HyTrust Appliance

I had the pleasure of having Eric Chiu and Ken Crandall of HyTrust (http://www.linkedin.com/companies/hytrust & http://www.hytrust.com/) give me a pre-release demo of their soon to be released product, the HyTrust Appliance. I hesitate to call the device a “security appliance”, although it is – and much more. My take on the HyTrust Appliance is that it is a device (either a physical hardware appliance or a VM appliance) whose goal, at a high level, is to provide a centralized point for administrative access to your VMware Infrastructure components. Why would you want such a thing? Here are four good reasons:

• To enable a single authentication source for all of the different administrative access methods (vCenter Server, ssh, web access, VIC, third-party tools, etc.)
• To enable a granular authorization service for users, regardless of administrative access method
• To provide a template-based security configuration for your hosts, and
• To provide a centralized logging facility to simplify and enhance auditability.

The architecture is relatively simple (which is a good thing). Basically, as shown in Figure 1, the appliance sits between your administrative users and your VMware Infrastructure systems. It can be configured either as an Ethernet bridge or as a proxy. I personally prefer the bridge approach, since it doesn’t require client-side configuration and is much harder to circumvent – intentionally or on purpose.

Figure 1. HyTrust High Level Architecture

Let’s look at the four basic functions individually:

Single Authentication Source

The appliance works in much the same way as vCenter Server – inbound administrative connections are terminated at the HyTrust appliance and HyTrust will use a single privileged account to perform host actions on the user’s behalf. The great thing about this approach is that you now have a single repository for user credentials – your Active Directory or other LDAP v3 repository. You don’t have to worry about keeping multiple authentication sources synchronized, and your users don’t have to remember a bunch of different passwords.

Granular Authorization Service

Because the HyTrust Appliance terminates inbound administrative connections, it has the ability to be very granular in its authorization functions. In addition to being able to authorize users for individual commands, such as esxcfgnas, you have the ability to authorize individual options on each command. For example, you could configure a role that has the rights to execute the command esxcfgnas -l but not esxcfgnas –a. This could be ideal for creating, for example, a role for an auditor who could come in and look at anything they wanted to, but they wouldn’t be able to change anything.

One of the really neat things that was demoed was a user connected to vCenter Server via the VIC attempting to execute a command that they are not authorized for. They were able to issue the command, but it was squashed even before it showed up as a task in the VIC status pane (and the attempt was logged). Ideally, unauthorized commands wouldn’t even show up in the UI, but the ability to prevent the command from even being scheduled for execution is a great first step.

Additionally, there is a single point for logging all actions performed against your environment.

Template-based Host Security Configuration

Another feature that was demonstrated was template-based host security configuration. OK, that sounds ominous – what exactly does it mean? It means that you can define the security settings that you want implemented for your hosts and the HyTrust Appliance can audit your hosts for compliance with your template and it can also remediate any hosts that it finds out of compliance. When the product ships, it will include two pre-defined templates that you can use out of the box or customize for your specific needs. The included templates will be base on the VMware ESX Security Hardening White Paper and the CIS VMware ESX Server Benchmark.

Additional templates may be added, and of course, you are free to create your own by modifying the included ones or starting from scratch.

Centralized Logging Facility

Since all administrative actions will be performed by the HyTrust Appliance, auditable logs can be created in one place. True, if you really have to dig in for forensics purposes, you’ll still have to go back to the source host and do log correlation and piece together an activity trail, but in many cases, you’ll have enough information in the HyTrust logs to satisfy your requirements. This can be a HUGE benefit for organizations that have regulatory obligations (such as HIPAA, GLBA, SARBOX, etc.) or for anyone who cares about security in general.

One of the things that I really liked about the log entries is that they were actually understandable! Here are just a couple examples to give you an idea:

• WARN : AUN0010I The request for {NetworkAdminUser {HT_NetworkAdmin}} to perform PowerOnVM_Task on VM : win2k3 is declined
• INFO : VVM0010O Source: 172.16.1.100 User: NetworkAdminUser Operation: RemoveVirtualSwitch
• INFO : AUN0001I The request for {NetworkAdminUser {HT_NetworkAdmin}} to perform RemoveVirtualSwitch on NETWORK : networkSystem-8 is authorized

There is enough information in the log to recreate the activities that a user has performed, the messages are structured to allow easy parsing by log analyzers, and the messages are clear enough that a human can read them and understand what’s going on.

Summary

I’ve not covered all the features that were presented in the demo, but I’ve hit what I felt were the high points. I’m eagerly awaiting the chance to put my hands on one of these boxes to put it through its paces for real.

In summary, I found the HyTrust Appliance to be a very interesting product that addresses many of the issues that nearly every virtualized environment is facing today. It enables true Role Based Access Control (RBAC) and single-source authentication for all of your VI administrative interfaces.

The only hole that I noticed in the HyTrust armor is the ESX server’s physical console. There is no way for a network-based product to protect against someone who has physical access to a system. This is true for every system and reinforces the best practice of ensuring the integrity of your security policies regarding access to systems.

As always, security is a combination of people, process, and technology. The HyTrust Appliance should be looked at by anyone who is serious about security in their environment.

Thanks Eric & Ken – I look forward to a product release in the near future!

---

More opinions can be found here:

Hytrust, virtualization under control @ Yellow Bricks / Duncan Epping
HyTrust Launches Security Appliance @ Scott Lowe
HyTrust: An Elegant Solution To a Messy Problem @ Rational Survivability / Chris Hoff
Virtually Secure – HyTrust Launches Virtual Security Appliance @ Professional VMware / Cody Bunch