and your network secure.

share|improve this answer
    
Thanks for the answer. I have configured a Deny All rule on the main (only) router firewall and also on the Ubuntu server (within a VM). I believe in terms of firewalls I have done all I can (with my level of knowledge at least!). Tripwire looks good, perhaps a little overkill for our needs but time will tell. –  dannymcc Dec 11 '11 at 20:35
    
@dannymcc tripwire may well be overkill, but its nice to know about it and make your own choice, I think. It sounds like you're doing everything right to me. –  RobM Dec 11 '11 at 21:18
    
Yeah fair comment. Thanks, appreciate your time. –  dannymcc Dec 11 '11 at 21:21

You should secure your VMWare-server. It should be accessible only via a physically separated backend admin-network. The networks provided should not be used on that server (i.e. don`t put any IP there).

VMWare had some weaknesses regarding access of graphics memory that could lead to priviledge escalation up the point where you executed code on the VMWare-server instead of the virtual hosts.

I did not see any usable too that can track those kind of attacks - especially if they are RAM-based and non-persistent (tripwire will not see any file change there). But perhaps you can closely watch what the VMWare-server-processes do...

share|improve this answer
    
The VMWare server has a local IP address but has no route from the outside world. The individual VM's do have a public address. –  dannymcc Dec 12 '11 at 11:55

When you have a properly firewall between the internet, and your local network, nobody can access your other services/computers, unless some kind of exploit is found in the firewall or your publicly available services.

You could try keeping your Virtual servers NICs on some other VLAN than your "management" network.

share|improve this answer

Apart from the suggestions above, why not having several network zones with specific purpose: App, DB or based on customer zone with firewall separating them. In this way, any compromise in one server would not result in compromise of another server.

Once you setup this, you push down this network zoning to the ESX host. One network zone corresponds to 1 NIC (or 2 NIC for teaming) in the ESX host. Naturally, your virtual machines would enjoy the same benefit of this network isolation too.

share|improve this answer
    
Am I correct in saying a network zone == vlan? –  dannymcc Dec 13 '11 at 0:44
    
Yes, by using vlan, you create new network zone. –  Niko Gunadi Dec 13 '11 at 22:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.