2

I have a windows server 2008 r2 with 3 hyper-v vm's

  • IIS server
  • Sql server 3 -
  • Mail server

I'm new to networking/server configuration.

I have created a Virtual Network and can see each of the 3 VMs as well as the host on the network.

I can connect from each VM to the host using the admin account.

However, what would be the best (secure) way to create connections/accounts between the VMs, presumabely this shouldn't be done with an admin account but one with lesser priveledges.

For example, to be able to access the SQL Server VM from the IIS server VM?

Improve this question
1
  • There already exists an external network between the host and the VMs. The host server has one NIC.
    – asn1981
    Dec 10, 2009 at 9:28

3 Answers 3

Reset to default
1

You appear to be asking two things here:

  1. providing a secure medium (channel) for the Virtual machines to talk to each other, that other machines in the real physical network cannot eavesdrop.
  2. using least-privileged user accounts to authenticate the connections between the virtual machines, to reduce privilege-based attack surface.

For point 1, in Hyper-V's perspective, you can create either a virtual Internal network or a Private network, then assign a second network adapter to each VM to that network. The difference is the former has a communication channel back to the host (parent partition) while the latter is only between VMs in that private network.

http://www.virtuatopia.com/index.php/Understanding_and_Configuring_Hyper-V_Virtual_Networks

For point 2, if you use a local SAM user account in the IIS web server - which seems to be the case because there is no mention of a domain controller so I assume they do not belong to any AD domain - the same account with same password must be created in the SQL Server server, with the account given the appropriate permissions to login and access the particular database and its objects it is intended for.

Perhaps these pages can help

http://www.informit.com/guides/content.aspx?g=sqlserver&seqNum=24 http://www.informit.com/guides/content.aspx?g=sqlserver&seqNum=35 http://www.informit.com/guides/content.aspx?g=sqlserver&seqNum=220

Improve this answer
0

I would recommend you build a private network within the VM that has no interface cards associated with it, and have all the traffic flow via that internal network.

Improve this answer
1
  • The VMs also need to be able to access the internet. The host server only has 1 connect NIC. SO would this mean creating an external network as well as an internal private network between the hyper-v VMs?
    – asn1981
    Dec 10, 2009 at 9:28
0

Is there a domain involved? If so I highly reccomend that you take a look at setting up domain and server isolation. This allows you to designate which servers and users can talk to any particular server and encrypts all traffic. If you don't have a domain this might be a reason to build one. You also didn;t say if this was production or for testing

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .