VMware vSphere Hypervisor 6.7出来了

bryan

这个是下载地址，可能需要建立账号

https://my.vmware.com/group/vmware/d...&productId=742

Introducing vSphere 6.7 Security
By mike On April 18, 2018 0 Comments
I’m really excited to share with you all of the new security features available now in vSphere 6.7! The goals of security in 6.7 are twofold. Introduce more “easy to use” security features and “meet requirements set by customers IT and Security teams”. With vSphere 6.7 we have achieved both goals. Let’s dive into some of the new features and changes.

TPM 2.0 support for ESXi
As many of you know a TPM (Trusted Platform Module) is a device on your laptop, desktop or server system. It is used to store encrypted data (keys, credentials, hash values). TPM 1.2 support has been around for many years on ESXi but was primarily used by partners. TPM 2.0 is not backwards compatible with 1.2 and required all new device drivers and API development. The Trusted Computing Group has a great overview on what a TPM is and does.

ESXi’s use of TPM 2.0 builds upon our work in 6.5 with Secure Boot. In a nutshell, we validate that the system has booted with Secure Boot enabled and we take measurements and store them in the TPM. vCenter reads those measurements and compares them with values reported by ESXi itself. If the values match, then the host has booted with Secure Boot enabled and all the good stuff such as only running signed code and the inability to install unsigned code is assured. vCenter will provide an attestation report in the vCenter web client showing you the status of each host.

Virtual TPM 2.0 for VMs
In order to support TPM’s for virtual machines our engineers created a virtualized TPM 2.0 device. It shows up in Windows as a normal TPM 2.0 device. Like a physical TPM, it can do crypto operations and store credentials. But how do we secure data stored IN the virtual TPM? We write that data to the VM’s nvram file and secure that file with VM Encryption. This keeps the data in the vTPM secured and it “travels” with the VM. If I copy that VM to another datacenter and that datacenter is not configured to talk to my KMS then the data in that vTPM is secured. All the same VM Encryption rules apply.

Note: only VM “home” files are encrypted, not VMDK’s unless you choose to encrypt them.

Why didn’t we use the hardware TPM?
A hardware TPM has many limitations. It’s a serial device so it’s slow. It has a secured nvram storage size measured in bytes. It’s not designed for accommodating 100+ VM’s on a host. It won’t be able to store all their TPM data on the physical TPM. It would need a scheduler for the crypto operations it does. Imagine 100 VM’s trying to encrypt something and depending on a serial device that can only do one at a time? Ugh.

Even if I could physically store the data, consider a vMotion. I would have to securely remove the data from one physical TPM and copy it to another. And re-sign data with the new TPM’s keys. All of these actions are very slow in practice and fraught with additional security issues and requirements.

Note: In order to run virtual TPM’s, you will need VM Encryption. That means you will need a 3rd party key management infrastructure in place. See the list of supported KMS and my blog on KMS topology.

Support for Microsoft Virtualization Based Security
Your security team will probably ask for/demand “Credential Guard” support. This is it.

Back in 2015 Microsoft introduced Virtualization Based Security. We have worked very closely with Microsoft to provide support for these features in vSphere 6.7. Let’s do a quick overview of what is going on under the covers to make this happen.

When you enable VBS on your laptop running Windows 10 the system will reboot and instead of booting Windows 10 directly the system will boot Microsoft’s hypervisor. For vSphere, this means the virtual machine that was running Windows 10 directly is now running Microsoft’s hypervisor which is now running Windows 10. This is called “nested virtualization” and it is something that VMware has a HUGE amount of experience with. We have been using nested virtualization in our Hands On Lab’s for years.

When you enable VBS at the vSphere level that one checkbox is turning on a number of features.

Nested virtualization
IOMMU
EFI firmware
Secure Boot
What this will NOT do is enable VBS within the VM’s Guest OS. For that you would follow Microsoft guidance. This can be done with PowerShell scripts, Group Policies, etc.

The point being is that vSphere’s role is to provide the virtual hardware to support enablement of VBS. Combined with a virtual TPM you can now enable VBS and turn on features such as Credential Guard.

If you are building Windows 10 or Windows Server 2016 VM’s today I would HIGHLY recommend you build them with EFI firmware enabled. Moving from traditional BIOS/MBR to EFI (UEFI) firmware after the fact introduces some challenges later on down the line.

UI Updates
In vSphere 6.7 we have made a number of leaps in the functionality of the HTML5 (H5) web client. I use it all the time now. It’s fast, well laid out and complete for just about every task I run in my lab. In order to make things easier for the administrator from a VM Encryption level we have made some changes. In the background we are still leveraging Storage Policies, but we have combined all encryption functions (VM Encryption, vMotion Encryption) into one panel in VM Options. I think you’ll find this to be a more logical workflow.

