19.2. Best practices for securing virtual machines

Secure the virtual machine as if it was a physical machine. The specific methods available to enhance security depend on the guest OS.

If your VM is running RHEL 10, see Securing RHEL 10 for detailed instructions on improving the security of your guest system.

Ensure SELinux is in Enforcing mode:

# getenforce
Enforcing

If SELinux is disabled or in Permissive mode, see the Using SELinux document for instructions on activating Enforcing mode.

Use VMs with SecureBoot:

SecureBoot is a feature that ensures that your VM is running a cryptographically signed OS. This prevents VMs whose OS has been altered by a malware attack from booting.

SecureBoot can only be applied when installing a Linux VM that uses OVMF firmware on an AMD64 or Intel 64 host. For instructions, see Creating a SecureBoot virtual machine.

Do not use qemu-* commands, such as qemu-kvm.

QEMU is an essential component of the virtualization architecture in RHEL 10, but it is difficult to manage manually, and improper QEMU configurations may cause security vulnerabilities. Therefore, using most qemu-* commands is not supported by Red Hat. Instead, use libvirt utilities, such as virsh, virt-install, and virt-xml, as these orchestrate QEMU according to the best practices.

Note, however, that the qemu-img utility is supported for management of virtual disk images.