Virtual Hosting & Virtual Machines

Transcription

1 & Virtual Machines Coleman Kane September 2, 2014 Cyber Defense Overview / Machines 1 / 17

2 Similar to the network partitioning schemes described previously, there exist a menu of options that enable a single piece of server hardware to be paritioned so as to provide varying levels of isolation to the applications and users served by this hardware. Cyber Defense Overview / Machines 2 / 17

3 Virtual hosting methods to be covered: : Apache virtual-hosting, Java VM OS Level: chroot, Jails, User-mode-Linux s: VirtualBox, VMWare, Xen Emulation: Bochs, VMWare & VirtualBox under special configuration Cyber Defense Overview / Machines 3 / 17

4 In, virtualization of the hosted applications are configured within the space of another application instance (typically a parent instance). Cyber Defense Overview / Machines 4 / 17

5 Generally the following ground rules are true: The administrator of the server hardware has full visibility and control inside the virtual environments The virtual applications may share, privileges, storage and RAM, unless specifically configured not to Virtual processes are still visible to each other on the server-side The shared nature of the infrastructure is generally opaque to the end-user, but counter-measures must be authored into the applications in order to ensure this remains true. Compromising one virtual server can put all other virtual servers at risk Cyber Defense Overview / Machines 5 / 17

6 Cyber Defense Overview / Machines 6 / 17

7 OS-Level With OS-Level virtualization, you set up independent deployments of whole application stacks which cannot share each others configurations, libraries, modules, etc. Configuration of the virtual environments hosting these deployments will either be configured at the supervisor OS level, or via specialized "no return" system calls which request that the OS isolate all future execution and child processes. In the case of User Mode Linux, a wholly-contained execution environment is created to run a different Linux kernel as a subprocess of a parent kernel, as a new application. Cyber Defense Overview / Machines 7 / 17

8 OS-Level Provides the following features beyond the virtual hosting Can be rooted at a sub-path in the filesystem, restricted from reads/writes outside of this zone Requires a dedicated instance of the service for each virtual host Lacks dedicated allocation, still competes for system resources, but executes with significantly limited visibility to other services Individual applications need not be specially configured, and will be relatively isolated from one another Networking and IPC may still be possible between isolation environments Cyber Defense Overview / Machines 8 / 17

9 OS-Level Extra cost is incurred by duplicating applications which were shared under application-level virtual hosting Cyber Defense Overview / Machines 9 / 17

10 A hypervisor further pushes isolation logic up to the hardware level. Requiring special hardware features, the hypervisor can natively execute code while maintaining lmost complete resource isolation between the instances. With a few small exceptions, the virtual hosts will execute as completely dedicated OS deployments, requiring complete OS + application installation within the virtual guest instances. Parent OS is called "host", while the children are called "guests". Cyber Defense Overview / Machines 10 / 17

11 Execute most code natively, but expose a false hardware representation to the "guest" OS Selectively allocate HW devices to guests Dedicate resources or limit resource with fine granularity Abstracted hardware enables suspend, move, restore, close, snapshot of running guest states Most common virtualization associated with "the cloud" Cyber Defense Overview / Machines 11 / 17

12 Cyber Defense Overview / Machines 12 / 17

13 s provide an environment which attempts to implement, in software, an entire architecture. The goal is to provide a method to execute the code in a manner which most closely replicates the underlying system in which the software would execute. Minimal assistance is provided by the host operating system, and typically no kernel-level or other supervisory hooks are required. The entire virtualized HW & SW stacks live entirely in user-space. Cyber Defense Overview / Machines 13 / 17

14 All code is executed at the application layer Absolutely zero access to the host operating system Host can execute guest code which is incompatible with host architecture (PPC on x86, etc.) 100% visibility into hardware-level operations Very slow execution Cyber Defense Overview / Machines 14 / 17

15 Cyber Defense Overview / Machines 15 / 17

16 VirtualBox & VMWare both offer hybrid implementations of s and s. This enables these platforms to adapt to presence/absence of hardwrae & software facilities which enable hypervisor-based virtualization. Cyber Defense Overview / Machines 16 / 17

17 Apache "VirtualHost" examples: Best Practices for UNIX chroot() Operations: FreeBSD Handbook, Chapter 15. Jails: User Mode Linux: VirtualBox Documentation: Xen Project: QEMU Project: (emu. for x86, PowerPC, SPARC 32/64, MIPS, ARM) Cyber Defense Overview / Machines 17 / 17