When using the Create a virtual machine wizard How is the virtual hard disk created by default?

Compromise of the Virtual Hard Drive and Virtual Files

Physical thefts of information assets can indeed occur in virtual environments. A VM can be encapsulated into a single virtual hard disk (VHD) file. A VHD is a disk image file format for storing the complete contents of a hard drive. The disk image/VMs replicate an existing hard drive and include all data and structural elements. It can be stored anywhere that the physical host can access so it is easily transportable such as on a USB flash memory device.

An attacker could access a VHD file without entering the data center. He or she could do so by accessing the devices in the host data store. Attackers can access the host with a “Secure Copy” program through client management utilities. Such access would allow an intruder to browse data stores and download files.10

It is critical to protect VHD files as part of the information security strategy. Such protection requires three elements:

limiting access to the host data stores where the VMs reside;

implementing access logging to know when a breach occurs;

physically isolating the storage network so that only the storage devices and hosts have access.

Securing the virtual machines

Hyper-V is designed to be used primarily with Windows servers and SUSE Enterprise Linux. Because these systems are presented to the network exactly as they would be if installed on physical hardware, you will want to take the typical precautions when securing them, keeping in mind their final function. With Hyper-V, it is much more feasible to have a single instance host a single function, which makes securing the instance much easier. With a single function to concern yourself with, it is much easier to restrict outbound services, for instance, to only those necessary for minimal function and the single service that virtual machine provides. The considerations discussed above when dealing with the host instance hold true with the guest instances as well, including antimalware, updates, and so forth.

There are steps you can take to further secure the virtual machine configuration files and virtual hard disk files. By default, the machine configuration files are kept in %programdata% | Microsoft | Windows | Hyper-V | directory. These files are very small, and usually the default location is acceptable. If you choose to move them, be sure that the System account and the Administrators group both have Full Control over the directory and files. Other groups should be allowed only the access required for their function, that is, the service account used for backups, and so forth. Virtual hard drive (VHD) files can vary greatly in size, as they contain the virtual machine OS and data. These are kept by default in the %users% ∣ Public ∣ Documents ∣Hyper-V∣ Virtual Hard Disks directory. These files you will most likely want to move, and further secure. You can supply a new location for these files in the Hyper-V manager. The rights listed in Table 9.1 will need to be applied to the directory containing the VHD files.

Table 9.1. VHD File Rights

Note

Table 9.1 lists the default permissions on the default folder for the VHD files. Table 9.2 lists the rights that are required for running the virtual machines and their VHDs. If you were to relocate the default folders you would need to set these rights on those folders.

Table 9.2. Default Permissions on the Default Folder for the VHD Files

Bitlocker and Hyper-V

BitLocker works with the Trusted Platform Module (TPM) chip in supported systems to encrypt the data partitions of your hard drives. A Virtual Hard Disk (VHD) or virtual machine configuration can be placed on a BitLocker encrypted partition to allow the data contained on the VHD to benefit from this security as well—regardless of the guest operating system. This allows you to extend the protection of BitLocker to incompatible and legacy Windows operating systems. Once BitLocker is enabled on your host system, and the drives prepared and encrypted, the only step required is creation of the virtual devices on the encrypted drive.

Configuring Hyper-V options

Clicking the Hyper-V Settings link on the right pane of the Manager (see Figure 4.6) brings up the Hyper-V Settings window:

You can set two options for the server itself and five for each user connecting to the virtual machines (see Figure 4.7):

The Virtual Hard Disks and Virtual Machines options allow you to set a path for the virtual hard disk files and virtual machine files, respectively.

The Keyboard user option determines when Windows key combinations (such as ALT + TAB) pass through the virtual machine.

The Mouse Release Key option lets you set which keys you must press to take the mouse pointer out of the virtual machine window in the Virtual Machine Connection application. Note that if you have the virtual machine drivers installed on the virtual machine (in other words, you are running an “enlightened OS”), you will not need to use the key combination to release the mouse—it will operate on whichever desktop it is currently hovering over. If you have not installed the virtual machine drivers, Chapter 7 walks you through the process.

The User Credentials check box determines if you use the currently logged on user to log in to the virtual machine as well, in a “pass-thru” arrangement. With this box checked, you will not need to log in to the virtual machine when it starts up; it will use the credentials you used to log in to the management system. Unchecked, you will need to log in to the virtual machine once it is up and running.

