Virtualization or chroot more secure?

[Ulysses_]

With the open-vm-tools-x extension I recently submitted, you can use Unity to give a more integrated look and use shared folders to store bookmarks and other permanent data.

Thanks.  Was it difficult?

Regarding step 5, why select Bridged then modify host firewall (if exists) instead of using NAT?

Because chances are a newbie is using a windows host. Which has a terrible reputation for security so it better be completely blocked off the internet and the VM, otherwise an infected VM might infect the host too. Through one of the many services that run in windows or exploits that exist for windows.  But then NAT is blocked too.  Whereas Bridged networking is not blocked, this somehow bypasses the firewall.

[danielibarnes]

Thanks.  Was it difficult?

It was difficult to get right and make it work with a minimum of user intervention. The more recent release of open-vm-tools is easier to compile, but it omits the vmmemctl module, so I had to compile that separately.

Because chances are a newbie is using a windows host.

Good point. Using VMware Player as you describe so completely protects the host that a chroot would not provide any additional security that I can imagine.

[Ulysses_]

Maybe ESX can be infected too, if it exposes itself to the internet and the VMs, and one of the VMs gets infected?

[danielibarnes]

Maybe ESX can be infected too, if it exposes itself to the internet and the VMs, and one of the VMs gets infected?

It is a best practice to separate your administrative network from your VM network for that reason.

[Ulysses_]

Does that imply having two network cards on the host, one for VMs, one administrative to connect to other computers in your lan?

[danielibarnes]

Does that imply having two network cards on the host, one for VMs, one administrative to connect to other computers in your lan?

Yes, most rack-mount systems include two NICs for that purpose. The administrative and virtual machine networks can be placed on a different VLANs or firewalled externally.