Protecting the Windows using Linux

Bill Yanaire, ESQ wrote:
>
>
> "Karthik Balaguru" wrote in message

>> Hi,
>> The internet connection is in Linux (Host OS).
>> I am just eager to know if i have Windows as a
>> guest OS on Host OS(Linux), is it less possible
>> for Windows to get infected by virus ?
>>
>
> No - Make sure you have a good antivirus program on your Windows OS.
>

Running Windows as a guest within Linux will not protect it from viruses
as such - you do that by using common sense, and by avoiding risking
programs (such as Internet Explorer, Outlook / Outlook Express, and MSN
client - use Firefox, Chrome, Opera, etc., instead). If the windows
guest is connected to the network through the Linux machine (typically
using NAT through the host, rather than bridging) then the Linux machine
will act as a solid firewall and protect the Windows guest from worms
and network attacks.

There are *no* "good" antivirus programs. Anything that runs on-access
is a waste of computer resources, and you run a continuous risk that
useful or essential files will be blocked as false positives. None of
them spot more than a fraction of malware, and none are any good against
new threats. Use clamav for on-demand scanning if you need to check
specific files (such as downloaded software).

So running the Windows machine as a guest on Linux will protect your
windows machine to some extent - but no more so than if you simply used
a decent hardware firewall on your network.

The biggest protection Linux offers here is that you would be using it
for most of your browsing and emails, and only using windows for
software that has to run under windows. This hugely reduces your
chances of getting anything unfortunate on the windows machine.

>> If Windows crashes, is there a mechanism
>> to recover it from Host OS(Linux) ?

If you use Virtual Box, you can take snapshots of your Windows guest -
that makes it easy to roll back if you do catch something.

It is also easy to boot the virtual machine with a Linux live "cd"
(i.e., an .iso file on your disk) for recovery. But the host cannot
typically read the guest's virtual disk directly, and therefore your
recovery possibilities from the host are limited (though it's possible,
depending on the type of virtual disk you are using).

>> Also, is there any mechanism to debug windows
>> from linux ? Any ideas ?
>

Debugging windows itself is simply not practical.

> It's best not to use Linux at all if you can help it.
>

It's best to ignore astroturfers if you can help it.

Malware is a tiny problem in Linux because of it being a more sturdy
design (roughly speaking, Windows is designed to allow everything unless
it is explicitly blocked, while *nix is designed to block everything
unless it is explicitly allowed. Windows thus aims for ease-of-use for
users and developers, but simultaneously gives ease-of-use to malware
writers). However, you must remember that it is not immune - malware of
various sorts have been created for Linux, and a well configured and
well maintained Windows system can be safer than a badly configured and
maintained Linux system.

>>
>> I am planning to use Ubuntu as Host OS and
>> Windows Vista as Guest OS and either
>> Vmware or VirtualBox (Virtual machines).
>>

Go for Virtual Box. It's easier, freer, and the free-beer version is a
better choice for typical desktop use than VMWare's free-beer version.
Pick the free-beer version of Virtual Box rather than the free-speech
version - the USB functionality is worth the money.
 >> Stay informed about: Protecting the Windows using Linux 

On Feb 13, 9:26 pm, The Natural Philosopher
wrote:
> Karthik Balaguru wrote:
> > Okay, So how can we tweak either VirtualBox or Vmware
> > and other configurations so that the packets get filtered/scanned
> > before going to the Guest OS(Windows) .
>
> run a mail server obn linux, scan there and pickup from then on.
>
> use linux as a proxy web server. Maybe.
>
>

I think i need to go in for some content filtering web proxy,
and mostly a web proxy that would be based on ICAP .
The ICAP(Lightweight HTTP based protocol (RFC3507))
based web proxy can communicate to daemon-
based ICAP-based antivirus softwareto anti-virus capabilities
and can also remove other malware by scanning
incoming content in real time before it enters the network.


Extract from RFC 3507 -
" ICAP, the Internet Content Adaption Protocol, is a protocol
aimed at providing simple object-based content vectoring for
HTTP services.
ICAP is, in essence, a lightweight protocol for executing a
"remote procedure call" on HTTP messages. It allows ICAP
clients to pass HTTP messages to ICAP servers for some
sort of transformation or other processing ("adaptation").
The server executes its transformation service on messages
and sends back responses to the client, usually with
modified messages. The adapted messages may be
either HTTP requests or HTTP responses.

