Chapter 13. Securing Domain0
When deploying Red Hat Virtualization on your corporate infrastructure, you must ensure that domain0 cannot be compromised. Domain0 is the privileged domain that handles system management. If domain0 is insecure, all other domains in the system are vulnerable. There are several ways to implement security you should know about when integrating Red Hat Virtualization into your systems. Together with other people in your organization,you should create a 'deployment plan' that contains the operating specifications and services that will run on Red Hat Virtualization, and what is needed to support these services. Here are some security issues to consider when putting together a deployment plan:
Run the lowest number of necessary services. You do not want to include too many jobs and services in domain0. The less things running on domain0, the higher the level of security.
Enable SeLINUX to help secure domain0.
Use a firewall to restrict traffic to domain0. You can setup a firewall with default-reject rules that will help secure attacks on domain0. It is also important to limit network facing services.
Do not allow normal users to access domain0. If you do permit normal users domain0 access, you run the risk of rendering domain0 vulnerable. Remember, domain0 is privileged, and granting unprivilged accounts may compromise the level of security.