kvm_security_pdf

《kvm_security_pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、
KernelVirtualMachine(KVM)KVMsecurity
KernelVirtualMachine(KVM)KVMsecurityNoteBeforeusingthisinformationandtheproductitsupports,readtheinformationin“Notices”onpage49.SecondEdition(April2012)©CopyrightIBMCorporation2010,2012.USGovernmentUsersRestrictedRights–Use,duplicationordisclosurerestricted

2、byGSAADPScheduleContractwithIBMCorp.ContentsKVMsecurity............1Step1.Server(KVMhost)configuration..26Hostsecurity..............1Step2.Guestdomainconfiguration...27Trustedcomputingbase.........1Step3.Clientconfiguration......28Hostnetworkconfiguration........2VMsecurity..............28Hostnetwo

3、rkisolation.........2ThesVirtservice............28Networkisolationoptions........2OverviewofthesVirtservice......28NetworkportsharingwithEthernetbridges2CreatingstaticsVirtlabels.......29Networkportsharingwith802.1qVLANs.5VerifyingsVirtlabelingbyexaminingtheThelibvirtnetworkfilterdriver.....8labels

4、..............29Securingstoragedevices.........9VerifyingsVirtlabelingbyviewingtheDefaultlocationforvirtualdiskimages...9domain.xmlfile...........31StoringvirtualdiskimagesinacustomizedControlgroups(cgroups).........31location..............10Thelibcgroupfacility.........32Storingvirtualdiskimageson

5、anNFSmount11Definingcgroups..........33Remotemanagement...........11Addingtaskstocgroups........34Overviewofremotemanagement......11Definingcgrouphierarchy.......34RemotemanagementusingSSHtunnels....13Workingwithlibvirtcgroups......34ManagingKVMguestsremotelywiththeKVMguestimageencryption.......35v

6、irshcommand...........13CreatinganencryptedLogicalVolumetargetDisplayingtheremoteKVMVNCconsoleinthehost.............35usingvirt-viewer..........14Migratingexistinggueststoencryptedstorage37DisplayingtheremoteKVMVNCconsoleInstallinganewguest.........39usinganyVNCclient.........14Storingencryptedgues

7、timages......39RemotemanagementusingSASLauthenticationAuditingtheKVMvirtualizationhostandguests40andencryption............15Enablinghostauditing........40RemotemanagementusingTLS......17Auditrulesfile......