Surrogates or origin servers can avoid performing
expensive operations by shipping the work off to other
servers instead. This helps distribute load across multiple
machines. For example,
consider a user attempting to download an executable
program via a surrogate (e.g., a caching proxy). The
surrogate, acting as an ICAP client, can ask an external
server to check the executable for viruses before
accepting it into its cache. "

So, i think, this is one better way of providing
the data from internet to windows(Guest OS)
from linux(Host OS).

Any other thoughts ?

Thx in advans,
Karthik Balaguru
 >> Stay informed about: Protecting the Windows using Linux 

ToddAndMargo wrote:
>
> On 02/12/2010 11:36 AM, Karthik Balaguru wrote:
<snip>
>> I am planning to use Ubuntu as Host OS and
>> Windows Vista as Guest OS and either
>> Vmware or VirtualBox (Virtual machines).
>
> I use Virtual Box with CenOS as host.
> Guest: Xp, Vista, W7, others.
>
> Vista is horriale as a guest. Xp and W7 as
> well behaved.
>

I recommend W2K as the best windows version for guest OS's. Typically
you use a windows guest for only one or two programs - the OS and its
features are of little interest. Since most windows software runs fine
on W2K, but often not on previous versions (NT4.0), it makes sense to
use the smaller and lighter W2K over XP (and certainly compared to W7).
It also saves you from the inconvenience of "activation" (though I
assume that you have a valid license for the windows guest...).
 >> Stay informed about: Protecting the Windows using Linux 

Karthik Balaguru wrote:

> Okay, So how can we tweak either VirtualBox or Vmware
> and other configurations so that the packets get filtered/scanned
> before going to the Guest OS(Windows) .

run a mail server obn linux, scan there and pickup from then on.

use linux as a proxy web server. Maybe.


>
 >> Stay informed about: Protecting the Windows using Linux 

And so it was that in the sacred domain of comp.os.linux.advocacy, Karthik Balaguru wrote:
>> "Karthik Balaguru" wrote in message
>>
>
>>
>> > Hi,
>> > The internet connection is in Linux (Host OS).
>> > I am just eager to know if i have Windows as a
>> > guest OS on Host OS(Linux), is it less possible
>> > for Windows to get infected by virus ?
>>
>> No - Make sure you have a good antivirus program on your Windows OS.
>
> Do you mean to say that windows will get infected
> even if it runs as a guest OS on linux OS ?
> Strange !!

Not really, all a virus is, is data. Different viruses get in in different
ways. If, say, it exploits IE to run itself when you land on a certain
webpage, then whether you're using IE on windows virtualised on native, it
won't make a snot of difference.

IF your linux is properly firewalled so nothing else can get in through the
back door on your virtual windows that's ONE added layer of protection.

>>
>> > If Windows crashes, is there a mechanism
>> > to recover it from Host OS(Linux) ?
>> > Also, is there any mechanism to debug windows
>> > from linux ? Any ideas ?
>>
>> It's best not to use Linux at all if you can help it.
>>

Ignore him.
In that respect at least. Linux is safer.
 >> Stay informed about: Protecting the Windows using Linux 

Karthik Balaguru wrote:
> (...)

If you want to protect Microsoft Windows using GNU/Linux the don't let
Windows connect to the Internet directly.

Use a proxy HTTP (e.g. squid) and set it up to scan for malware. The same
for email. Setup a email server that get the mail from your accounts and
scans the email for malware. Malware also moves through IM protocols but I
don't know of any IM proxy that scans for malware.

The above can be used with MS Windows running on the hardware on in virtual
machines.

A better solution would be to move to GNU/Linux for all your Internet
activities and use MS Windows inside a VM for what ever Windows programs you
may need or want to use.

Regards.
 >> Stay informed about: Protecting the Windows using Linux 

On Sat, 13 Feb 2010 12:00:35 -0800 (PST), Karthik Balaguru wrote:


> Any other thoughts ?
>
> Thx in advans,
> Karthik Balaguru

Yea.
You'll never get a decent answer to your question in
comp.os.linux.advocacy because most of the so called Linux
"advocates" run Windows.
 >> Stay informed about: Protecting the Windows using Linux 

["Followup-To:" header set to comp.os.linux.advocacy.]
On 2010-02-13, the following emerged from the brain of Aragorn:
> On Saturday 13 February 2010 07:18 in comp.os.linux.setup, somebody
> identifying as Karthik Balaguru wrote...
>
>> On Feb 13, 1:13 am, "David W. Hodgins" wrote:
>>
>>> As with any m$ software, make sure it's protected by
>>> a properly configured router.
>>>
>>
>> Okay, but it is strange that there is no mechanism/tricks
>> in VirtualBox/Vmware to make the packets to flow
>> through the host OS to the guest OS ?
>
> I have no experience with VMWare or VirtualBox, but in my humble
> opinion, it should be possible to set up the virtual machine so that it
> uses the host OS as a router - I know that Xen supports different types
> of networking, so I would imagine this to apply to VMWare or VirtualBox
> as well.

