Chapter 15 Security Best Practices and Scenarios

Table 15-9. User Access in a Multiple-Customer Open Deployment

		Customer	System
Access Level	Site Administrator	Administrator	Administrator	Business User
Root access?	Yes	No	No	No
Service console access through	Yes	Yes	No	No
SSH?
vCenter Server and vSphere	Yes	Yes	No	No
Web Access?
Virtual machine creation and	Yes	Yes	No	No
modification?
Virtual machine access through	Yes	Yes	Yes	Yes
the console?

Virtual Machine Recommendations

There are several safety precautions to consider when evaluating virtual machine security and administering virtual machines.

Installing Antivirus Software

Because each virtual machine hosts a standard operating system, consider protecting it from viruses by installing antivirus software. Depending on how you are using the virtual machine, you might also want to install a software firewall.

Stagger the schedule for virus scans, particularly in deployments with a large number of virtual machines. Performance of systems in your environment will degrade significantly if you scan all virtual machines simultaneously.

Because software firewalls and antivirus software can be virtualization-intensive, you can balance the need for these two security measures against virtual machine performance, especially if you are confident that your virtual machines are in a fully trusted environment.

Limiting Exposure of Sensitive Data Copied to the Clipboard

Copy and paste operations are disabled by default for ESX to prevent exposing sensitive data that has been copied to the clipboard.

When copy and paste is enabled on a virtual machine running VMware Tools, you can copy and paste between the guest operating system and remote console. As soon as the console window gains focus, non-privileged users and processes running in the virtual machine can access the clipboard for the virtual machine console. If a user copies sensitive information to the clipboard before using the console, the user—perhaps unknowingly —exposes sensitive data to the virtual machine. To prevent this problem, copy and paste operations for the guest operating system are disabled by default.

It is possible to enable copy and paste operations for virtual machines if necessary.

Enable Copy and Paste Operations Between the Guest Operating System and Remote Console

To copy and paste between the guest operating system and remote console, you must enable copy and paste operations using the vSphere Client.

Procedure

1 Log into a vCenter Server system using the vSphere Client and select the virtual machine.

2On the Summary tab, click Edit Settings.

VMware, Inc.

211