Delete Saved Credentials does just what is advertized: it deletes any saved user log-ons you have in the virtual machine. Cached user log-ons are vulnerable to being captured by attackers—remember, just because the machine is virtual, it does not mean that it is secure! This option makes it easy for you to remove any and all cached log-ons that may be residing on the virtual machine.

Finally, the Reset Check Boxes option reverses all the work you did to ensure the annoying pop-up windows do not pester you anymore. Clicking the Reset button will allow you to once again see the warning messages before confirming certain actions.

The next option we explore is the Edit Disk option. Figure 4.8 shows you where this option is located. Selecting this launches the Edit Virtual Hard Disk Wizard.

Warning

Only run the Edit Virtual Hard Disk Wizard on virtual disks that are not currently in use.

After the typical introductory screen, you are asked to locate the virtual hard disk image, which is a .vhd file. (Of course, you need to have a .vhd file before you can edit it; Chapter 7 walks you through the process of creating a Virtual Machine.

Browse to the .vhd file you wish to alter, as shown in Figure 4.6 and select Next (Figure 4.9).

Figure 4.10 shows you the three available actions:

The Compact option allows you to shrink a dynamic disk by removing any blank space that might exist from deleting files within the virtual machine.

Note

The differences between a dynamic disk and fixed disk are essentially that a dynamic disk starts at a particular minimum size and grows as the amount of data on the virtual machine grows. A fixed disk begins at a particular size and stays there. The third type of disk is called differencing, and is used to create a copy of an existing disk. The differenced disk then records the changes made to the original disk, instead of the original being changed. Chapter 7 goes into much greater detail on the advantages and disadvantages of each.

The Convert option allows you to change the virtual disk from a fixed to a dynamic disk, or vice versa. It does this by copying the contents of the current .vhd file to a new one of the type you wish to convert to. This means you will need enough free disk space to contain both the old .vhd file and the new one on the physical drive. Once the conversion is completed, the old file is removed.

The Expand option is primarily useful for fixed disks and allows you to expand the maximum size of the virtual disk.

If you have a differencing disk attached as well, you have two more options available to you in this wizard: Merge, which takes the changes recorded on the differencing disk and writes them to the parent disk; and reconnect, which is only available if the parent disk cannot automatically be found. The reconnect function will prompt you for the new location of the parent disk.

Once you select your action, click Next. For the Convert option, you are asked for the location of the new disk; for Reconnect you will be asked to locate the parent disk. Click Finish and set the wizard to work. You will see a progress bar, as seen in Figure 4.11.

Another function available to you in the Hyper-V Management console is the Inspect Disk option as seen in Figure 4.12. The Inspect Disk option prompts you to locate the .vhd file you wish to inspect. It then connects to the disk and displays the properties in a window similar to Figure 4.13.

Type, location, name, size, and max size are listed (see Figure 4.13).

The next two Management console options, Stop Service and Remove Server, are shown in Figure 4.14.

Stop Service will stop the Hyper-V services on the host machine, turning off any running virtual machines and disabling the virtual network connections.

Remove server takes the currently selected server off the list of servers available to manage in the Hyper-V Management console.

VirtualBox

Pros

Available for Windows, Linux, Mac, Solaris, and FreeBSD.

Functions are available to clone VMs (saves time).

Supports more virtual hard disk file types. This is especially handy when running downloaded and prebuild VMs.

Cons

VMs are isolated from each other unless port forwarding is enabled on the host.

Does not support advanced virtualization needed for Xen, XenServer, vSphere, or other types of hypervisors.

If the VM crashes, there is a higher likelihood that the entire VM will become corrupted.

This guide is specifically for Oracle’s VirtualBox version 4.2.16 installed on Microsoft Windows 7 Professional. The decision was made to use VirtualBox instead of VMWare Player because there are more resources available on the Internet to help if problems arise; however, it does require a little extra setup. Remember, the best analysis is your analysis when choosing a virtualization system. There has been a long time over which is the best, ultimately choosing one virtualization system over another is a personal preference. Also, unlike antivirus programs, both can be installed to facilitate various needs, so it is possible to install VirtualBox and VMWare Player on the same computer. All of the links and references used throughout this guide were available at the time of writing. Be aware that versions, download locations, and information may change over time.

Virtual Hard Disk

The Virtual Hard Disk or VHD format is basically a hard drive that actually exists as a file. VHDs are generally used with virtual machines. But, they can also be used with physical machines. VHDs have the .vhd file extension.

Create VHD

VHDs can be created in the Disk Management MMC snap-in.

To create a VHD, do the following:

1.

