VirtualBox

source: vbox/trunk/doc/manual/en_US/user_Security.xml@ 68716

Last change on this file since 68716 was 58485, checked in by vboxsync, 9 years ago

doc/manual: typos, spaces.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 17.1 KB
Line 
1<?xml version="1.0" encoding="UTF-8"?>
2<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
4<chapter id="Security">
5 <title>Security guide</title>
6
7 <sect1>
8 <title>General Security Principles</title>
9
10 <para>The following principles are fundamental to using any application
11 securely.
12 <glosslist>
13 <glossentry>
14 <glossterm>Keep Software Up To Date</glossterm>
15 <glossdef>
16 <para>
17 One of the principles of good security practise is to keep all
18 software versions and patches up to date. Activate the VirtualBox
19 update notification to get notified when a new VirtualBox release
20 is available. When updating VirtualBox, do not forget to update
21 the Guest Additions. Keep the host operating system as well as the
22 guest operating system up to date.
23 </para>
24 </glossdef>
25 </glossentry>
26
27 <glossentry>
28 <glossterm>Restrict Network Access to Critical Services</glossterm>
29 <glossdef>
30 <para>
31 Use proper means, for instance a firewall, to protect your computer
32 and your guest(s) from accesses from the outside. Choosing the proper
33 networking mode for VMs helps to separate host networking from the
34 guest and vice versa.
35 </para>
36 </glossdef>
37 </glossentry>
38
39 <glossentry>
40 <glossterm>Follow the Principle of Least Privilege</glossterm>
41 <glossdef>
42 <para>
43 The principle of least privilege states that users should be given the
44 least amount of privilege necessary to perform their jobs. Always execute VirtualBox
45 as a regular user. We strongly discourage anyone from executing
46 VirtualBox with system privileges.
47 </para>
48 <para>
49 Choose restrictive permissions when creating configuration files,
50 for instance when creating /etc/default/virtualbox, see
51 <xref linkend="linux_install_opts"/>. Mode 0600 would be preferred.
52 </para>
53 </glossdef>
54 </glossentry>
55
56 <glossentry>
57 <glossterm>Monitor System Activity</glossterm>
58 <glossdef>
59 <para>
60 System security builds on three pillars: good security protocols, proper
61 system configuration and system monitoring. Auditing and reviewing audit
62 records address the third requirement. Each component within a system
63 has some degree of monitoring capability. Follow audit advice in this
64 document and regularly monitor audit records.
65 </para>
66 </glossdef>
67 </glossentry>
68
69 <glossentry>
70 <glossterm>Keep Up To Date on Latest Security Information</glossterm>
71 <glossdef>
72 <para>
73 Oracle continually improves its software and documentation. Check this
74 note yearly for revisions.
75 </para>
76 </glossdef>
77 </glossentry>
78
79 </glosslist>
80 </para>
81 </sect1>
82
83 <sect1>
84 <title>Secure Installation and Configuration</title>
85
86 <sect2>
87 <title>Installation Overview</title>
88 <para>
89 The VirtualBox base package should be downloaded only from a trusted source,
90 for instance the official website
91 <ulink url="http://www.virtualbox.org">http://www.virtualbox.org</ulink>.
92 The integrity of the package should be verified with the provided SHA256
93 checksum which can be found on the official website.
94 </para>
95 <para>
96 General VirtualBox installation instructions for the supported hosts
97 can be found in <xref linkend="installation"/>.
98 </para>
99 <para>
100 On Windows hosts, the installer allows for disabling USB support, support
101 for bridged networking, support for host-only networking and the Python
102 language bindings, see <xref linkend="installation_windows"/>.
103 All these features are enabled by default but disabling some
104 of them could be appropriate if the corresponding functionality is not
105 required by any virtual machine. The Python language bindings are only
106 required if the VirtualBox API is to be used by external Python
107 applications. In particular USB support and support
108 for the two networking modes require the installation of Windows kernel
109 drivers on the host. Therefore disabling those selected features can
110 not only be used to restrict the user to certain functionality but
111 also to minimize the surface provided to a potential attacker. </para>
112 <para>
113 The general case is to install the complete VirtualBox package. The
114 installation must be done with system privileges. All VirtualBox binaries
115 should be executed as a regular user and never as a privileged user.
116 </para>
117 <para>
118 The Oracle VM VirtualBox extension pack provides additional features
119 and must be downloaded and installed separately, see
120 <xref linkend="intro-installing"/>. As for the base package, the SHA256
121 checksum of the extension pack should be verified. As the installation
122 requires system privileges, VirtualBox will ask for the system
123 password during the installation of the extension pack.
124 </para>
125 </sect2>
126
127 <sect2>
128 <title>Post Installation Configuration</title>
129 <para>
130 Normally there is no post installation configuration of VirtualBox components
131 required. However, on Solaris and Linux hosts it is necessary to configure
132 the proper permissions for users executing VMs and who should be able to
133 access certain host resources. For instance, Linux users must be member of
134 the <emphasis>vboxusers</emphasis> group to be able to pass USB devices to a
135 guest. If a serial host interface should be accessed from a VM, the proper
136 permissions must be granted to the user to be able to access that device.
137 The same applies to other resources like raw partitions, DVD/CD drives
138 and sound devices.
139 </para>
140 </sect2>
141 </sect1>
142
143 <sect1>
144 <title>Security Features</title>
145 <para>This section outlines the specific security mechanisms offered
146 by VirtualBox.</para>
147
148 <sect2>
149 <title>The Security Model</title>
150 <para>
151 One property of virtual machine monitors (VMMs) like VirtualBox is to encapsulate
152 a guest by executing it in a protected environment, a virtual machine,
153 running as a user process on the host operating system. The guest cannot
154 communicate directly with the hardware or other computers but only through
155 the VMM. The VMM provides emulated physical resources and devices to the
156 guest which are accessed by the guest operating system to perform the required
157 tasks. The VM settings control the resources provided to the guest, for example
158 the amount of guest memory or the number of guest processors, (see
159 <xref linkend="generalsettings"/>) and the enabled features for that guest
160 (for example remote control, certain screen settings and others).
161 </para>
162 </sect2>
163
164 <sect2>
165 <title>Secure Configuration of Virtual Machines</title>
166 <para>
167 Several aspects of a virtual machine configuration are subject to security
168 considerations.</para>
169
170 <sect3>
171 <title>Networking</title>
172 <para>
173 The default networking mode for VMs is NAT which means that
174 the VM acts like a computer behind a router, see
175 <xref linkend="network_nat"/>. The guest is part of a private
176 subnet belonging to this VM and the guest IP is not visible
177 from the outside. This networking mode works without
178 any additional setup and is sufficient for many purposes.
179 </para>
180 <para>
181 If bridged networking is used, the VM acts like a computer inside
182 the same network as the host, see <xref linkend="network_bridged"/>.
183 In this case, the guest has the same network access as the host and
184 a firewall might be necessary to protect other computers on the
185 subnet from a potential malicious guest as well as to protect the
186 guest from a direct access from other computers. In some cases it is
187 worth considering using a forwarding rule for a specific port in NAT
188 mode instead of using bridged networking.
189 </para>
190 <para>
191 Some setups do not require a VM to be connected to the public network
192 at all. Internal networking (see <xref linkend="network_internal"/>)
193 or host-only networking (see <xref linkend="network_hostonly"/>)
194 are often sufficient to connect VMs among each other or to connect
195 VMs only with the host but not with the public network.
196 </para>
197 </sect3>
198
199 <sect3>
200 <title>VRDP remote desktop authentication</title>
201 <para>When using the VirtualBox extension pack provided by Oracle
202 for VRDP remote desktop support, you can optionally use various
203 methods to configure RDP authentication. The "null" method is
204 very insecure and should be avoided in a public network.
205 See <xref linkend="vbox-auth" /> for details.</para>
206 </sect3>
207
208 <sect3 id="security_clipboard">
209 <title>Clipboard</title>
210 <para>
211 The shared clipboard allows users to share data between the host and
212 the guest. Enabling the clipboard in "Bidirectional" mode allows
213 the guest to read and write the host clipboard. The "Host to guest"
214 mode and the "Guest to host" mode limit the access to one
215 direction. If the guest is able to access the host clipboard it
216 can also potentially access sensitive data from the host which is
217 shared over the clipboard.
218 </para>
219 <para>
220 If the guest is able to read from and/or write to the host clipboard
221 then a remote user connecting to the guest over the network will also
222 gain this ability, which may not be desirable. As a consequence, the
223 shared clipboard is disabled for new machines.
224 </para>
225 </sect3>
226
227 <sect3>
228 <title>Shared folders</title>
229 <para>If any host folder is shared with the guest then a remote
230 user connected to the guest over the network can access
231 these files too as the folder sharing mechanism cannot be
232 selectively disabled for remote users.
233 </para>
234 </sect3>
235
236 <sect3>
237 <title>3D graphics acceleration</title>
238 <para>Enabling 3D graphics via the Guest Additions exposes the host
239 to additional security risks; see <xref
240 linkend="guestadd-3d" />.</para>
241 </sect3>
242
243 <sect3>
244 <title>CD/DVD passthrough</title>
245 <para>Enabling CD/DVD passthrough allows the guest to perform advanced
246 operations on the CD/DVD drive, see <xref linkend="storage-cds"/>.
247 This could induce a security risk as a guest could overwrite data
248 on a CD/DVD medium.
249 </para>
250 </sect3>
251
252 <sect3>
253 <title>USB passthrough</title>
254 <para>
255 Passing USB devices to the guest provides the guest full access
256 to these devices, see <xref linkend="settings-usb"/>. For instance,
257 in addition to reading and writing the content of the partitions
258 of an external USB disk the guest will be also able to read and
259 write the partition table and hardware data of that disk.
