0

Such as when you are completely Inside the VM, can you have your Host machine in which the VM resides be completely Encrypted while running the VM?

say for example: UBUNTU(host machine):->run VM(Arch) and have Ubuntu be completely Encrypted whilst in the Arch VM?

I have seen no questions about this and am sure it must be possible... right?

5
  • yes of course you can. To run the VM you need to boot the encrypted host and provide the key to run. Rest is the normal system running. – kelalaka Feb 12 at 22:49
  • The VM is just another program on the host. You're asking if a program can be run on an encrypted host. It would be pretty useless if it couldn't. – user10216038 Feb 12 at 23:29
  • Who does the encryption? If you mean running VM on an encrypted host, then yes. If you are saying encrypting the host from the VM, then no – Limit Feb 13 at 1:22
  • Like while in the VM the host machine becomes encrypted, rather than encrypting the VM. I'm trying to think of a way to increase security on the main machine, by having it sort of shutdown and encrypt itself like "encryption while at rest" - and that way also sucking less memory/processing from the VM – User0x01 Feb 13 at 3:22
  • The act of encrypting the host is yet another running process that will draw more memory and CPU . – user10216038 Feb 13 at 5:24
0

If I understand your question correctly, what you are after is not possible. The reason for this is that encryption can protect data while it is transit or at rest, but not while it is being processed. As the comments stated the host OS must be running in order to run the guest, so you cannot encrypt the Ubuntu partition that is also running your VMs.

A solution is to either make a dedicated machine as a hypervisor (which if you run without a GUI will consume less resources and need less patching) or to encrypt any sensitive files on your host using file encryption. An example of a program that can encrypt individual folders or the entire drive (which will not work for this use case) is Veracrypt. After creating the secured folder/container with Veracrypt, you could decrypt it only when you need access to the contents and running your VM, leaving it encrypted whenever you use the VM so that if a VM escape exploit does occur the attacker can still not read your data.

EDIT: Just making it clear that this answer is based on the below quote from the question;

say for example: UBUNTU(host machine):->run VM(Arch) and have Ubuntu be completely Encrypted whilst in the Arch VM?

You can encrypt your host/hypervisor with disk encryption to protect data during transport or rest, but you cannot have the host/hypervisor encrypted while it is actually running VMs.

2
  • 1
    " ... so you cannot encrypt the Ubuntu partition that is also running your VMs." Actually you can! documentation.help/VeraCrypt/System%20Encryption.html "Note that VeraCrypt can encrypt an existing unencrypted system partition/drive in-place while the operating system is running (while the system is being encrypted, you can use your computer as usual without any restrictions)" – user10216038 Feb 13 at 5:15
  • You can enable drive encryption while the OS is running, just like with Bitlocker for Windows. However each time you boot the computer the file system will have to be decrypted as otherwise the core files could not be read or written to. If the OP was just talking about enabling drive encryption you can do that while the OS is on, but I was under the impression that OP wanted system files on the host encrypted such as /etc/* or /sbin/* while VMs were running – anotherusername Feb 14 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.