Sure you can use different tupes of networking on vbox and vmware. I
have three Windows guests (one 2003 Server, one XP Pro and one 7
Ultimate) on my Debian host, and they are all on an internal
virtualbox network behind a FreeBSD guest, which is bridged to the
host's network on its 'external' interface.

I really need to look into Xen soon. Never used it, because at the
moment vbox offers everything I need for virtualisation (and at work
I'm 'forced' to use vmware because it is the 'industry standard').
 >> Stay informed about: Protecting the Windows using Linux 

On Feb 14, 9:03 pm, "Ezekiel" wrote:
> "TomB" wrote in message
>

>
>
>
>
>
> > On 2010-02-14, the following emerged from the brain of Ezekiel:
>
> >> "TomB" wrote in message
> >
> >>> On 2010-02-14, the following emerged from the brain of Ezekiel:
> >>>> "TomB" wrote in message
> >>>>> I really need to look into Xen soon. Never used it, because at the
> >>>>> moment vbox offers everything I need for virtualisation (and at
> >>>>> work I'm 'forced' to use vmware because it is the 'industry
> >>>>> standard').
>
> >>>> I don't get the comment about being 'forced' to use vmware. I've
> >>>> used both and I'm willing to pay money and buy vmware. What do you
> >>>> find so bad about vmware that you feel that you're 'forced' to use
> >>>> it?
>
> >>> I just like vbox better. Better command line interface.
>
> >> I suspect this comment is based on what's included 'out of the box'
> >> because
> >> if you download and install the VMware infrastructure toolkit there isn't
> >> anything that you can't script or do from the CLI. And I'm talking about
> >> some very, very low-level functionality.
>
> > Didn't know that.
>
> If you feel like taking a peek -  look here:
>
>    [URL="http://pubs.vmware.com/vi-sdk/visdk250/ReferenceGuide/"]http://pubs.vmware.com/vi-sdk/visdk250/ReferenceGuide/[/URL]
>
> To be fair - I rarely use this (once to be exactly via the Perl interface)
> but our systems group at work does some really cool stuff with this. For
> when I need the CLI with VMWare (not very often) it's usually just scripting
> like 'vmrun list | start | stop | etc'
>
> >>> Open source (the OSE edition that is).
> >> Meh - I'm more interested in what works for me. But if that's more
> >> important
> >> to you then I won't knock it.
>
> > Mind you, it's not the most important reason why I like vbox better.
> > It's just a nice plus. It also means that GNU/Linux distributors can
> > include pre-built packages in their repositories, which is nice too.
> > As Chris already pointed out installing vmware on Debian can be a
> > pain.
>
> I use it with Ubuntu which works very, very well.
>
> >>> A little faster in my experience too.
> >> This is always an interesting issue to me. VMWare tends to have better
> >> video
> >> drivers so graphic intensive tasks run faster for me on VMware. In terms
> >> of
> >> pure performance... I forget who wins. There's the case where there's one
> >> VM
> >> doing a lot of work and the case where you have multiple VM's all doing a
> >> lot of work. In one scenario VMWare usually wins and Vbox wins the other.
> >> I
> >> forget who wins which.
>
> > I never did any real comparison. It's just a general impression. Can't
> > back it up at all.
>
> Your impression might have been right. I've read some benchmarks on this in
> the past and they both do well. To a large degree it depends on what you're
> doing with the VMs but overall the performance-diffs are minor enough where
> they don't usually matter.
>
>
>
>
>
> >>> One thing vmware handles better is clean starting and stopping of the
> >>> guests along with the hosts (although it can be scripted with vbox
> >>> too).
> >> When I used VBox I didn't use it long enough to get into any of the
> >> scripting abilities. I've been a VMWare user for about 10 years now so
> >> it's
> >> a product that I'm very comfortable with which probably has a strong
> >> influence on my decision.
>
> > Sure. Same here. With vbox setting up about anything is second nature
> > to me, while on vmware I have to poke around a little sometimes.
>
> >>> My favorite way of 'virtualisation' is still FreeBSD jails by the way..
> >> Not familiar with BSD jails but after a quick search they appear to be
> >> similar to Solaris containers - which is a good thing.
>
> > Yes, very similar to that. Not 'real' virtualisation, but very cool
> > and virtually transparent in performance.
>
> Which IMO is a better solution if you need to run 'multiple instances' of
> the host OS. But if you want to run a different OS then you need to fully
> virtualize it.- Hide quoted text -
>
> - Show quoted text -- Hide quoted text -
>
> - Show quoted text -

