3

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation possible (so full disk, but it would be nice to have temporary files created when executing the virtual machine encrypted too). The guest operating system would be Windows 7 and most likely Virtual Box would be used, but I'm open to other free alternatives. I was thinking of using TrueCrypt's full disk encryption but TrueCrypt is no long supported. The host operating system (is also) Windows 7.

It's not possible to encrypt the whole host machine.

  • Why not just encrypt the host with BitLocker? Or DiskCryptor? Or FreeOTFE? – Polynomial May 15 '15 at 16:04
  • Or put the VM files in a TrueCrypt volume or similar... – Iszi May 15 '15 at 19:46
  • @Iszi that's what I'd use to do but TrueCrypt isn't supported anymore, plus I'm not experienced with VirtualBox so I'm not exactly sure which files I'm looking for to encrypt. – Celeritas May 16 '15 at 6:02
  • You can create TrueCrypt-like encrypted volumes with Bitlocker (howtogeek.com/193013/…). All you need to do is put your VMs' hard drive files in there. You can find & configure the locations of your VMs' hard drive files in the VM configuration screens. – Iszi May 18 '15 at 12:45
3

You can not securely use encrypted virtual machines without full disk encryption on the host.

While the virtual machine is running, the host stores memory chunks, log data, configurations, and loads of other files on disk, leaving permanent forensic trail of a live decrypted virtual machine. File and project names will almost certainly be recoverable.

If you really have to, you can create a Truecrypt volume (it works fine on all Windows versions) and install VMware in it. The install would work only on the original computer you did the installation on.

If you are really paranoid, you can encrypt and external HDD with Truecrypt, and create a hidden partition it with VMware and virtual machines. Don't write too much data in the original drive, as it would destroy the hidden partition, unless that was the intention ;)

  • Right yes, that's what I'd do under normal circumstances EXCEPT 1)TrueCrypt is no longer supported 2)I don't have access to VMware and need to use VirtualBox – Celeritas May 16 '15 at 6:00
  • Truecrypt is 'okay' to use, and still a much better option than any other cryptography tool out there. – user4294507 May 16 '15 at 14:08
2

I am sorry if I am missing something simple in your question. Why not just store the image on an encrypted drive? You could store the image or the entire VirtualBox folder on the encrypted disk so that way you need the key to be able to access it.

  • "Why not just store the image on an encrypted drive?" while I'm experienced with VMware, I'm not so with VirtualBox. I've only used PGP whole disk encryption. What does mean "encrypted drive" and how is this accomplished? Are you recommending to encrypt the guest OS, host OS, or particular files on the host OS that make up the guest OS (e.g. VirtualBox's version of .VMDK file)? – Celeritas May 15 '15 at 20:18
2

You have a few options, and it'd probably be best to do at least the first two:

  1. Encrypt your host operating system's drive using BitLocker or doxbox.
  2. When installing your guest operating system, do the same thing inside the guest.
  3. VirtualBox and other VM hosts provide the option to encrypt the virtual drive. All drive contents are encrypted before written to disk.

Please note that any VM host, given enough motivation and a little bit of time, can extract the disk encryption passphrase from the guest's memory. If the guest is able to break out of the VM environment somehow and able to read the host's memory, the guest would theoretically be able to get the disk encryption password for the host as well.

The important thing is to understand how disk encryption works and what attacks it is designed to mitigate. It's almost always better to encrypt than not to encrypt, but understand why you're encrypting.

  • I said the host OS can't be encrypted – Celeritas May 15 '15 at 20:14
  • I guess what I'm asking is how do you do #2 or #3? – Celeritas May 15 '15 at 20:15
  • That depends on your software/OS. VirtualBox 5 IIRC has a UI for disk encryption. If you're using DoxBox, install Windows and then run the installer. Having never used it before, I can't comment on the process. – Naftuli Kay May 15 '15 at 22:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.