1

Let's say that on my personal computer, I host a VM I use to do software development. My personal computer is connected to the internet and running Ubuntu 16.04 and my guest is CentOS 7.

I don't want to bother with SSH keys or passwords on that guest but, should I?

If so, are there other options or should I always make my VM as secure as my personal computer?

Thanks

3

The answer to that depends. Is your VM connected in a host only network? or a virtual subnet that is not connected to the internet? or is the vm also allowed to access the internet (i.e. bridged or nat)?

Having root access to a machine on your network with no password is a huge security risk. If it got exploited somehow, it would give an attacker carte blanche to download all kinds of penetration testing tools and network assessment software (think apt-get install nmap, mysql-client, etc...) and basically roam around your network as if they were sitting right next to you connected to your wifi.

If the vm is connected in host only or is in an isolated subnet then it basically is about as secure as your host os, given you haven't made some ridiculous misconfiguration somewhere. Since, the host would have to be exploited first. But personally, I wouldn't feel safe in this situation either. But then again, I'm the paranoid sort.

Setting up ssh keys isn't that much of a pain. It might take all of 5-10 minutes to accomplish. There are many guides on how to do it easily, like this one from Digital Ocean and, although I highly recommend against it, you can even make keypairs that require no password if you absolutely must. At least that way someone would require the ssh key to connect making it more difficult than just logging in.

But to answer your title question bluntly, if your development vm is connected to the internet with root access, no password and is available a good percentage of the time, the security implications are potentially complete and total compromise of your internal network. I'd really recommend against it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.