How to restrict access to backdoor port without restrict_backdoor?

[Pyr0Texn1c]

The question is: can I use some of OS (Windows Server 2008 R2) methods to block access to ESXi backdoor port from any program except VMware tools so that I don't need to set monitor_control.restrict_backdoor parameter? Or, maybe, can I change some of VMware tools parameters to override the effect of monitor_control.restrict_backdoor parameter?

[Kedar_D]

Please refer to the hardening guide.

http://www.vmware.com/security/hardening-guides.html

[admin]

You can restrict individual hypercalls with various "isolation.tools.*" settings, but there is no way to restrict hypercalls from the guest on a per-process basis.

[admin]

Actually, the semantics of restrict_backdoor is that, when set, access to the backdoor port requires normal x86 I/O port permissions.  If Windows offers a way to raise the IOPL of the VMware Tools process to equal its privilege level, then it could still make hypercalls, even with monitor_control.restrict_backdoor=TRUE.

[admin]

Alternatively, if Windows provides facilities for a per-process (or per-thread) scheduling hook, you could make a hypercall from the process or thread hook to dynamically disable restrict_backdoor on entry to a VMware Tools process (or thread) and to dynamically enable restrict_backdoor on entry to any other process (or thread).