0

Lets say I have a large system made up of many VMs running on one bare metal esxi box. Each of these VMs are running application(s) that are necessary for the system. I do not have the ability to change some of the applications, and changing the others would be difficult. Many of these applications send passwords around in clear text, you know, like you do.

I would like to explore a system wide solution. Can an ESXi hypervisor be configured so that all "virtual" ip traffic between these virtual machines is encrypted?

I don't mean changing the VM Guest operating systems to use ssl or anything like that (if possible to avoid). Rather I want ESXi to handle encrypting and decrypting data between these virtual NICs; or any other solution that sufficiently hide this data.

3 Answers 3

3

Can an ESXi hypervisor be configured so that all "virtual" ip traffic between these virtual machines is encrypted?

No, but it's a switch not a hub, not on its own anyway - you could, if you really wanted to be paranoid, use NSX which provides microsegmentation between VMs but that's not encrypted, just firewalling.

1

When you design for security or failures, you should create a list of possible use cases.

For example:

  • I want to protect against malicious/compromised VMs that could listen to the network traffic that is not destined for them.
  • I want to protect that if we discard the HDD (e.g. replace a RAID disk) the data can not be recovered.
  • I want that a compromised web frontend has minimum impact on confidential data in the DB.

Using this kind of thinking will eliminate some solutions that are not increasing the security and they will reveal better ones. To be able to put those questions you need to know the application, how it will be used and what is the target userbase.

If you have the VMs that you want to secure in VLANs where there are no rogue VMs, you might not need SSL encryption between those VMs. May be only some firewall rules would be enough.

For example SSL will not protect you from SQL injection and it could add a bug like was heart-bleed. Adding a firewall will not protect you from a network sniffer but will limit the attack surface.

2
  • Not looking for other solutions, I understand the issue, I'm simply looking for a way to make viewing or intercepting passwords between internal vms to an esxi box not possible.
    – xcalibre
    Mar 29, 2016 at 18:48
  • Or to say it better, en.wikipedia.org/wiki/There_are_known_knowns
    – xcalibre
    Mar 30, 2016 at 15:38
1

The purpose of encrypting Ip traffic is to prevent it from interception and eavesdropping. Traffic between you virtual machines never leaves ESXi host since the ESX virtual switch resides in memory of the host. So, encrypting traffic within ESXi host is pointless in your case.

If you have multiple ESXi hosts and there is a chance that you guest VMs will be running on separate ESXi hosts and this traffic goes over untrusted network segments then you could deploy virtual VPN/Firewall appliances on each ESXi host and route your traffic via VPN links. In all honesty, if you ever need to resort to this solution you probably have bigger problem with overall network design and you should address it first.

5
  • If a VM on the esxi is compromised, then it would be easy for someone to sniff the packets on the fake/virtual vlan. I would like to stop this.
    – xcalibre
    Mar 29, 2016 at 18:52
  • 3
    @xcalibre no it would not. Promiscuous mode is denied by default. kb.vmware.com/selfservice/microsites/…
    – JamesRyan
    Mar 29, 2016 at 20:47
  • 2
    @xcalibre If you don't trust VMware to implement VLANs that can't be forcibly joined by a compromised VM, why would you think they can implement an encrypted link that can't be forcibly joined by a compromised VM?
    – nobody
    Mar 29, 2016 at 21:53
  • because there is no actual wire, esxi is faking a physical layer that we then throw ip on. Unlike an actual piece of copper or glass, they could programaticaly encrypt all traffic on that fake copper.
    – xcalibre
    Mar 30, 2016 at 15:32
  • Essentially, I'm hoping that it is harder to compromise the hypervisor than vms or the router running on the hypervisor. Also, this would solve the problem for all ip traffic on the hypervisor no matter what i have running in there, router, hub, gaming console or ham sandwich.
    – xcalibre
    Mar 30, 2016 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .