Security Best Practices and Scenarios

A series of ESX deployment scenarios can help you understand how best to employ the security features in your own deployment. Scenarios also illustrate some basic security recommendations that you can consider when creating and configuring virtual machines.

This chapter includes the following topics:

n“Security Approaches for Common ESX Deployments,” on page 207

n“Virtual Machine Recommendations,” on page 211

Security Approaches for Common ESX Deployments

You can compare security approaches for different types of deployments to help plan security for your own ESX deployment.

The complexity of ESX deployments can vary significantly depending on the size of your company, the way that data and resources are shared with the outside world, whether there are multiple datacenters or only one, and so forth. Inherent in the following deployments are policies for user access, resource sharing, and security level.

Single-Customer Deployment

In a single-customer deployment, ESX hosts are owned and maintained within a single corporation and single datacenter. Host resources are not shared with outside users. One site administrator maintains the hosts, which are run on a number of virtual machines.

The single-customer deployment does not allow customer administrators, and the site administrator is solely responsible for maintaining the various virtual machines. The corporation staffs a set of system administrators who do not have accounts on the host and cannot access any of the ESX tools such as vCenter Server or command line shells for the host. These system administrators have access to virtual machines through the virtual machine console so that they can load software and perform other maintenance tasks inside the virtual machines.

Table 15-1 shows how you might handle sharing for the components that you use and configure for the host.

Table 15-1. Sharing for Components in a Single-Customer Deployment

ESX Configuration Guide

Table 15-1. Sharing for Components in a Single-Customer Deployment (Continued)

Table 15-2 shows how you might set up user accounts for the host.

Table 15-2. User Account Setup in a Single-Customer Deployment

Table 15-3 shows the level of access for each user.

Table 15-3. User Access in a Single-Customer Deployment

Multiple-Customer Restricted Deployment

In a multiple-customer restricted deployment, ESX hosts are in the same datacenter and are used to serve applications for multiple customers. The site administrator maintains the hosts, and these hosts run a number of virtual machines dedicated to the customers. Virtual machines that belong to the various customers can be on the same host, but the site administrator restricts resource sharing to prevent rogue interaction.

Although there is only one site administrator, several customer administrators maintain the virtual machines assigned to their customers. This deployment also includes customer system administrators who do not have ESX accounts but have access to the virtual machines through the virtual machine console so that they can load software and perform other maintenance tasks inside the virtual machines.

Table 15-4 shows how you might handle sharing for the components you use and configure for the host.

Chapter 15 Security Best Practices and Scenarios

Table 15-4. Sharing for Components in a Multiple-Customer Restricted Deployment

Table 15-5 shows how you might set up user accounts for the ESX host.

Table 15-5. User Account Setup in a Multiple-Customer Restricted Deployment

Table 15-6 shows the level of access for each user.

Table 15-6. User Access in a Multiple-Customer Restricted Deployment

ESX Configuration Guide

Multiple-Customer Open Deployment

In a multiple-customer open deployment, ESX hosts are in the same datacenter and are used to serve applications for multiple customers. The site administrator maintains the hosts, and these hosts run a number of virtual machines dedicated to the customers. Virtual machines that belong to the various customers can be on the same host, but there are fewer restrictions on resource sharing.

Although there is only one site administrator in a multiple-customer open deployment, several customer administrators maintain the virtual machines assigned to their customers. The deployment also includes customer system administrators who do not have ESX accounts but have access to the virtual machines through the virtual machine console so that they can load software and perform other maintenance tasks inside the virtual machines. Lastly, a group of business users who do not have accounts can use virtual machines to run their applications.

Table 15-7 shows how you might handle sharing for the components that you use and configure for the host.

Table 15-7. Sharing for Components in a Multiple-Customer Open Deployment

Table 15-8 shows how you might set up user accounts for the host.

Table 15-8. User Account Setup in a Multiple-Customer Open Deployment

Table 15-9 shows the level of access for each user.