I came across the below from internet -
The below seems to give some thoughts
regd perfomance analysis & methods used -
[URL="http://virtualizationreview.com/Articles/2009/03/02/Lab-Experiment-Hypervisors.aspx"]http://virtualizationreview.com/Articles/2009/03/02/Lab-Experiment-Hypervisors.aspx[/URL]

A very long comparative list of platform virtual machines -
[URL="http://en.wikipedia.org/wiki/Comparison_of_platform_virtual_machines"]http://en.wikipedia.org/wiki/Comparison_of_platform_virtual_machines[/URL]

Karthik Balaguru
 >> Stay informed about: Protecting the Windows using Linux 

Karthik Balaguru wrote:
> On Feb 13, 9:26 pm, The Natural Philosopher wrote:
>> Karthik Balaguru wrote:
>>> Okay, So how can we tweak either VirtualBox or Vmware
>>> and other configurations so that the packets get filtered/scanned
>>> before going to the Guest OS(Windows) .
>> run a mail server obn linux, scan there and pickup from then on.
>>
>> use linux as a proxy web server. Maybe.
>>
>>

<snip>
> Any other thoughts ?
>

Yes - it's overkill.

There are two things you need to do to keep a windows system safe. One
is to use technical measures to block things that happen without your
knowledge or consent, and the other is to use your brain to block things
that happen /with/ your knowledge and consent.

For the first part, you use a proper firewall (i.e., not a windows
software firewall) - using a Linux host as a NAT router for a guest is
perfectly good. And avoid using software that risks doing things
without asking you - i.e., avoid Internet Explorer, Outlook, MSN client,
and any other software that accesses the web using IE's engine.

For the second part, think about what you are doing, where you are
wandering in cyberspace, and what software you choose to download and run.

No amount of technical measures will ever protect you from yourself. If
you get fooled by phishing links telling you to change your bank account
password, it's /your/ fault - no proxy or virus scanner will protect
you. Even running doing your browsing from Linux won't help you.
 >> Stay informed about: Protecting the Windows using Linux 

On Feb 14, 6:41 pm, David Brown
wrote:
> Karthik Balaguru wrote:
> > On Feb 13, 9:26 pm, The Natural Philosopher wrote:
> >> Karthik Balaguru wrote:
> >>> Okay, So how can we tweak either VirtualBox or Vmware
> >>> and other configurations so that the packets get filtered/scanned
> >>> before going to the Guest OS(Windows) .
> >> run a mail server obn linux, scan there and pickup from then on.
>
> >> use linux as a proxy web server. Maybe.
>
> <snip>
>
> > Any other thoughts ?
>
> For the first part, you use a proper firewall (i.e., not a windows
> software firewall) - using a Linux host as a NAT router for a guest is
> perfectly good.  

Okay !

> And avoid using software that risks doing things
> without asking you - i.e., avoid Internet Explorer, Outlook, MSN client,
> and any other software that accesses the web using IE's engine.
>

Karthik Balaguru
 >> Stay informed about: Protecting the Windows using Linux 

Karthik Balaguru wrote: > On Feb 14, 6:41 pm, David Brown >
wrote: > > Karthik Balaguru
wrote: > > > On Feb 13, 9:26 pm, The Natural Philosopher
wrote: > > >> Karthik Balaguru wrote: > >
>>> Okay, So how can we tweak either VirtualBox or Vmware > > >>> and
other configurations so that the packets get filtered/scanned > > >>>
before going to the Guest OS(Windows) . > > >> run a mail server obn
linux, scan there and pickup from then on. > > > > >> use linux as a
proxy web server. Maybe. > > > > <snip> > > > > > Any other thoughts ?
> > > > For the first part, you use a proper firewall (i.e., not a
windows > > software firewall) - using a Linux host as a NAT router
for a guest is > > perfectly good.   > > Okay ! > > > And avoid using
software that risks doing things > > without asking you - i.e., avoid
Internet Explorer, Outlook, MSN client, > > and any other software
that accesses the web using IE's engine. > > > > Karthik Balaguru
 >> Stay informed about: Protecting the Windows using Linux