ASP Developer Network - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com

ASPDeveloper

ASPDeveloper.Net / VirtualServerFAQ.COM

Make sure you go to our home page for:

* Virtual Server 2005 FAQ
* ASP.Net 2.0 Information
* ASP.Net 2.0 Streaming Tutorials
* ASP.Net 2.0 HTML based Tutorials

Made possible by Business Internet Technology Shop (BitShop)

Virtual PC

Recent Virtual PC posts

* Advanced questions
* Loading opperating system onto V 7.0
* Video Spanning in virtual pc
* Virtual PC 7.0 - OS question
* Disk Error
* VPC with ASPI8DOS.SYS and Win95?
* Internet Connection Issue when using Wireless Connection
* Applied SP1 and still have host reboots
* How secure is VPC?
* Smartcard reader on USB port
* unixware (sco) 7
* Comparison between Virtual andVMware
* Anyone tried to install XP+virtual pc on window 2000 server?
* Virtual PC 2004 - virtual dynamic disk does not grow
* Service Control Manager (timeout)
* Feature request: Let me have a choice to disable auto-resizing display resolution of guest OS
* How do you get the Mac Serial -> Modem to work in VPC 7????
* VPC Convert
* Managing Files
* VPN Host versus Guest

Add Solution

Configuring Guest/Host as secure environment

Source: microsoft.public.virtualpc
Sent: 12/13/2004
From: Luigi
Message:

I would appreciate your help regarding an Internet connection configuration I
have
been facing in my environment.
My host : Windows XP Pro
My guest: Windows XP Pro
Internet access: directly by the host NIC/ ADSL.

I would like to permit internet access only for the guest in a way that the
host could be protect and "invisible" from all internet traffic. The guest
will act like a "sand box" and the host must have a complete isolation and
independency from this other environment (guest environment).
Is this possible to make a environment like this ?
I was using in the past a similar environment by using a dial-up connection
where the guest pointed its serial port to the serial port (modem) of the
host.
Now, with de ADSL connection the scenario changes and I'm in doubt to
configure the new environment.

Thanks in advance for any help you could provide.
Luigi.

Post Reply | This is Spam! | Mark as Spam

Related Messages

Re: Configuring Guest/Host as secure environment

Sent: 12/13/2004
From: "GaryM" <Gary(No.Canned.Meat)(email address - cut out)>
Message:

Well, Luigi, one surefire way to isolate the Host from any networking
threats is to disable TCP/IP (and any other protocols) on your Host's
network connection. That will also automatically disable File/Printer
sharing and Windows network client services. None of this, however, will
prevent internet access for your VPC Guest machines. As sandboxes go, this
one seems pretty deep.

--Gary

"Luigi" <(email address - cut out)> wrote in message
news:(email address - cut out)...

Show quoted text

>I would appreciate your help regarding an Internet connection configuration
>I
> have
> been facing in my environment.
> My host : Windows XP Pro
> My guest: Windows XP Pro
> Internet access: directly by the host NIC/ ADSL.
>
> I would like to permit internet access only for the guest in a way that
> the
> host could be protect and "invisible" from all internet traffic. The
> guest
> will act like a "sand box" and the host must have a complete isolation and
> independency from this other environment (guest environment).
> Is this possible to make a environment like this ?
> I was using in the past a similar environment by using a dial-up
> connection
> where the guest pointed its serial port to the serial port (modem) of the
> host.
> Now, with de ADSL connection the scenario changes and I'm in doubt to
> configure the new environment.
>
> Thanks in advance for any help you could provide.
> Luigi.

Re: Configuring Guest/Host as secure environment

Sent: 12/14/2004
From: Luigi
Message:

Hi Gary, I must agree this is a perfect surefire solution.The goal is not to
compromise or expose the host.
If I disable all the network protocols of the host it will be really
"protect" ?
Since I do this can I continue using the guest to get internet access ?
Do you know any other alternatives that reaches the same security level ?
Thanks for your valuable response.

Luigi

"GaryM" wrote:

Show quoted text

> Well, Luigi, one surefire way to isolate the Host from any networking
> threats is to disable TCP/IP (and any other protocols) on your Host's
> network connection. That will also automatically disable File/Printer
> sharing and Windows network client services. None of this, however, will
> prevent internet access for your VPC Guest machines. As sandboxes go, this
> one seems pretty deep.
>
> --Gary
>
>
> "Luigi" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
> >I would appreciate your help regarding an Internet connection configuration
> >I
> > have
> > been facing in my environment.
> > My host : Windows XP Pro
> > My guest: Windows XP Pro
> > Internet access: directly by the host NIC/ ADSL.
> >
> > I would like to permit internet access only for the guest in a way that
> > the
> > host could be protect and "invisible" from all internet traffic. The
> > guest
> > will act like a "sand box" and the host must have a complete isolation and
> > independency from this other environment (guest environment).
> > Is this possible to make a environment like this ?
> > I was using in the past a similar environment by using a dial-up
> > connection
> > where the guest pointed its serial port to the serial port (modem) of the
> > host.
> > Now, with de ADSL connection the scenario changes and I'm in doubt to
> > configure the new environment.
> >
> > Thanks in advance for any help you could provide.
> > Luigi.
>
>
>

Re: Configuring Guest/Host as secure environment

Sent: 12/14/2004
From: "GaryM" <Gary(No.Canned.Meat)(email address - cut out)>
Message:

This is the closest thing to a foolproof method I can think of to isolate
the Host from any threats, while still giving Guests full internet access.
The Host still runs the Virtual Machine Network Services driver, so it's
still pushing bits to the Guests, but disabling the Host's network protocols
plus all services that depend on those protocols essentially takes away the
Host's communications capabilities. I can't say for sure that there aren't
any potential buffer overflow vulnerabilities in the necessary VM network
services driver, but as a specific target for any hacker, it would be
statistically unrewarding compared to say, any of the major browsers or
servers in use today. To get bulletproof protection, you may simply have to
buy a separate physical computer for your sandbox.