Right-click the Disk Management MMC snap-in and select Create VHD. As seen in Figure 5.37, the Create and Attach Virtual Hard Disk window will appear.

2.

Specify a location for the hard disk file.

3.

Specify a size for the VHD.

4.

Choose whether you want to create a dynamically expanding VHD or a fixed-size VHD.

5.

Click OK. The VHD is created.

FIGURE 5.37. Create and Attach Virtual Hard Disk Window

SCVMM

1.

Open SCVMM.

On the right-hand pane – select New virtual machine (see Figure 7.72).

Change the radio button to Create the new virtual machine with a blank virtual hard disk and click Next (see Figure 7.73).

Give your VM a name in the virtual machine name field, and click Next (see Figure 7.74).

4.

Select BIOS and move “PXE Boot” to the top (see Figure 7.75).

Check the Network Adapter – make sure it is “Emulated” and not “Synthetic.”

Select the Hard Disk under Bus Configuration, and click Remove (see Figure 7.76).

Click Next.

Click Next (see Figure 7.77).

Click Next (see Figure 7.78).

Click Next (see Figure 7.79).

Select the network adapter from the drop-down list and click Next (see Figure 7.80).

By default no adapter is connected, so this needs to be changed.

12.

Click Next (see Figure 7.81).

Click Create (see Figure 7.82).

You will get a warning, which you can ignore (see Figure 7.83).

14.

Right-click on your VM and select Properties | Hardware Configuration | Network Adapter (see Figure 7.84).

Change the Ethernet (MAC) address to Static, and click Generate to generate a MAC address.

Click OK.

Tip

Copy the MAC address to a text file so you can use it later on provisioning server.

Repeat the process to create a second diskless virtual desktop.

Virtual Hard Disks

When dealing with virtual machines, virtual storage plays a large role in reaping the benefits of virtualization. A virtual machine relies on virtual hard disks much in the same way a physical machine would rely on a physical hard disk. Because of this it is critical to understand and master the creation and configuration of virtual hard disks.

Hyper-V allows you to designate and connect Virtual Hard Disks (VHD) to the virtual machines that you create. The virtual hard disk (VHD) format is a block-based format that stores the contents of a virtual machine. VHDs use the *.vhd file that simulates the properties of a physical hard drive. Virtual hard disks can be created during the VM creation using Hyper-V Manager. VHDs can also be customized and created prior to the creation of the virtual machine. To do this Hyper-V offers the New Virtual Hard Disk wizard as shown in Figure 10.3. This is a wizard that allows you a great deal of configuration options to create the ideal virtual hard disk for your requirements.

Here is an overview of the functions available to you with the New Virtual Hard Disk Wizard:

Before You Begin This page of the wizard explains the purpose of the wizard. From this pane you can create a default virtual hard disk without working through the rest of the wizard. By clicking Finish on this page, the wizard will create a dynamically expanding virtual hard disk with a storage capacity of 127 gigabytes by default.

Choose Disk Type From this page you can choose one of the three types of virtual hard disk that you would like to create based on the functionality you require.

Dynamically expanding virtual hard disks provide storage capacity as needed to store data. The size of the.*.vhd file is small when initially created and expands as data is added. The size does not shrink automatically, however, when data is deleted. In order to decrease the *.vhd file size you must compact the disk after data is deleted by using the Edit Virtual Hard Disk Wizard.

Fixed virtual hard disks provide storage via a size-specified *.vhd file when the disk is created initially. The size of the *.vhd file remains fixed regardless of the amount of data stored. In order to change the size of this type of disc you must use the Edit Virtual Hard Disk Wizard to increase the size of the virtual hard disc.

Differencing virtual hard disks provide storage to enable you to make changes to a parent virtual hard disk without altering that disk. The size of the *.vhd file for a differencing disk grows as changes are stored to the disk.

Specify Name and Location This page is used to provide a name and location for your new virtual hard disk. You can also specify a shared location if you plan to cluster the virtual hard disk to a virtual machine.

Configure Disk This page allows you to adjust the configuration of the VHD based on the type of disk you selected in the Choose Disk Type window.

For fixed and dynamically expanding virtual hard disks, you have the option to copy the contents of an available physical disk.

For a differencing disk, you can specify the location of the disk you want to use as the parent virtual hard disk.

Completing the New Virtual Hard Disk Wizard This page gives you the all the configuration details that you selected from all the previous pages. The new virtual hard disk is created when you click Finish. This process can take a considerable amount of time depending on the configuration options you choose for your virtual hard disk.