Multiple SYSLOG targets
This is something I’ve personally wanted for a long time. I helped get the 6.5 logging enhancements out the door a number of years ago and one of the requests I’ve had is the ability, from the UI, to configure multiple SYSLOG targets. Why? Some customers want their SYSLOG stream going to two places. For example, IT and InfoSec teams. IT folks LOVE VMware Log Insight. InfoSec teams typically use Security Incident and Event Management systems that have specialized functions geared directly toward security operations. Now both can have an unfiltered stream of SYSLOG events going to their respective targets. The VAMI UI now supports up to 3 different SYSLOG targets.

FIPS 140-2 Validated Cryptographic Modules – By Default
This is big news for our US Federal customers. Within vSphere (vCenter and ESXi) there are two modules used for cryptographic operations. The VM Kernel Cryptographic Module is used by our VM Encryption and Encrypted vSAN features and the OpenSSL Module is used for things like certificate generation and TLS connections. These two modules have passed FIPS 140-2 validation.

Now, does that mean that vSphere is “FIPS Certified”? Well, some incorrectly use the terms interchangeably. To be “FIPS Certified” actually applies to a full solution of hardware and software that is tested and configured together. What we have done at VMware is make that process a whole lot easier for our partners to certify vSphere for FIPS operations. We look forward to seeing this happen in the near future. What a typical vSphere customer should know is that all crypto operations in vSphere are being done using the highest standards because we have turned on all FIPS 140-2 cryptographic operations BY DEFAULT.

Wrap Up
More info will be coming very soon in the form of blog articles and FAQ’s. For example, there will be a TPM and virtual TPM FAQ available on vSphereCentral. That should address MANY of your questions!

There you have it. LOTS of new security stuff. What you’ll see here is that we introduce new features like Secure Boot for ESXi and VM Encryption and then layer new functionality on top of them like TPM 2.0 and virtual TPM respectively. I expect this pattern to continue going forward.

We are committed to providing best in class security while at the same time paying extra attention to making security easy to implement and manage. I’d like to thank all of the VMware R&D teams for their outstanding work in this release. They do the hard work to make security easier for you to implement and manage! Know this: The future is bright in vSphere Security Land!

Thanks for reading!

mike

stevencif

你只是將全文照搬 來呃貼
https://www.yelof.com/2018/04/18 ... phere-6-7-security/

lewislee

全部都是英文，不是看得很懂

yjdtx

转载也翻译一下吧

歲月靜好

全部鸡肠唔识得睇喔，我人好懒，楼主最好翻译埋~

jan小琪

鸡肠呢样野唔适合我........

dkmi

參考翻譯（谷歌）唔一定完全啱！！！

介紹vSphere 6.7安全性
由邁克在2018年4月18日0評論
我非常高興能與您分享vSphere 6.7中現有的所有新安全功能！ 6.7中的安全目標是雙重的。引入更多“易於使用”的安全功能和“滿足客戶IT和安全團隊設定的要求”。通過vSphere 6.7，我們實現了兩個目標。讓我們深入一些新功能和變化。


TPM 2.0支持ESXi
許多人都知道TPM（可信平台模塊）是筆記本電腦，台式機或服務器系統上的設備。它用於存儲加密數據（密鑰，憑證，散列值）。 TPM 1.2支持在ESXi上已有很多年，但主要由合作夥伴使用。 TPM 2.0不向後兼容1.2，並且需要所有新的設備驅動程序和API開發。可信計算小組對TPM是什麼以及做什麼有很好的概述。

ESXi對TPM 2.0的使用建立在我們使用Secure Boot的6.5版本上。簡而言之，我們驗證系統是否啟用了安全啟動，然後我們進行測量並將它們存儲在TPM中。 vCenter將讀取這些度量值並將其與ESXi本身報告的值進行比較。如果這些值匹配，那麼主機已啟用安全啟動並啟動所有好東西，例如僅運行簽名代碼以及無法安裝未簽名代碼。 vCenter將在vCenter Web Client中提供證明報告，向您顯示每台主機的狀態。

針對虛擬機的虛擬TPM 2.0
為了支持虛擬機的TPM，我們的工程師創建了一個虛擬化的TPM 2.0設備。它在Windows中顯示為普通的TPM 2.0設備。像物理TPM一樣，它可以執行加密操作和存儲憑證。但是，我們如何保護存儲在虛擬TPM中的數據呢？我們將這些數據寫入VM的nvram文件並使用VM Encryption保護該文件。這將保持vTPM中的數據安全並且與VM“傳播”。如果我將該虛擬機複製到另一個數據中心，並且該數據中心未配置為與我的KMS進行通信，則該vTPM中的數據將得到保護。所有相同的VM加密規則都適用。

注意：只有VM“家”文件被加密，而不是VMDK，除非你選擇加密它們。

為什麼我們不使用硬件TPM？
硬件TPM有許多限制。這是一個串口設備，所以速度很慢。它有一個安全的nvram存儲大小，以字節為單位。它不適用於在主機上容納超過100個虛擬機。它將無法將所有TPM數據存儲在物理TPM上。它需要一個調度器來執行它的加密操作。想像一下，100台虛擬機試圖加密一些東西，並依賴於一次只能做一個的串行設備？啊。

