On Fri, Jul 16, 2010 at 3:32 PM, Jonathan Tripathy
<jonnyt@xxxxxxxxxxx> wrote:
> I'm guessing the same risks apply to
Xen as they do
> VMWare?
in general, yes. As for vendor support,
Redhat has been very
responsive in fixing whatever security bug that comes up
(like
http://www.securitytracker.com/alerts/2009/Oct/1022977.html),
so if
you're concerned about that, I suggest using RHEL/Centos and
their
bundled Xen/kernel-xen version (which might be somewhat old,
but
should be sufficient for most uses).
I also suggest you do
whatever security measures you normally do in
your normal, non-virtual
environment. Think of domU as just another
server, and dom0 as
SAN/switch/router/firewall.
For example, if you never bother to rewrite a
SAN's LUN with 0s before
reusing it on another host, then I don't see why you
should bother
writing 0s to an LV that will be used by Xen. Another example,
if
you're comfortable having a single firewall box and switch used by
all
traffic on your network (using vlans), then I don't see why you
should
treat Xen networking differently.
--
Fajar
-----------------------------------------------------------------------------------------------------------------------------------------------------------
Hi Fajar,
I am using CentOS 5.5 with the stock Xen kernel that came with it, however I'm using Xen 3.4.2 from gitco.de - think this is safe enough?
I'm fairly sure that my network setup is secure. I'm using iptables to prevent IP spoofing, and using ebtables to prevent MAC spoofing. A firewall DomU (pfsense) has WAN, LAN, DMZ and PUBLIC interfaces. WAN and PUBLIC are bridged (For the customers' public VMs). The DMZ subnet only allows certain needed incoming ports from the internet (via NAT port forwarding), and outbound is also restricted to what's only needed. The LAN subnet doesn't allow any incoming ports from the internet. Ports between DMZ and LAN are also only open on a "need to" basis. I've been told that since my Public and DMZ bridges in the Dom0 have no IP addresses, it is impossible for the Dom0 to route traffic between them without going through the firewall DomU.
What you think?
Thanks
_______________________________________________ Xen-users mailing list Xen-users@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-users
| Previous by Date: | Re: [Xen-users] Xen Security , Fajar A. Nugraha |
|---|---|
| Next by Date: | Re: [Xen-users] Xen Security , Bart Coninckx |
| Previous by Thread: | Re: [Xen-users] Xen Security , Fajar A. Nugraha |
| Next by Thread: | Re: [Xen-users] Xen Security , Bart Coninckx |
| Indexes: | [Date] [Thread] [Top] [All Lists] |