| |
|
 |
|
 |
|
|
|
| |
|
|
xen-users
Re: [Xen-users] Best way to use Xen to segment & protect
On Feb 17, 2009, at 12:55 PM, Nick Anderson <nick@xxxxxxxxxxxx> wrote:
On Tue, Feb 17, 2009 at 12:06:53PM -0800, Rick Flower wrote:
Hi all...
I'm a Xen newbie and was wondering about the merits of using Xen to
segment off my private data from the prying eyes & fingers of
Apache/PHP
hackers (something that bit me recently). If I create several
DOM's --
one for Apache, 1 for mail, 1 for pgsql and 1 for my private data, is
that a good way to ensure that IF someone gets around Apache ( for
instance) that my private data will not be compromised? The server
I've
got is a quad Xeon Proliant running FC6
MTIA!!
-- Rick
It would make it just as secure as having it on a separate machine.
However if your dom0 was compromised there is nothing standing in the
way to compromise all domUs. Also if there are ever any domU root
escalation issues someone attacking through your webserver would be
able to escalate to dom0 and then have access to all of your virtual
machines.
Thanks for the info Nick... Regarding the root escalation mentioned
above -- have there been issues with this in the past?
Also, I guess it would help to have the domU that Apache is using to
have tools such as Tripwire and other related tools to keep thing from
getting too far...
If you're in a domU, can you tell that it's a virtual server? If not
then perhap it's less likely to break out and escalate to dom0...?
Is it possible to have a domU mount a different filesystem than dom0?
Sorry for the numerous questions...
Thx!
-- Rick
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
|
|
| |
|
Home