Edge and internal VMs on same host

[JBark]

I was reading this thread, and got to thinking about this a bit:
http://hardforum.com/showthread.php?t=1554608

Does anyone have any links regarding a true ESX/Hyper-V remote exploits? I've seen the occasional ESX bug over the years, including the ones that allow cross VM attacks, but these all required access to a VM on the host irself. I don't think I've ever come across a true honest to god remote exploit that didn't involve some idiot exposing the management interface to the web or something similar.

I can't say I would normally put an edge device and internal servers on the same host, but after thinking about it for the past day, I really can't see a problem with it. I understand and have always preferred the completely separate hardware, but I honestly can't come up with a solid reason not to virtualise on the same host. Sure, I can think of all sorts of hypothetical and mythical attacks that don't exist, but when it comes down to it, the edge device is a million times more likely to be hacked, and it doesn't really matter after that what your setup is. As long as you keep external/internal links partitioned by seperate NICs/vSwitches, it seems OK to me. Damnit, it seems so wrong, but I just can't come up with a good reason!

Then I realised that BackOffice/SBS Premium is pretty much this exact scenario, a single server with external/internal facing NICs, and all of us IT guys have happily installed thousands and thousands of these setups over the past 10+ years. Yeah, they might be installed behind a cheap, basic router with some port forwarding, but I've also seen hundreds plugged directly into the internet with no ill effects.

Also, thought this would be a decent setup for a colo situation. Instead of just coloing your 1U linux web server, why not colo an esxi server, with a small Untangle VM sitting in front of your linux VM? More piece of mind for the same rackspace cost.

Thoughts? As far as I can tell, neither MS or VMware have a stance on this, though that's not surprising.

Edit: Note, I'm really thinking towards the home/small business type of setup with just a single server. If you've got the 50k plus to put towards some nice multi server/SAN/HA type setup, you can afford something like an ASA or similar to us as your edge device.

 

[geiger]

Personally I'd do it as long as you are using dedicated NICs for each side of the network connected to distinct physical networks. This way you have the warm and fuzzy that a switch misconfig on the physical gear doesn't mix traffic(ie not seperate VLANs on the same switch)

 

[haileris]

Essentially you are trusting the Hypervisor to provide the seperation model correctly. Like yourself, I'm not aware of any issues in any of the mainline virtualisation platforms that would give me cause for concern in what you are planning. I notice VMware ESX 4 has received EAL4+ certification (http://www.vmware.com/security/certifications/) which provides a level of confidence. Likewise for vanilla Hyper-V (https://www.bsi.bund.de/cln_136/SharedDocs/Downloads/DE/BSI/Zertifizierung/Reporte05/0570b_pdf.html) - I assume R2 will be put through in time.

The increased risk comes from (imho) the increased ease of misconfiguration. Its quite easy to incorrectly place a VM on the wrong network - doesn't even take an idiot to do that

 

[nessus]

I do it in my home environment, and I don't see issues with doing it in a work environment either.

I would keep keep physically separate NICs on the hosts for each environment with separate vSwitches for external and Internal communication(I do all externally facing interfaces in all CAPs with a trailing exclamation point adn starting with the words "RAW INTERNET"). You do still have to make sure you correctly assign interfaces to keep things safe.

I'd have a PowerCli script run on a regular basis to check and make sure that no VMs are connected to both internal and external networks at the same time on ESX hosts, I'd also have it power off any VM that was running in violation of that configuration, and email about powered off VMs with a bad config.