linux:apps:kvm:kvm-hardening
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| linux:apps:kvm:kvm-hardening [2026/09/13 13:24] – [Network containing] oscar | linux:apps:kvm:kvm-hardening [2026/09/16 16:31] (current) – [Network containing] oscar | ||
|---|---|---|---|
| Line 56: | Line 56: | ||
| ``` | ``` | ||
| #### Step 2: Create a Libvirt hook script | #### Step 2: Create a Libvirt hook script | ||
| - | Libvirt can execute scripts when VMs start. We will use a qemu hook to isolate the traffic. | + | Libvirt can execute scripts when VMs start. We will use a qemu hook to isolate the traffic. Open a terminal on your host and create the hook directory if it does not exist. |
| - | + | ||
| - | Open a terminal on your host and create the hook directory if it does not exist. | + | |
| ``` | ``` | ||
| - | # mkdir -p / | + | # mkdir -p / |
| ``` | ``` | ||
| Create and edit the hook file and paste the following script (replace vnet0 and 192.168.122.1 with your actual interface and allowed gateway): | Create and edit the hook file and paste the following script (replace vnet0 and 192.168.122.1 with your actual interface and allowed gateway): | ||
| ``` | ``` | ||
| - | # nano / | + | # nano / |
| - | ------------------------------ | + | ------------------------------------------------------- |
| #!/bin/bash | #!/bin/bash | ||
| - | VM_NAME=" | + | set -euo pipefail |
| - | INTERFACE="vnet0" | + | |
| - | ALLOWED_GATEWAY=" | + | NFT="/ |
| + | VM_NAME=" | ||
| + | VM_MAC=$(/ | ||
| + | LIBVIRT_BRIDGE=" | ||
| + | HOST_INTERFACE="enp2s0" | ||
| + | BLOCKED_IPV4_RANGES="{ 192.168.0.0/16 }" | ||
| + | BLOCKED_IPV6_RANGES=" | ||
| + | TABLE=" | ||
| + | CHAIN=" | ||
| + | |||
| + | install_rules() | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | |||
| + | # Allow established and related return traffic | ||
| + | " | ||
| + | |||
| + | # Allow only VM -> 192.168.178.1 | ||
| + | "$NFT" add rule inet " | ||
| + | " | ||
| + | |||
| + | # ALLOW remaining traffic from the VM out to the internet via enp2s0 | ||
| + | " | ||
| + | } | ||
| + | |||
| + | remove_rules() | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | |||
| + | case " | ||
| + | start) | ||
| + | [[ " | ||
| + | ;; | ||
| + | |||
| + | stopped) | ||
| + | [[ " | ||
| + | ;; | ||
| + | esac | ||
| + | |||
| + | exit 0 | ||
| - | OBJECT=$1 | ||
| - | OPERATION=$2 | ||
| - | if [ " | ||
| - | if [ " | ||
| - | # 1. Allow traffic to the specific gateway IP | ||
| - | iptables -I FORWARD -m physdev --physdev-in $INTERFACE -d $ALLOWED_GATEWAY -j ACCEPT | ||
| - | iptables -I FORWARD -m physdev --physdev-out $INTERFACE -s $ALLOWED_GATEWAY -j ACCEPT | ||
| - | | ||
| - | # 2. Drop all other traffic from this interface | ||
| - | iptables -A FORWARD -m physdev --physdev-in $INTERFACE -j DROP | ||
| - | iptables -A FORWARD -m physdev --physdev-out $INTERFACE -j DROP | ||
| - | fifi | ||
| ``` | ``` | ||
| Line 101: | Line 129: | ||
| Now, every time you start this specific VM, the host firewall will block all network traffic unless it is explicitly sent to or from your chosen gateway IP. | Now, every time you start this specific VM, the host firewall will block all network traffic unless it is explicitly sent to or from your chosen gateway IP. | ||
| If you are using nftables instead of iptables, or if you need help finding the exact subnet/ | If you are using nftables instead of iptables, or if you need help finding the exact subnet/ | ||
| + | |||
| + | Check if the firewall settings are created and removed with: | ||
| + | # nft list ruleset | ||
| + | The firewall settings will look something like: | ||
| + | ``` | ||
| + | table inet vm_filter { | ||
| + | chain vm_Debian13_ESP { | ||
| + | type filter hook forward priority raw; policy accept; | ||
| + | ct state established, | ||
| + | ether saddr 51: | ||
| + | ether saddr 51: | ||
| + | ether saddr 51: | ||
| + | } | ||
| + | } | ||
| + | ``` | ||
| + | |||
| + | ## Kernel Samepage Merging (KSM) | ||
| + | In Linux, KSM (Kernel Samepage Merging) is a feature that scans your system' | ||
| + | |||
| + | * The ksm service controls the actual raw kernel thread (ksmd) that does the heavy lifting. | ||
| + | * The ksmtuned service is a user-space daemon. It actively watches your system and dynamically adjusts the tuning parameters of the kernel thread (like how fast it scans memory) based on how many QEMU/KVM instances are currently running. | ||
| + | |||
| + | #### The Security Risk: Side-Channel Attacks | ||
| + | While KSM is great for saving RAM on high-density servers, it introduces a major security flaw called a Memory Side-Channel / Cache-Leak Attack. [1, 2] | ||
| + | Because memory pages are shared between the host and the guest, a malicious process inside your Debian guest can perform precise timing measurements on memory access. By deliberately modifying a page and measuring how long it takes to process, the guest can figure out if that same data exists elsewhere in the host system' | ||
| + | |||
| + | Even if you only run a single Debian guest, KSM can still merge identical pages between your one guest and the Debian host operating system. If ksmtuned kicks in and starts aggressive page merging, the side-channel attack vector remains open between your isolated guest and your underlying hypervisor. | ||
| + | |||
| + | #### Check if KSM is running | ||
| + | To check if ksmtuned and the underlying Kernel Samepage Merging (KSM) engine are active on your Debian Trixie host, run these diagnostic commands: | ||
| + | systemctl status ksmtuned ksm | ||
| + | |||
| + | What to look for: If it says Active: active (running), it is active. If it says Active: inactive (dead) or loaded (...; masked), it is successfully disabled. | ||
| + | |||
| + | #### How to completely disable KSM | ||
| + | To ensure no memory deduplication happens at all, you should permanently stop and disable both the tuning daemon and the kernel driver: [5] | ||
| + | |||
| + | 1. Stop and mask the services so they can never be started by other system triggers: | ||
| + | |||
| + | sudo systemctl disable --now ksm ksmtuned | ||
| + | sudo systemctl mask ksm ksmtuned | ||
| + | |||
| + | 2. Force the kernel to instantly unshare any pages it has already merged: | ||
| + | |||
| + | echo 2 | sudo tee / | ||
| + | |||
| + | (Setting this to 2 completely disables the engine and forces the kernel to unmerge everything immediately. Setting it to 0 only stops it from scanning new pages). [2, 5] | ||
linux/apps/kvm/kvm-hardening.1789305845.txt.gz · Last modified: by oscar