Installing and Configuring

Threats Associated with Virtual Machine Information Flow
Configuring virtual
machine log size
Because often a new log file is created only when a host is rebooted, log files
can grow to be quite large. Uncontrolled logging can lead to denial of service
if the datastore runs out of disk space. VMware recommends saving 10 log files,
with each one limited to 1,000KB. Use the following .vmx settings to set these
limits:
log.rotateSize = "10000"
log.keepOld = "10"
A more extreme strategy is to disable logging altogether for the virtual
machine. Disabling logging makes troubleshooting challenging and support
difficult. Do not consider disabling logging unless the log file rotation approach
proves insufficient. Use the following .vmx setting to disable logging altogether:
logging = "FALSE"
VMX file size
By default the configuration file is limited to a size of 1MB because uncontrolled
size for the file can lead to a denial of service if the datastore runs out of disk
space. Informational messages are sometimes sent from the virtual machine to
the .vmx file. These setinfo messages define virtual machine characteristics or
identifiers by writing name-value pairs to the file. You might need to increase
the size of the file if large amounts of custom information must be stored in the
file. The property name is tools.setInfo.sizeLimit, and you specify the value
in kilobytes. Retain the following .vmx setting:
tools.setInfo.sizeLimit = "1048576"
Sending performance
counters into PerfMon
You can integrate virtual machine performance counters for CPU and memory
into PerfMon for Microsoft Windows guest operating systems. This feature
makes detailed information about the physical host available to the guest
operating system. An adversary could potentially use this information to
inform further attacks on the host. By default this feature is disabled. Retain
the following .vmx setting to prevent host information from being sent to the
virtual machine:
tools.guestlib.enableHostInfo = "FALSE"
This setting blocks some but not all metrics. If you set this property to FALSE,
the following metrics are blocked:
n
GUESTLIB_HOST_CPU_NUM_CORES
n
GUESTLIB_HOST_CPU_USED_MS
n
GUESTLIB_HOST_MEM_SWAPPED_MB
n
GUESTLIB_HOST_MEM_SHARED_MB
n
GUESTLIB_HOST_MEM_USED_MB
n
GUESTLIB_HOST_MEM_PHYS_MB
n
GUESTLIB_HOST_MEM_PHYS_FREE_MB
n
GUESTLIB_HOST_MEM_KERN_OVHD_MB
n
GUESTLIB_HOST_MEM_MAPPED_MB
Chapter 6 Security Considerations for Configuring VMware Tools
VMware, Inc. 45