I run an IPv4 server in a Fedora virtual machine. This server hosts a git service for a group of developers and is open to the internet. As a consequence, it is confronted to hacking attempts (mainly from Ukraine and China). I'd like to reduce its exposition to unwanted access to improve security of the host machine (access to the VM opens access to the virtual bridge then to the LAN and exposes the physical local machines).
To limit risks, the server has a very minimal configuration: base OS, git, shell but no compilers. Only ssh is open through the firewall. The fact that ssh service is on an unusual port does not add any security, as shown by the attempts.
Presently security relies on strong passwords.
Filtering on source IP in the host system before forwarding to the VM does not work well (partly because all connections seem to come from the box) and may not be desirable because some contributors have dynamic IPs.
The VM firewall has a white list (local LAN and some contributors) but I'm not sure if other connections really get drop or reject (I'd prefer drop) or are allowed through.
To protect the VM, I'd like to switch it on only on certain time slots, e.g. 00UTC to 01UTC after agreement with the developers.
Question How to schedule shutdown every day? gives a clue for switching off a VM.
- However, how does that translate for a systemd machine without an /etc/rc.local ?
The VMs are automatically started when the host system boots. I want to change that to defer VM activation.
- Would a cron job with a
virsh start <domain>be a good idea?
The above mentioned question recommends the KISS principle. Is there a better way to do it?
As an alternative, could the firewall be programmed with time slots so that it drops incoming packets outside the time window and accepts them only during the set time interval?
Configuration: Fedora 28, KVM/QEMU, systemd Several servers on different local systems with dispatching from the first physical machine hit from the internet. Servers may be real or virtual machines. The latter case introduces another level of forwarding.