VMware Cloud Community
cypherx
Hot Shot
Hot Shot

Why would you want to disable copy and paste between vm and host? That is very convenient.

There's nothing more frustrating than working on a VM and finding out you can't copy and paste links or command snippits, or anything between the VM and the host machine.  Many times doing research on websites to find the proper download link or command, its is better to do that on a workstation than do web browsing on a server.  So you find the link or command and you copy it, but cannot paste it into the VM?  The security hardining guide explains that the features are disabled by default but its still recommended to put isolation.tools.copy.disable = true and isolation.tools.paste.disable = true.  However its a nuisance to have to use the network to browse an SMB share to grab a text file with pasted texts, licence keys, links, webex links for vendors, commands, etc....  If anything I think that is more of a security hole because now your using SMB and traversing the network via a file.  Access to the VM through vSphere is protected by a username and password anyway.  Then the VM itself likely goes into a lock screen or you lock it manually (or logoff in *nix vm's) where even if someone broke into vCenter, now they have to guess the password to the Vm, for what, copy and paste?  Well if they made it that far, there are far more things to worry about than copy and paste.

So I'll admit, In PowerCLI I ran Get-VM | NewAdvancedSetting -Name "isolation.tools.paste.diable" -value $false and Get-VM | NewAdvancedSetting -Name "isolation.tools.copy.diable" -value $false just because its more convenient.

Anyone here know what really makes copy and paste a security concern?  Heck if I copy something sensitive to the clipboard, before I am done I will usually overwrite it and copy just the letter A or something into the clip board to clear it anyway.

0 Kudos
2 Replies
randomname
Enthusiast
Enthusiast

Potential attack vector by which a compromised desktop could self-propagate its infection to an otherwise securely segregated virtual machine, and vice versa, by moving undesired data and/or code back and forth between the two endpoints.

0 Kudos
Texiwill
Leadership
Leadership

Hello,

The goal is to not have ANY sensitive data within the client clipboard as there is malware or other programs that regularly accesses the clipboard. Defense in depth says to disable it specifically if you are moving between trust zones or deal with sensitive data in any way within a trust zone. This is one way data can be leaked. Data can leak faster than you can overwrite it. Humans are just not fast enough and forgetful, you may paste sensitive data into something where it should not be and leak it out that way.

If you do not deal with sensitive data then you can probably ignore. Note, that this is apropos to the VMware clients, other mechanisms as needed for things like RDP.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009-2015

Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.

Virtualization and Cloud Security Analyst: The Virtualization Practice, LLC -- vSphere Upgrade Saga -- Virtualization Security Round Table Podcast

--
Edward L. Haletky
vExpert XIV: 2009-2023,
VMTN Community Moderator
vSphere Upgrade Saga: https://www.astroarch.com/blogs
GitHub Repo: https://github.com/Texiwill
0 Kudos