Accepted Solutions
Hi,
The only excuse for installing AV into your COS that i can think of would be if you are offering SMB shares from the console.
That could possibly get loaded with viruses. As for the console itself, it's a RHEL derivative, you don't have to worry about viruses, it's a windows thing, still is, not likely to change.
The issue you should be worried for is getting rooted, not getting a virus and you cannot run antivirus software to protect you against being rooted. Heck if you are rooted, there's NO software that can reliably confirm this for you. Not unless you have installed software to help detect this BEFORE the hack happened.
As stated earlier, the console has a built-in firewall and only has a few services running, it is not a windows desktop with users clicking on links in emails etcetera. Getting infected with a virus is highly unlikely.
--
Wil
Thanks for all the info guys, I will have to flip a coin for the points! 
So is it true (what I said above), that if I have 3 different zones sepearted by FW, and the SC network is not routable, I will need 3 VC Servers?
Thanks
In addition to what was said before.
The new 3i version of vmware cannot even be infected by a virus as it sits in flash memory.
Edward,
But your "could" is pretty hypothetical isn't it? Especially when you are talking about getting infected with a virus.
If you didn't misconfigure your ESX pretty badly then how is the virus going to get in? What will execute it?
I agree it is possible, like it is possible for routers to get infected with worms and malware and this is something i've actually heard before... but i still think that we are then talking about rootkits and not about a simple virus.
Hello,
New things are being created daily, what we say may not happen today, will not be the case tomorrow. If the system is properly configured can a virus get in.... Not sure actually, there are so few Linux virus' out there that well most are trapped by other things up the road. But could it, yes, will it? Not sure. So is it hypothetical, yes....
However, if 3i has the vulnerability to allow it to happen or a root kit to be installed, then a reboot just means they (the nebulous hackers) just have to redo it every time. This type of thing takes seconds to do. I have been working with penetration testers and it is amazing how fast a system can be infiltrated, takes seconds. So should 3i have AV/chkrootkit or something like that available to it? I think so... I always err on the side of being overly cautious. 
Best regards,
Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074
Well the point i tried to make is that a virus requires HUMAN action in order to propagate.
If i'm not mistaken that's inherently part of the definition of a virus, it replicates and does so by a human taking action like browsing to a dark site on the web, getting a drive-by exploit from a rogue ad-site, users clicking links in IM chats, emails....
If the malware can replicate by itself, we are talking about worms.
The administration console should not be used for any of the above.
One of the other things with AV is that it uses the "enumerate badness" technique, a bit of a self downplaying technique as it depends on the virus be known to the AV first and then hope its digital signature is accurate enough to recognize it in the wild. So your AV won't catch original malware, freshly rehashed public exploits (which are trivial to make). The AV won't catch it, unless it uses a engine that uses some heuristic engine to verify for other typical virus-like behavior. This exists, but also generates false positives. So AV is ok as an extra safety net on a normal desktop/server, but that's what it is, an extra safety net, nothing more. I don't like them much anymore as they tend to create a false sense of security to the average computer user.
Unfortunately while people tend to think that their AV engine checks for all types of malware, it doesn't. Most AV vendors want you to buy other AV suits for that. Seen too many owned windows boxes with "everything" up-to-date (OS/AV) to still trust AV to catch the badness for me. Am I paranoid? Maybe, it's a security paranoid thing which i think is good as it keeps one sharp. But it eats up hours sometimes too
You are correct about the ease of penetration these days (was easier in the past really) by the availability of "professional exploit" bundles that are available nowadays with the black hat community moving more and more to the criminal site of things. It's a fast moving world...
... as it is SOMETHING that you can do
Sure I agree
the way 3i closes off most of the traditional aspects of this is just frightening. I want logs, without which I can not tell what is happening to my critical hardware....
Yikes, that would led me to believe that 3i is actually less secure. I suppose you can still setup a syslog server to mitigate this. Unfortunately haven't been exposed to 3i yet. Didn't have the time to visit vmworld 2007 
...and trust that the vendor fixes everything
Heheh.. yeah i know and with the current java/swf attacks, the hackers are moving from OS exploits to application exploits.
So on windows you need something like secunia's PSI to make sure your desktop isn't fragile.
more to the criminal side of things, it is laws being passed that make it criminal for them to even do their research...
You are referring to the german anti hacker law i suppose. A very silly law. No i meant that nowadays there is lots of money to be made if you are an elite hacker. Back in the days when i knew people from a group that had something to do with dead cows, there was no money connected to this and it was much more about skills. Those guys are now working for top security firms. Of course there was black hats back then as well.
When there is alot of money, there's criminals too.
Ok, i'm going to shut up now as it seems i've hijacked the thread too much already