Let's say I am hosting several services on my server, for instance, email and a web page. I am concerned that the web server software may have unknown vulnerabilities in it, which will allow an attacker to take over my machine. The attacker will then have access not only to my website, but also my emails!
I could solve the problem by simply having two separate physical machines, each one dedicated to a server. If the attacker breaks into the web server, he can only see the web site. To see emails, he must break into the email server.
I don't want to actually buy a new server for each service I'm running, so as a compromise I thought I could use virtual machines. In this model, the host OS runs a secured SSH server and a VM software. For each service, a new virtual machine is created, and configured to provide that service.
My model can be catastrophically defeated in two ways:
- Attacker breaks into the SSH server, essentially gaining access to all VMs.
- Attacker finds a security flaw in the VM software, and manages to tunnel out of the compromised VM into the host OS.
However, if both of these are harder to do than simply exploiting a vulnerability in one of the myriad of services I want to host, it seems like the attacker's life has been made much more difficult. He must first realize that the servers are actually VMs on the same machine, then exploit e.g. the web server, and then defeat the virtualization on top of that - this seems harder to do than just exploiting the web server.
My question is, is this sort of strategy actually reasonable and practical for a non-enterprise set up? Do drawbacks like slower performance from running many OSes, disk space wasted on each OS, justify the realistic security gain (if any)?
My primary security goal is to compartmentalize individual services, so that gaining access to the machine through one service (eg. web server) does not immediately provide access to private data of other services (such as emails of the mail server). Every time I add a service to my server, I feel like I'm just adding yet more potential vulnerabilities and exploits that attackers can use and take everything - it would be preferable if, when a flaw in one service is exploited, only that service itself is compromised.