即使我可以物理存儲數據，請考慮使用vMotion。我必須安全地從一個物理TPM中刪除數據並將其複製到另一個物理TPM中。並用新的TPM密鑰重新簽署數據。所有這些行動在實踐中都非常緩慢，充滿了額外的安全問題和要求。

注意：為了運行虛擬TPM，您需要虛擬機加密。這意味著您將需要第三方密鑰管理基礎架構。請參閱支持的KMS列表和KMS拓撲上的我的博客。

支持基於Microsoft虛擬化的安全性
您的安全團隊可能會要求/請求“憑據守衛”支持。就是這個。

早在2015年，微軟推出了基於虛擬化的安全性。我們與微軟密切合作，為vSphere 6.7中的這些功能提供支持。讓我們快速回顧一下發生的事情。

當您在運行Windows 10的筆記本電腦上啟用VBS時，系統將重新啟動，而不是直接啟動Windows 10，系統將引導Microsoft的管理程序。對於vSphere，這意味著直接運行Windows 10的虛擬機現在運行著微軟的hypervisor，它現在運行的是Windows 10.這被稱為“嵌套式虛擬化”，這是VMware擁有豐富的經驗。多年來，我們一直在Hands On Lab中使用嵌套式虛擬化。

當您在vSphere級別啟用VBS時，其中一個複選框打開了許多功能。

嵌套虛擬化
IOMMU
EFI固件
安全啟動
這不會做的是在VM的Guest OS中啟用VBS。為此，您需要遵循Microsoft指導。這可以通過PowerShell腳本，組策略等來完成。

問題的關鍵在於vSphere的角色是提供虛擬硬件來支持VBS的啟用。結合虛擬TPM，您現在可以啟用VBS並打開Credential Guard等功能。

如果您今天正在構建Windows 10或Windows Server 2016虛擬機，我強烈建議您在啟用EFI固件的情況下構建它們。在傳統的BIOS / MBR轉向EFI（UEFI）固件之後，事實上將在後面引入一些挑戰。

UI更新
在vSphere 6.7中，我們在HTML5（H5）Web客戶端的功能方面取得了一些進展。我現在一直都在使用它。它的速度很快，佈局合理，並且完成了我在實驗室中運行的所有任務。為了讓虛擬機加密級別的管理員更輕鬆，我們做了一些更改。在後台我們仍然利用存儲策略，但我們已將所有加密功能（VM加密，vMotion加密）結合到VM選項中的一個面板中。我想你會發現這是一個更合乎邏輯的工作流程。

多個SYSLOG目標
這是我長期以來一直想要的。幾年前，我幫助實現了6.5版日誌記錄增強功能，並且我的其中一個要求是可以從UI中配置多個SYSLOG目標。為什麼？有些客戶希望他們的SYSLOG流到兩個地方。例如，IT和資訊安全團隊。 IT人員喜歡VMware Log Insight。 InfoSec團隊通常使用安全事件和事件管理系統，這些系統具有專門針對安全操作的功能。現在都可以有一個未過濾的SYSLOG事件流到達它們各自的目標。 VAMI UI現在最多支持3個不同的SYSLOG目標。

FIPS 140-2已驗證的加密模塊 - 默認情況下
這對我們美國聯邦客戶來說是一個重大消息。在vSphere（vCenter和ESXi）中，有兩個模塊用於加密操作。我們的虛擬機加密和加密vSAN功能使用VM內核加密模塊，而OpenSSL模塊用於證書生成和TLS連接等功能。這兩個模塊已通過FIPS 140-2驗證。

現在，這是否意味著vSphere是“FIPS認證”的？那麼有些人可能會錯誤地使用這些術語。獲得“FIPS認證”實際上適用於經過測試和配置的完整硬件和軟件解決方案。我們在VMware上所做的工作使我們的合作夥伴更輕鬆地對vSphere進行FIPS操作進行認證。我們期待在不久的將來看到這種情況。典型的vSphere客戶應該知道的是，vSphere中的所有加密操作都是使用最高標準完成的，因為我們已將所有FIPS 140-2加密操作都打開為默認值。

包起來
更多信息將很快以博客文章和常見問題的形式發布。例如，vSphereCentral上將提供TPM和虛擬TPM常見問題解答。這應該解決你的許多問題！

你有它。很多新的安全措施。您將在這裡看到的是，我們引入了諸如用於ESXi和VM Encryption的安全引導等新功能，然後分別在TPM 2.0和虛擬TPM之上分層添加新功能。我預計這種模式將繼續向前發展。

我們致力於提供一流的安全性，同時要特別注意使安全易於實施和管理。我要感謝所有VMware研發團隊在此版本中的出色工作。他們努力工作，讓安全更容易實現和管理！了解這一點：vSphere Security Land中的未來是光明的！

謝謝閱讀！

麥克風

神之影

不会用可惜了

Miao

m默默的路过