Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have installed a 64v ubuntu desktop. Is it safe to run any production server in a KVM?

PC = i5 vt enabled, 8gig memory 1g hard drive

HOST = Ubuntu Desktop 64 bit. Guest(s) = Ubuntu Server (command line)

Is this safe? Should I run all from a command line for security purposes?

share|improve this question
add comment

2 Answers

First of all, yes you can (you know that from the existing answer). I would still like to add a few aspects. The desktop and server versions only differ by the packages installed by default or set to be installed by default (tasksel), hence you can do it.

Running a production server on a "desktop version" of Ubuntu is therefore possible as there are no fundamental differences such as, say, between Windows XP Pro (32bit) and Windows 2003 Server R3 (32bit) - the latter would accept up to 64 GiB RAM in the more expensive editions. On Ubuntu you can install a kernel that speaks PAE and doesn't set arbitrary limits (like cheaper Server editions of Windows 2003) even on 32bit setups.

The bigger question should be whether you can run production servers on commodity hardware. And the answer is YES. Check out this article over at Wikipedia. Google runs most of their services on this kind of hardware, but redundantly. A few years ago they (Google) published some study about the reliability of desktop hard drives, too.

Therefore after we know commodity hardware isn't the problem your requirements about reliability and the known parameters concerning hardware failures to be expected etc should govern your decision making.

A "cheaper" (or rather: "more lightweight") alternative would be to use LXC (Linux Containers). Imagine them like an intermediate step between chroot (which was never meant to be a jail like the respective concepts on Solaris or BSDs) and KVM. LXC does leverage apparmor to achieve this, btw. The separation isn't perfect, but given the advantages, the tradeoff seems small.


About your rootkit worry, I am not sure because I haven't researched the topic enough. However, KVM guests run as user mode processes and you can even let each guest have its own account, if you like. Now parts of KVM must obviously operate in the kernel of the host, so there is a chance that attack vectors exist, I just wonder whether the attach vector allows code from the guests to break out ...


How you intend to make things more secure by only using the command line is beyond me, however. You have all the possibilities (usually rather more than less) that you have through a GUI (KDE, GNOME, Unity etc). So it doesn't make the job harder to install host or guest as command line only. The reason to leave out X11 should rather be governed by the use (you say "server", so it's not obvious) and the available resources. If X11 doesn't run it also won't take away resources (except for disk space).

share|improve this answer
    
Linux People suggest that we should run less services as possible to imrpove security. That is why I ask if running ubuntu desktop as kvm host and running KVM for production servers (web, email, database) could be a bad idea. –  tito_santana Feb 21 '13 at 14:40
    
I strongly disagree with Lxc in production. First host separation is incomplete and second lxc is in rapid development with IMO inadequate documentation. –  bodhi.zazen Feb 21 '13 at 15:06
    
@tito_santana: good point. –  0xC0000022L Feb 21 '13 at 15:52
    
@bodhi.zazen: didn't I point out that very catch? Still I see people using a mere chroot as a security measure and running with it in production. LXC is superior to that for example. Depends mostly on your requirements, another aspect I tried to point out. –  0xC0000022L Feb 21 '13 at 15:53
add comment

Yes you can run KVM on a desktop install. In fact, there is a great graphical tool, virt-manager to help configure, install, and manage guests.

virt manager

To install it

sudo apt-get install virt-manager

See https://help.ubuntu.com/community/KVM/VirtManager for details

share|improve this answer
    
Thanks Bodhi. It is safe to use a desktop to run kvm virtual machines for production servers? I am doing my research and I found out a lot postings about kvm/xen root kits. Is this is true? –  tito_santana Feb 20 '13 at 21:34
    
Those root kits, or at least the ones I have seen reported, are against the KVM package components itself and running KVM on a desktop make it no more or less vulnerable. If you are paranoid about such things either look at using apparmor to confine KVM or take a look at Fedora (selinux). Selinux has confined all the root kits I have seen for KVM. –  bodhi.zazen Feb 20 '13 at 21:47
    
Thanks. That answered my question a bit better. I will look into apparmor since I will be using ubuntu. –  tito_santana Feb 20 '13 at 21:54
    
Thanks for all your answers. I installed a ubuntu headless server which is going to host the kvms. I also installed a kvm machine witch is going to be the web server and another web for the database. I had to use virt-manager from a remote computer to be able to install the KVM machines. However virt-manager was buggy. Would you recommend any other kvm remote manager? Also when I bridged the internet it doesnt work unless i manually restart networking. Thanks guys. –  tito_santana Feb 21 '13 at 14:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.