I have a CentOS based product I'm looking to distribute it as a virtual machine (VMWare, XEN and KVM) and I have been lately assessing the steps needed to protect the VM. The VM's data shouldn't be accessible to anyone other than authorized people as it contains sensitive data, by this I mean a root password should always be requested or access denied.
Using XEN it was possible to have access to the machine via the following ways:
- By editing the bootloader using the Dom0, therefore defeating any bootloader protections: xe-edit-bootloader -u -p 1
- By adding init=/bin/sh to the VM startup options
Using VMWare you can mount the image on an other system and access the files.
Possibly there are other ways of accessing the machine, my question here is, what are these other ways I should take into consideration and how can I prevent them including the ones I listed above?