Virtual Server security

  • Article

Virtual Server security

The default configuration of Virtual Server 2005 is designed to be secure, as follows:

  • The VMRC server is disabled.
  • Virtual Server uses Integrated Windows authentication.
  • Only local administrators can access the Administration Website, configure Virtual Server, and create and configure virtual machines and virtual networks; other users must be granted the appropriate permissions manually.
  • Scripting is disabled by default; it must be manually enabled for Virtual Server or virtual machines.
  • Scripts cannot be run on a virtual machine until a user account under which to run that virtual machine is specified. Virtual Server enforces this to prevent a security vulnerability resulting from an elevation of privilege.
  • The two Virtual Server services run under security accounts that have low privileges: The Virtual Server service (Vssrvc.exe) runs under the Network Service account, which has limited access to the local computer and authenticated access (as the computer account) to network resources. The Virtual Machine Helper service (Vmh.exe) runs under the Local System account. This account has limited access to the local computer and anonymous access to network resources.

Security vulnerabilities in Virtual Server can have the following causes:

  • Virtual Server is not deployed in a secure manner, following the recommendations in Best practices for Virtual Server. For example, Integrated Windows authentication is disabled, and Basic authentication is enabled without the implementation of Secure Sockets Layer (SSL) security.
  • Guest operating systems may have security vulnerabilities. Virtual Server does not mitigate security issues within guest operating systems. Administrators must take steps to address these vulnerabilities in the same manner as on a physical computer. Virtual Server does, however, isolate guest operating systems from one another as well as from the host operating system. This prevents an attacker from exploiting a vulnerability on a guest operating system to attack the host operating system, and vice versa.
  • Firewall and antivirus software running on the host operating system will not protect guest operating systems. To obtain this protection, you must install firewall and antivirus software directly on the guest operating systems.

You can configure security settings for Virtual Server, virtual machines, and virtual networks. For more information about the default settings, see Security Settings. For more information about configuring security, see Securing Virtual Server.