On Fri, Jul 16, 2010 at 3:32 PM, Jonathan Tripathy
<jonnyt@xxxxxxxxxxx> wrote:
> I'm guessing the same risks apply to
Xen as they do
> VMWare?
in general, yes. As for vendor support,
Redhat has been very
responsive in fixing whatever security bug that comes up
(like
http://www.securitytracker.com/alerts/2009/Oct/1022977.html),
so if
you're concerned about that, I suggest using RHEL/Centos and
their
bundled Xen/kernel-xen version (which might be somewhat old,
but
should be sufficient for most uses).
I also suggest you do
whatever security measures you normally do in
your normal, non-virtual
environment. Think of domU as just another
server, and dom0 as
SAN/switch/router/firewall.
For example, if you never bother to rewrite a
SAN's LUN with 0s before
reusing it on another host, then I don't see why you
should bother
writing 0s to an LV that will be used by Xen. Another example,
if
you're comfortable having a single firewall box and switch used by
all
traffic on your network (using vlans), then I don't see why you
should
treat Xen networking differently.
--
Fajar
-----------------------------------------------------------------------------------------------------------------------------------------------------------
Hi Fajar,
I am using CentOS 5.5 with the stock Xen kernel that came with
it, however I'm using Xen 3.4.2 from gitco.de - think this is safe
enough?
I'm fairly sure that my network setup is secure. I'm using
iptables to prevent IP spoofing, and using ebtables to prevent MAC spoofing. A
firewall DomU (pfsense) has WAN, LAN, DMZ and PUBLIC interfaces. WAN and PUBLIC
are bridged (For the customers' public VMs). The DMZ subnet only allows certain
needed incoming ports from the internet (via NAT port forwarding), and outbound
is also restricted to what's only needed. The LAN subnet doesn't allow any
incoming ports from the internet. Ports between DMZ and LAN are also only open
on a "need to" basis. I've been told that since my Public and DMZ bridges in the
Dom0 have no IP addresses, it is impossible for the Dom0 to route traffic
between them without going through the firewall DomU.
What you think?
Thanks