260 </para>
261 </sect3>
262
263 </sect2>
264
265 <sect2>
266 <title>Configuring and Using Authentication</title>
267
268 <para>The following components of VirtualBox can use passwords for
269 authentication:<itemizedlist>
270
271 <listitem>
272 <para>When using remote iSCSI storage and the storage server
273 requires authentication, an initiator secret can optionally be supplied
274 with the <computeroutput>VBoxManage storageattach</computeroutput>
275 command. As long as no settings password is provided (command line
276 option <screen>--settingspwfile</screen>, this secret is
277 stored <emphasis role="bold">unencrypted</emphasis> in the machine
278 configuration and is therefore potentially readable on the host.
279 See <xref
280 linkend="storage-iscsi" /> and <xref
281 linkend="vboxmanage-storageattach" />.</para>
282 </listitem>
283
284 <listitem>
285 <para>When using the VirtualBox web service to control a VirtualBox
286 host remotely, connections to the web service are authenticated in
287 various ways. This is described in detail in the VirtualBox Software
288 Development Kit (SDK) reference; please see <xref
289 linkend="VirtualBoxAPI" />.</para>
290 </listitem>
291 </itemizedlist></para>
292 </sect2>
293
294 <!--
295 <sect2>
296 <title>Configuring and Using Access Control</title>
297 </sect2>
298
299 <sect2>
300 <title>Configuring and Using Security Audit</title>
301 </sect2>
302
303 <sect2>
304 <title>Congiguring and Using Other Security Features</title>
305 </sect2>
306 -->
307
308 <sect2 id="pot-insecure">
309 <title>Potentially insecure operations</title>
310
311 <para>The following features of VirtualBox can present security
312 problems:<itemizedlist>
313 <listitem>
314 <para>Enabling 3D graphics via the Guest Additions exposes the host
315 to additional security risks; see <xref
316 linkend="guestadd-3d" />.</para>
317 </listitem>
318
319 <listitem>
320 <para>When teleporting a machine, the data stream through which the
321 machine's memory contents are transferred from one host to another
322 is not encrypted. A third party with access to the network through
323 which the data is transferred could therefore intercept that
324 data. An SSH tunnel could be used to secure the connection between
325 the two hosts. But when considering teleporting a VM over an untrusted
326 network the first question to answer is how both VMs can securely
327 access the same virtual disk image(s) with a reasonable performance. </para>
328 </listitem>
329
330 <listitem>
331 <para>When Page Fusion (see <xref linkend="guestadd-pagefusion"/>)
332 is enabled, it is possible that a side-channel opens up that allows
333 a malicious guest to determine the address space layout (i.e. where
334 DLLs are typically loaded) of one other VM running on the same host.
335 This information leak in it self is harmless, however the malicious
336 guest may use it to optimize attack against that VM via unrelated
337 attack vectors. It is recommended to only enable Page Fusion if you
338 do not think this is a concern in your setup.</para>
339 </listitem>
340
341 <listitem>
342 <para>When using the VirtualBox web service to control a VirtualBox
343 host remotely, connections to the web service (through which the API
344 calls are transferred via SOAP XML) are not encrypted, but use plain
345 HTTP by default. This is a potential security risk! For details about
346 the web service, please see <xref linkend="VirtualBoxAPI" />.</para>
347 <para>The web services are not started by default. Please refer to
348 <xref linkend="vboxwebsrv-daemon"/> to find out how to start this
349 service and how to enable SSL/TLS support. It has to be started as
350 a regular user and only the VMs of that user can be controlled. By
351 default, the service binds to localhost preventing any remote connection.</para>
352 </listitem>
353
354 <listitem>
355 <para>Traffic sent over a UDP Tunnel network attachment is not
356 encrypted. You can either encrypt it on the host network level (with
357 IPsec), or use encrypted protocols in the guest network (such as
358 SSH). The security properties are similar to bridged Ethernet.</para>
359 </listitem>
360
361 <listitem>
362 <para>Because of shortcomings in older Windows versions, using
363 VirtualBox on Windows versions older than Vista with Service Pack 1
364 is not recommended.</para>
365 </listitem>
366
367 </itemizedlist></para>
368 </sect2>
369
370 <sect2>
371 <title>Encryption</title>
372
373 <para>The following components of VirtualBox use encryption to protect
374 sensitive data:<itemizedlist>
375 <listitem>
376 <para>When using the VirtualBox extension pack provided by Oracle
377 for VRDP remote desktop support, RDP data can optionally be
378 encrypted. See <xref linkend="vrde-crypt" /> for details. Only
379 the Enhanced RDP Security method (RDP5.2) with TLS protocol
380 provides a secure connection. Standard RDP Security (RDP4 and
381 RDP5.1) is vulnerable to a man-in-the-middle attack.</para>
382 </listitem>
383 </itemizedlist></para>
384 </sect2>
385 </sect1>
386
387 <!--
388 <sect1>
389 <title>Security Considerations for Developers</title>
390 </sect1>
391 -->
392
393</chapter>
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette