In a network where every server is virtual, the virtualization host is the key to every door. An attacker who reaches it doesn’t need to hack each server one by one; they can shut down, copy or encrypt every VM. In recent years, many ransomware attacks have targeted virtualization hosts directly, especially hosts that were not up to date or whose console was reachable from the internet.
Keep the management console out of public reach
- Never expose host management interfaces, vCenter or the Proxmox web console directly to the internet. Remote access should only go through VPN.
- Place the management network in a separate VLAN and allow access in the firewall only from administrators’ systems, not the entire user network.
- Hardware management interfaces such as iLO and iDRAC are just as sensitive and belong on the same separate network.
Don’t postpone updates
Serious vulnerabilities are discovered and fixed on every platform. Keep a regular schedule for updating hosts and follow the vendor’s security advisories. In a cluster, you can move VMs and update hosts one at a time without service downtime. Don’t forget server firmware either.
Accounts and permissions
- Create a personal account for each administrator, and don’t use the shared root or Administrator account for day-to-day work.
- Enable two-factor authentication wherever the platform supports it; for example, the Proxmox web console supports two-factor login methods.
- Grant permissions based on roles: someone who only needs to see one VM’s console doesn’t need permission to delete VMs or change host settings.
- Think carefully before joining hosts to the main domain. If the domain is compromised, hosts managed with domain accounts are at risk too; many specialists recommend managing hosts with separate accounts or a dedicated management domain.
Keep the passwords for the hosts’ primary accounts in a secure password manager and document the emergency access procedure. Being locked out of your hosts during a crisis is a crisis in itself.
Shrink the attack surface
- Enable unnecessary services such as SSH only when needed, or restrict access to them.
- On a Hyper-V host, install only the Hyper-V role, and don’t run other applications, a browser or email on it. A Server Core installation reduces the attack surface further.
- Don’t install extra software on a Proxmox host either, and use its built-in firewall to restrict access to the management ports.
- VMware offers features such as Lockdown Mode to restrict direct access to the host; check the exact capabilities in your version.
Keep backups and logs separate from the hosts
If the backup server is managed with the same accounts and on the same network, an attacker who takes over the host can reach the backups too. Keep the backup repository separate and, preferably, immutable. Also send host login and change logs to a central server so suspicious logins are visible and an attacker can’t erase their tracks.
Checklist
- Management consoles are reachable only from a separate management network or through VPN.
- Hosts and server firmware are up to date.
- Every administrator has a personal account and two-factor authentication.
- Unnecessary services are disabled.
- Backups are separated from the hosts and their accounts.
- Logs are stored and reviewed elsewhere.
The security of your virtualization hosts is the security of all your servers. ITPlus724 engineers can review the security settings of your VMware, Hyper-V or Proxmox hosts and fix their weak points.