Hypervisors

One of the things that allows us to do virtualization, at least from that virtual machine level, is hypervisors.

When we have bare metal, that software, a lot of times this is an operating system, is talking to that hardware directly. When we virtualize something, we create an abstraction layer. That creates these instances that are separate from the hardware, and the software is talking to this abstraction layer instead, and then the abstraction layer is making calls to the hardware. There are a lot of advantages to setting it up this way.

When we're talking about VMs and setting up VMs, this abstraction layer here is what's known as a hypervisor. A hypervisor is essentially its own operating system. We don't call it an operating system, but it performs some of the same functionality as an operating system, talking to the hardware and managing that hardware and giving instructions to that hardware. From there, what we can do is we can turn up other instances, operating systems, on top of that. These operating systems feel like they're talking directly to hardware, but instead they're talking to the hypervisor, and the hypervisor is making calls then to the hardware. Now, this isn't always the case, but generally speaking, this is the concept of what virtualization is and what hypervisors do.

So in this case right here, we have our operating systems, and then we have applications that are running on top of those operating systems. What's great now is our applications can run separately on different instances of this without interfering with each other. Each one of these instances we could actually log into. So I could log into this operating system and then log back out and log into this one, and they would act just like your desktop or laptop or whatever you're viewing this on. You're logging into that system and you're using that system as if it's its own entity. So then we only have one piece of hardware but can access multiple versions of this operating system.

Proxmox

I've set up something called Proxmox. Proxmox is a hypervisor. So what I've done is I've taken a machine, a server, and I've installed Proxmox on top of that. And now that is essentially what is the operating system, or what we call a hypervisor, that's running that machine. And then I have many machines running on top of that.

Now, if I were to go to the machine itself and look at the actual screen, it would just give me like a couple basic options, just enough to configure an IP address on it and do some other troubleshooting. It's really basic if I were to go to the machine itself. So instead, what I do to manage this box is I go to the IP address. So I go into the IP address here, and then I can see that this is the box right here. So there's a data center, and that's just kind of a grouping here, so I can manage many different Proxmox boxes. This is the server itself, and then these are all the machines that are running under this server.

So now what I can do is I can click on one of these machines and see all the configurations of it. So this one right here is a Kali Linux box, and I can see it's up and running. I can see that it's set up with two virtual CPUs. Even though this server has something like 64 CPUs on it, I've only assigned two for this one. It's also got probably about 128 gigs of memory to it, and I've just assigned four of those gigs to this box right here. And then it's got about maybe a terabyte of information, and I've just assigned 32 GB of storage space to this. So I've assigned certain resources to this machine.

And then I can get into this machine just by clicking it, and then it opens up this machine. So now I'm interacting with this machine just as if it's installed on my desktop or laptop, and I can utilize this. This is great for testing purposes, or if I have large-scale operations and I need to roll out a bunch of servers, or this is just my lab environment. So it has a lot of applications to it, and then I can open up these other environments to it as well.

Types of Hypervisors

Now there are different types of hypervisors. So here's a hypervisor type one and a hypervisor type two. They look a little different. I'm not going to get real in-depth into the differences between these. There's just this extra operating system level. And so this is something that you could actually set up very easily at home to test out. But depending on these deployment models, there's advantages and disadvantages of them.

As far as a type one hypervisor is concerned, it can be very cost-effective, easy to deploy, scalable, simplified management. It's great for large-scale operations, and there's very diverse operating systems you can run on it. Everything we've already mentioned. Some of the disadvantages to it is it can increase complexity. We have this whole other layer, this abstraction layer, that creates some level of complexity that now we have to manage, that's extra. There's also some performance overhead, because there's some extra stuff that has to happen every time you process things, so we have some performance degradation because of that. A lot of businesses will use this. Like I say, I use this in my lab, and it's definitely something to look into and try out on your own as well.

Hypervisor type 2 has a lot of the same advantages to it, except for there is more overhead with this, because now we have an operating system layer, a hypervisor layer, and then more operating system layers. So it's somewhat limited in its scalability, but it's great for personal use or for testing. I have used it in production environments before, but it's not really as recommended as this type one hypervisor.

Security Pros and Cons

Now there are pros and cons to this from a security perspective. One of the pros to this is that it creates highly available environments. I could just have multiple bare metal machines with these hypervisors installed on it, and then if I have any issues with one of these machines, I just move this machine to another one and then I'm up and running again. So it creates highly available environments. So that's great from a security standpoint if you think about our CIA triad.

Some of the disadvantages: it does add complexity to this, it adds up that performance hit. It also can cause problems if the hypervisor has like a vulnerability. This is what I've seen before, is that the hypervisor had a vulnerability and then one machine could see what the other machine was doing, because they're sharing the same resources, they're sharing the same hardware. And so if that underlying hypervisor has a vulnerability to it, there is potential that one machine can see what's happening on another machine, which is not something that we want to happen. They need to be in secure environments. So typically hypervisors are programmed so that way they are siloed and they don't see what other machines are doing. But there have been vulnerabilities that have created some exposure.