For the past few months I have been looking at KVM virtualization on Red Hat Enterprise Linux and CentOS and just recently started looking at KVM security. I have a small deployment in my lab with a few Dell PowerEdge servers, EqualLogic iSCSI storage and several Linux Virtual Machines (VMs), and even though security is not a major concern in a lab environment, I learned a few interesting things about KVM virtualization security that I’d like to share with you.
Security in a virtualized environment can be divided into three different components: Hypervisor (physical server) security, VM security and remote management security. Because hypervisor and VM security are beyond the scope of this blog, I will just provide a brief overview for them and instead focus on a couple of easy methods to provide secure remote management.
Hypervisor security involves restricting access to the virtualization host and should be no different than for non-virtualized hosts. The usual tools can be used to secure a KVM host, including iptables and SELinux. You can implement additional measures such as isolating VM network traffic from the hypervisor’s, thus limiting the hypervisor’s exposure from external attacks. Hypervisor security is critically important, because if a hypervisor is compromised, then all VMs running on it can be compromised as well.
VM security encompasses not just securing the OS running on the VMs (which would be no different than a physical host) but also securing the VM images from within the hypervisor. Because VM images are accessible from the hypervisor either on local or remote storage, measures should be taken to secure VM images just like any other sensitive data. There are different options available, including VM image encryption and the sVirt service.
Remote management security
Remote management involves managing virtual resources (storage and VMs) on KVM hosts remotely. Remote management can be very useful when you want to delegate management of the virtualized environment to other users without granting login access to the KVM hypervisor.
The libvirtd daemon is responsible for managing all virtual resources on a KVM host, and there are client tools, such as ‘virsh’ and ‘virt-manager’ that can interact with it remotely. To find out more about how to use a couple of methods for connecting securely to libvirtd, please read the full article in the Dell TechCenter Wiki.
To post a comment
login or create an account