[libvirt-users] security BPC
HI! Disclaimer: I'm a libvirt beginner using it for managing virtual machines based on qemu-kvm. Is there any documentation describing how to harden libvirt/qemu-kvm installations? Escpecially how to improve isolation of VMs: - secure time sync (with or without ntpd?) - random number generation - running VMs as different host OS users I do not need general OS hardening advice. Ciao, Michael.
Hi,
- running VMs as different host OS users
Described here https://libvirt.org/drvqemu.html#securitydac
- secure time sync (with or without ntpd?)
Not sure what you mean by hardening here. You can set VM to get its time from the host (see here https://libvirt.org/formatdomain.html#elementsTime) and disable ntp in VM's OS. /--Regards, Aleksei/ ------------------------------------------------------------------------ *From:* Michael Ströder *Sent:* Thursday, October 20, 2016 11:48AM *To:* Libvirt-users *Subject:* [libvirt-users] security BPC
HI!
Disclaimer: I'm a libvirt beginner using it for managing virtual machines based on qemu-kvm.
Is there any documentation describing how to harden libvirt/qemu-kvm installations?
Escpecially how to improve isolation of VMs: - secure time sync (with or without ntpd?) - random number generation - running VMs as different host OS users
I do not need general OS hardening advice.
Ciao, Michael.
_______________________________________________ libvirt-users mailing list libvirt-users@redhat.com https://www.redhat.com/mailman/listinfo/libvirt-users
On Thu, Oct 20, 2016 at 10:48:55AM +0200, Michael Ströder wrote:
HI!
Disclaimer: I'm a libvirt beginner using it for managing virtual machines based on qemu-kvm.
Is there any documentation describing how to harden libvirt/qemu-kvm installations?
Escpecially how to improve isolation of VMs: - secure time sync (with or without ntpd?) - random number generation
See device RNG [1]
- running VMs as different host OS users
See <seclabel/> [2] oh, I see we don't have much there. Well then, this would do: <seclabel model="dac" type="static"> <label>user:group</label> </seclabel> Martin [1] https://libvirt.org/formatdomain.html#elementsRng [2] https://libvirt.org/formatdomain.html#seclabel
I do not need general OS hardening advice.
Ciao, Michael.
_______________________________________________ libvirt-users mailing list libvirt-users@redhat.com https://www.redhat.com/mailman/listinfo/libvirt-users
participants (3)
-
Aleksei -
Martin Kletzander -
Michael Ströder