Chapter 15 Security Best Practices and Scenarios

7Use a text editor to add the following line to the .vmx file, where device_name is the name of the device you want to protect (for example, ethernet1).

device_name.allowGuestConnectionControl = "false"

NOTE By default, Ethernet 0 is configured to disallow device disconnection. The only reason you might change this is if a prior administrator set device_name.allowGuestConnectionControl to true.

8Save your changes and close the file.

9 In the vSphere Client, right-click the virtual machine and select Power Off. 10 Right-click the virtual machine and select Power On.

Limiting Guest Operating System Writes to Host Memory

The guest operating system processes send informational messages to the ESX host through VMware Tools. If the amount of data the host stored as a result of these messages was unlimited, an unrestricted data flow would provide an opportunity for an attacker to stage a denial-of-service (DoS) attack.

The informational messages sent by guest operating processes are known as setinfo messages and typically contain name-value pairs that define virtual machine characteristics or identifiers that the host stores—for example, ipaddress=10.17.87.224. The configuration file containing these name-value pairs is limited to a size of 1MB, which prevents attackers from staging a DoS attack by writing software that mimics VMware Tools and filling the host's memory with arbitrary configuration data, which consumes space needed by the virtual machines.

If you require more than 1MB of storage for name-value pairs, you can change the value as required. You can also prevent the guest operating system processes from writing any name-value pairs to the configuration file.

Modify Guest Operating System Variable Memory Limit

You can increase the guest operating system variable memory limit if large amounts of custom information are being stored in the configuration file.

Procedure

1 Log in to a vCenter Server system using the vSphere Client. 2 Select the virtual machine in the inventory panel.

3On the Summary tab, click Edit Settings.

4 Select Options > Advanced > General and click Configuration Parameters.

5If the size limit attribute is not present, you must add it. a Click Add Row.

b In the Name column, type tools.setInfo.sizeLimit. c In the Value column, type Number of Bytes.

If the size limit attribute exists, modify it to reflect the appropriate limits.

6Click OK to close the Configuration Parameters dialog box, and click OK again to close the Virtual Machine Properties dialog box.

VMware, Inc.

213