JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
Oracle VM Server for SPARC 3.1 Security Guide
Oracle Technology Network
Library
PDF
Print View
Feedback
search filter icon
search icon

Document Information

Using This Documentation

Chapter 1 Oracle VM Server for SPARC Security Overview

Security Features Used by Oracle VM Server for SPARC

Oracle VM Server for SPARC Product Overview

Applying General Security Principles to Oracle VM Server for SPARC

Security in a Virtualized Environment

Execution Environment

Securing the Execution Environment

Defending Against Attacks

Operational Environment

Threat: Unintentional Misconfiguration

Countermeasure: Creating Operational Guidelines

Threat: Errors in the Architecture of the Virtual Environment

Countermeasure: Carefully Assigning Guests to Hardware Platforms

Countermeasure: Planning an Oracle VM Server for SPARC Domain Migration

Countermeasure: Correctly Configuring Virtual Connections

Countermeasure: Using VLAN Tagging

Countermeasure: Using Virtual Security Appliances

Threat: Side Effects of Sharing Resources

Evaluation: Side Effects Through Shared Resources

Countermeasure: Carefully Assigning Hardware Resources

Countermeasure: Carefully Assigning Shared Resources

Summary: Side Effects Through Shared Resources

Execution Environment

Threat: Manipulation of the Execution Environment

Evaluation: Manipulation of the Execution Environment

Countermeasure: Securing Interactive Access Paths

Countermeasure: Minimizing the Oracle Solaris OS

Countermeasure: Hardening the Oracle Solaris OS

Countermeasure: Using Role Separation and Application Isolation

Countermeasure: Configuring a Dedicated Management Network

ILOM

Threat: Complete System Denial-of-Service

Evaluation: Complete System Denial-of-Service

Countermeasure: Securing the ILOM

Hypervisor

Threat: Breaking the Isolation

Evaluation: Breaking the Isolation

Countermeasure: Validating Firmware and Software Signatures

Countermeasure: Validating Kernel Modules

Control Domain

Threat: Control Domain Denial-of-Service

Evaluation: Control Domain Denial-of-Service

Countermeasure: Securing Console Access

Logical Domains Manager

Threat: Unauthorized Use of Configuration Utilities

Evaluation: Unauthorized Use of Configuration Utilities

Countermeasure: Applying the Two-Person Rule

Countermeasure: Using Rights for the Logical Domains Manager

Countermeasure: Hardening the Logical Domains Manager

Countermeasure: Auditing the Logical Domains Manager

Service Domain

Threat: Manipulation of a Service Domain

Evaluation: Manipulation of a Service Domain

Countermeasure: Granularly Segregating Service Domains

Countermeasure: Isolating Service Domains and Guest Domains

Countermeasure: Restricting Access to Virtual Consoles

I/O Domain

Threat: Experiencing a Denial-of-Service of an I/O Domain or a Service Domain

Evaluation: Experiencing a Denial-of-Service of an I/O Domain or a Service Domain

Countermeasure: Granularly Configuring I/O Domains

Countermeasure: Configuring Redundant Hardware and Root Domains

Threat: Manipulation of an I/O Domain

Evaluation: Manipulation in an I/O Domain

Countermeasure: Protecting Virtual Disks

Guest Domains

Countermeasure: Securing the Guest Domain OS

Chapter 2 Secure Installation and Configuration of Oracle VM Server for SPARC

Chapter 3 Security Considerations for Developers

Appendix A Secure Deployment Checklist

Oracle VM Server for SPARC Product Overview

Oracle VM Server for SPARC provides highly efficient, enterprise-class virtualization capabilities for Oracle's SPARC T-Series servers as well as the SPARC M5 server and Fujitsu M10 systems. Using the Oracle VM Server for SPARC software, you can create many virtual servers, called logical domains, on a single system. This kind of configuration enables you to take advantage of the massive thread scale offered by these SPARC servers and the Oracle Solaris OS.

A logical domain is a virtual machine that contains a discrete logical grouping of resources. A logical domain has its own operating system and identity within a single computer system. Each logical domain can be created, destroyed, reconfigured, and rebooted independently, without requiring you to perform a power cycle of the server. You can run a variety of application software in different logical domains and keep them independent for performance and security purposes.

For information about using the Oracle VM Server for SPARC software, see Oracle VM Server for SPARC 3.1 Administration Guide and Oracle VM Server for SPARC 3.1 Reference Manual . For information about the required hardware and software, see Oracle VM Server for SPARC 3.1 Release Notes .

Figure 1 - Hypervisor Supporting Two Logical Domains

image:Graphic shows the layers that make up the Logical Domains functionality.

Often, an Oracle VM Server for SPARC system has only a control domain that provides the services that are performed by I/O domains and service domains. To improve redundancy and platform serviceability, consider configuring more than one I/O domain on your Oracle VM Server for SPARC system.