Enable hardware virtualization in Bios - Security risk ?

Discussion in 'all things UNIX' started by Ocky, Sep 27, 2009.

Thread Status:
Not open for further replies.
  1. Ocky

    Ocky Registered Member

    Joined:
    May 6, 2006
    Posts:
    2,677
    Location:
    George, S.Africa
    I wanted to run a 64 bit Linux guest on a 64 bit Linux host using latest Virtualbox, and know that for this I need to enable VT (hardware virtualization) in the Bios.
    Now I am not so sure whether I want to do this as the setting for this is under the 'Security' tab and is disabled by default (Intel). See here re. potential risks:- http://communities.vmware.com/message/679154

    http://www.theta44.org/software/HVM_Rootkits_ddz_bh-usa-06.pdf

    Please tell me whether I can run a 32 bit Linux guest on a 64 bit Linux host without having to enable VT in the Bios.
    Edit: I have 64 bit version of Vbox and 64 bit Ubuntu host.
    Thanks.
     
    Last edited: Sep 27, 2009
  2. Ocky

    Ocky Registered Member

    Joined:
    May 6, 2006
    Posts:
    2,677
    Location:
    George, S.Africa
    To answer my own question - yes, apparently it can. So I suppose there shouldn't be any problems. Hope this is right :doubt:
     
  3. Ocky

    Ocky Registered Member

    Joined:
    May 6, 2006
    Posts:
    2,677
    Location:
    George, S.Africa
    Guys and frequent posters, you will know the answer to my concerns. I have no idea and would appreciate your advice.
    If I enable VT in Bios a hard reboot is required. What's the recommended way to best do this ? Maybe exit Bios and then immediatley turn off the power ?
     
  4. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    You can let your system boot. Then shut it down. No rush.
    Mrk
     
  5. Ocky

    Ocky Registered Member

    Joined:
    May 6, 2006
    Posts:
    2,677
    Location:
    George, S.Africa
    OK will try. Are there any security issues in having VT enabled, seeing the setting is shown under 'Security' in the Bios .. 'blue pill' or other ?

    BTW. Useful article http://www.dedoimedo.com/computers/windows-7-security.html mailed link to sister-in-law overseas. As staunch Windows
    user told her (for the second time) to bookmark your site. Saves me answering lots of questions, most of which require Googling. :D
     
    Last edited: Oct 10, 2009
  6. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    I would not worry about hardware security. To get your hardware pwned, you need to install bad stuff. This is no different than installing any other bad stuff. Keep your machine clean and you're good.
    Mrk
     
  7. Ocky

    Ocky Registered Member

    Joined:
    May 6, 2006
    Posts:
    2,677
    Location:
    George, S.Africa
    Thanks - it's like you said 'no rush' worked perfectly :)
    However I didn't notice speedier execution with 4 cpu's enabled, was about the same as running 32 bit with one cpu.
    Also I am not sure what 'Nested Paging' is all about so didn't enable that. (I just loaded the .iso, so can't tell if actual install would make a difference.

    Regards.
    Edit: I see now that only Intel Core i7 processors support nested paging. So out of luck regarding that.

    VT enabled 64 bit Mint.jpg
     
    Last edited: Oct 11, 2009
  8. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    Your biggest bottleneck is the disk. At home, you won't ever get your cpu/memory to max. Make sure you have separate drives for virtual machines, 7,200 rpm or more, sata and whatnot, this makes the biggest difference.

    Mrk
     
  9. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    You mean to put VMs on non-OS partition/ disks?
     
  10. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    Yup, non-OS, external disks, if you can afford to buy 15k SCSI disks, by all means do.
    Mrk
     
  11. Ocky

    Ocky Registered Member

    Joined:
    May 6, 2006
    Posts:
    2,677
    Location:
    George, S.Africa
    I have no spare drives, and obviously it's no use just to place the images on a separate partition as the host OS is still running.
    Will think about getting an external drive sometime. Thanks.
     
    Last edited: Oct 12, 2009
  12. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    Enable your hardware virt.

    Separate drives for vms makes a huge difference. The biggest performance hit is on I/O - use the highest rpm you can and keep 'em defragmented.
     
  13. lewmur

    lewmur Registered Member

    Joined:
    Dec 22, 2008
    Posts:
    332
    I can see two good points here. One, you definitely want your virtual drive file to be one contiguous file and not a fragmented one. Two, you want it to be on a drive with as few other files as possible. Both of these things will dramatically enhance disk I/O to the virtual drive. (I have one drive used only for backup images and vdi files. It is an external drive but only because I use it on both my Desktops and my laptop.)

    But you've lost me with your "external drive" bit. Unless you consider a SCSI drive, with its own controller, to be "external?." Do you think that an external USB drive would be faster than an internal SATA?
     
    Last edited: Oct 12, 2009
  14. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    It will be faster than an internal sata running the host OS and the virtual machine.
    Mrk
     
  15. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    Hmm.... I always thought that keeping virtual hard disks on an internal drive will be faster than keping them on an external one.
     
  16. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    External, internal is semantics. The actual bus is what matters.
    As to 15k velociraptors, I think they only can internal ... I should have clearer in that sentence. Of course, internal 15k is the best option, maybe even 8 in raid 6 configuration :)
    Mrk
     
  17. Ocky

    Ocky Registered Member

    Joined:
    May 6, 2006
    Posts:
    2,677
    Location:
    George, S.Africa
    My processor doesn't support 'Nested Paging' but apparently there is a substantial performance gain of around 30% if enabled in Vbox and supported by your cpu.
    Over my head but thought I would mention it.

     
Loading...
Thread Status:
Not open for further replies.