Of course, VPC's architects or other brilliant folks in this NG might be
able to give you a more detailed answer, or an alternative configuration to
achieve even better network isolation for the Host. I always reserve the
right to be shown up by someone smarter ;-) Ciao.

--Gary

"Luigi" <(email address - cut out)> wrote in message
news:(email address - cut out)...

Show quoted text

> Hi Gary, I must agree this is a perfect surefire solution.The goal is not
> to
> compromise or expose the host.
> If I disable all the network protocols of the host it will be really
> "protect" ?
> Since I do this can I continue using the guest to get internet access ?
> Do you know any other alternatives that reaches the same security level ?
> Thanks for your valuable response.
>
> Luigi
>
> "GaryM" wrote:
>
>> Well, Luigi, one surefire way to isolate the Host from any networking
>> threats is to disable TCP/IP (and any other protocols) on your Host's
>> network connection. That will also automatically disable File/Printer
>> sharing and Windows network client services. None of this, however, will
>> prevent internet access for your VPC Guest machines. As sandboxes go,
>> this
>> one seems pretty deep.
>>
>> --Gary
>>
>>
>> "Luigi" <(email address - cut out)> wrote in message
>> news:(email address - cut out)...
>> >I would appreciate your help regarding an Internet connection
>> >configuration
>> >I
>> > have
>> > been facing in my environment.
>> > My host : Windows XP Pro
>> > My guest: Windows XP Pro
>> > Internet access: directly by the host NIC/ ADSL.
>> >
>> > I would like to permit internet access only for the guest in a way that
>> > the
>> > host could be protect and "invisible" from all internet traffic. The
>> > guest
>> > will act like a "sand box" and the host must have a complete isolation
>> > and
>> > independency from this other environment (guest environment).
>> > Is this possible to make a environment like this ?
>> > I was using in the past a similar environment by using a dial-up
>> > connection
>> > where the guest pointed its serial port to the serial port (modem) of
>> > the
>> > host.
>> > Now, with de ADSL connection the scenario changes and I'm in doubt to
>> > configure the new environment.
>> >
>> > Thanks in advance for any help you could provide.
>> > Luigi.
>>
>>
>>

Re: Configuring Guest/Host as secure environment

Sent: 12/15/2004
From: paul purvis
Message:

here are a few things i am doing with msvpc
1. running msdos software and using other networking protocols for my msdos
network besides the basic ones everybody else is running.

2. using a guest operation to access the internet.

configuration on my host machine does not use the tcp/ip protocol, or
netbuei, but i use another protocol not used by many others.
i have small offices and so far have been able to keep tcp/ip protocol off
my workstations and that will probably change as my experience on firewalls
and security grow.
i have each of the host system's administrator passwords secure and only
allow my operators to use a guest level to sign on and run host the
computers.
i have made internet explorer and outlook express where they would no run on
the host system, i feel you could run the tcp/ip protocols on the host and
not allow any browsers or email to/from the host. you could use ftp programs
and other programs to do some kind on network access, even to the internet if
needed, but no browsers or email systems.
now for the guest os, use a operating system that will access the internet
where the browser and email software will be run, but only run the tcp/ip
protocol on those guest os.
keep in mind, my users on the host only have guest (really user) level
privileges.
so that keeps them from installing a networking protocol, other than what i
set.
the beauty of this, other than it out right running, is you can backup the
vhd files in the beginning and replace the vhd file working in no time flat
on a regular basis or when those guest operating get all that cramp from
browers.
so even you can go where you dare not go and still have a surviving host os.

i will be glad when products, such as low to middle end routers, give use
security
like the big boys, and i am sure internet services as well will change also
in the near future.
it is really terrible that a hand full of bad people cause most of the
problems on the internet, but it is only because we let them get by with it
as a whole and we do not have to put up with it if we really wanted not too.

Post Reply | This is Spam! | Mark as Spam

Other groups

Virtual PC (Mac)(3592)	Virtual PC(12844)	Virtual PC (French)(496)
Virtual Server 2005(6245)

Our Sponsors

Virtual Server 2005 Info Here!
http://www.aspdeveloper.net

Wiki

Blogs

Articles

Image galleries

File galleries

Forums

Maps

Directories

ASP Developer Network (since 1996) - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com
Copyright © 1997-2005 by BitShop, Inc. All Rights Reserved.
No content may be reproduced in any form without written permission from BitShop, Inc.
We will be honored to assist with reproduction rights on our material if you contact us.
We also can provide print articles for your magazine, private training seminars at your site, and conference presentations.
Thank you for visiting. Please bookmark our site if you found it useful!
If you wish to make a donation it will help further the development of these free resources: