• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

VM Encryption Questions

F

Franko

Weaksauce
Joined
Jan 17, 2009
Messages
121
I currently use WSE 2012R2 for my home server. I have full disk encryption with a TPM on the boot drive as well as my storage array.

To consolidate systems I want to move to an all-in-one and virtualize the WSE on ESXI. My research indicates that I can not pass thru the TPM. This leads me to believe that my security options if I virtualize are as follows:

1. Go without encryption.
2. Use unencrypted virtual machines and vm storage but encrypt the storage array (will be passed through to the WSE vm) and manually re-enter the unlock code every time I reboot.
3. Create a virtual floppy for the WSE vm and store the unlock codes for WSE as well as the storage array there.

I have two questions:

1. Are there any other options I am missing? I want to be able to lock this entire system (vm storage and hypervisor as well as the vm's) up tight as the server contains sensitive info (personal as well as work related). I don't mind paying but it wont be worth it if the cost to protect is more that just keeping separate machines like now.

2. How does one protect their vm's and the associated data? Is there any way to encrypt the ESXI hypervisor (and datastores) like I am currently doing with my WSE and full disk encryption?

Thanks for taking the time to read this.
 
I recently went thru a similar rebuild on my home network. Initially I tried to utilize the FDE of the SSD's I had installed on a single server with a LSI 9260 (with key) but there seemed to be some kind of compatibility issue (could see the FDE ability but would never successfully create a volume). That would have solved the issue but instead I had to look elsewhere.

Ultimately what I ended up doing was separating the ESXi host and storage VM (used to do an ESXi all-in-one) into two servers and running a full encrypted ZFS setup on the storage server (OS and all storage arrays under LUKS+ZFS) and mount all the datastores from the ESXi machine across a fibre channel connection to the storage server. This way everything VM-wise and the storage server itself was encrypted.

While this might not work or be an option for you, that's ultimately the way I came up with to achieve this goal. If you can get a RAID controller with FDE and compatible drives, that would be a much simpler way.

Doing the above in an all-in-one with NFS mounted datastores is also an option that I did have working at one point. The only unencrypted data at that point is the ESXi installation itself (the VM you utilize to serve the datastores via NFS should be encrypted by the OS (similiar to what I did above) and any additional VMs would be encrypted from the storage VM.)

Technically you should be able to do the same with a WSE VM utilizing bitlocker for the OS and storage arrays (I'm pretty sure you can utilize a USB stick to store the key and bypass any TPM requirement with group policy if required, looked into this method awhile back but didn't follow up on it) and mount NFS/iSCSI datastores exported from the WSE VM for all additional VMs.
 
Last edited:
You must log in or register to reply here.
Back
Top