The New Virtual Hard Disk Wizard can be an invaluable resource creating as well as backing up virtual machines. Once a virtual machine is created by the New Virtual Hard Disk Wizard you can use the Edit Virtual Hard Disk wizard to make adjustments to it. This wizard has a number of options including Compact, Convert, Expand, Merge, and Reconnect, based on the type of VHD you have created.

Here is a summation of each of these functions:

Compact This function applies only to dynamically expanding virtual hard disks and differencing virtual hard disks. It reduces the size of the .*.vhd file by removing blank space left from where data was deleted.

Convert This function converts a dynamically expanding virtual hard disk to a fixed virtual hard disk or vice versa.

Expand This function increases the total storage capacity of a dynamically expanding virtual hard disk or a fixed virtual hard disk.

Merge This feature applies only to differencing disks and merges the parent partition with the differencing disk for back up purposes.

Reconnect This function applies to differencing disks only. It allows you to choose a differencing disk to reconnect to. This page will appear automatically when the parent virtual hard disk cannot be located.

Now that we have a better understanding of how to create and configure virtual hard disks we are ready to move on to the creation of virtual machines with the Hyper-V role.

Microsoft

Microsoft's virtual products, just like VMware's products, have other files associated with the virtual machine where the VHD format is used. The files and their descriptions are as follows: the virtual machine configuration (.vmc) file, the virtual hard disk (.vhd) file, any virtual machine saved-state (.vsv) files, and virtual machine undo disk (.vud) files associated with the virtual machine. The saved-state and undo disk files are stored in the same folder as the .vmc file. If you save the state of a virtual machine instead of shutting it down, all data from the virtual machine's memory is stored in a saved-state file (.vsv file) instead of in a .vhd file. Microsoft recommends that you either restore the virtual machine or discard the changes and then shut down the virtual machine before moving or copying a .vhd file.

Versions prior to Microsoft Virtual Server 2005 supported splitting of disk images, if the disk image grew larger than the maximum supported file size on the host file system.

Some file systems, such as the FAT32 file system, have a 4 GB limit on file size. If the hard disk image expands to more than 4 GB, Microsoft Virtual PC 2004 and previous versions will split the hard disk image into another file. The split files are stored in the same directory as the main hard disk image. They only have raw data, no headers or footers except for the last one, which has a footer stored at the end of the file. The first file in the split disk image has an extension of .vhd. The subsequent split files use a number convention similar to an EnCase image, so they would show as .v01, .v02, and so on. The maximum number of split files that can be present is 64, and the size of the split file cannot be altered.

Microsoft

Microsoft provides a full suite of technologies to enable an integrated, end-to-end virtualized infrastructure. Microsoft's solution includes servers, desktops, and applications virtual machine management and virtualization acceleration as described in Chapter 2, “Server Virtualization,” and Chapter 3, “Desktop Virtualization.” According to Microsoft's Web site, its emphasis on virtualization technologies is rooted in creating what is called a Dynamic IT environment. Microsoft uses the VHD file format for its virtual appliances. We will be discussing dynamic VHD in Chapter 5, “Investigating Dead Virtual Environments.” The Microsoft VHD file format specifies a virtual machine hard disk that can reside on a native host file system encapsulated within a single file. This is now a standard format used by Virtual PC 2007, Virtual Server 2005 R2, and Hyper-V. Microsoft plans to use this format for future versions of Microsoft Windows Server with hypervisor-based virtualization technology.

Microsoft's Web site offers a VHD Test Drive Program, which provides software vendors with a place to distribute preconfigured applications within Windows Server-based virtual machines to their customers. This gives Microsoft partners a way to offer their prospective and current customers more choices and flexibility for evaluating application software and makes it easier to assess complex solutions through the distribution of preconfigured virtual machines. These preconfigured virtual machines currently run on Virtual Server 2005 R2 or Hyper-V System Center Virtual Machine, as shown in Figure 4.12. If the program is successful, the offerings are sure to expand.

Manager can also be used to manage all the virtual machines in an environment. Beyond that, the VHD format is broadly applicable. Since June 2005, Microsoft has made the VHD Image Format Specification available to third parties under a royalty-free license, and as noted earlier, MojoPac has partnered with Microsoft to leverage their technology. Microsoft offers preconfigured VHDs that can be downloaded and evaluated similar to the virtual appliance market of VMware. Figure 4.13 shows the readily available VHD images.

However, the images that are offered are a bit different than those offered by VMware's Appliance Marketplace. Microsoft currently only offers VHDs that are evaluation copies due to licensing.