Compatibility with Vulnerability Scanners

[acca]

Regards,

As part of the corporate policy, I've received the request to install the vulnerability scanning agents on the bare metal servers running the latest version of the Proxmox hypervisor.

These agents are designed for the end-point use case and can be aggressive while scanning the file system, processes, network communication, etc. I'm concerned about the impact of these tools on the Hypervisor operations. Is there any recommendation or advisory on installing the vulnerability scanner agents on the hypervisor?

Thank you in advance!

 

[Moayad]

Hi,

One potential concern is that the agents may consume a significant amount of system resources while they are running scans, which could lead to slowdowns or even crashes of the VMs running on the System. Otherwise, the agents may cause increased network traffic or file system activity, which could disrupt the normal operations of the VMs.

I would simulate installing the vulnerability scanner on a test environment first before running it in a production environment in order to avoid any issues and test the behavior.

Is there any recommendation or advisory on installing the vulnerability scanner agents on the hypervisor?

My personal recommendation would be the following (maybe someone else will have other recommendations):
- Schedule the scan on off-peak hours (to avoid the high network traffic)
- Make double-check to have a valid backup for the important images and configs file.
- I would also reach out to the vendor of the vulnerability scanner to inquire about any guidelines they may have for utilizing their software on Proxmox VE.

 

[acca]

Hi,

One potential concern is that the agents may consume a significant amount of system resources while they are running scans, which could lead to slowdowns or even crashes of the VMs running on the System. Otherwise, the agents may cause increased network traffic or file system activity, which could disrupt the normal operations of the VMs.

I would simulate installing the vulnerability scanner on a test environment first before running it in a production environment in order to avoid any issues and test the behavior.



My personal recommendation would be the following (maybe someone else will have other recommendations):
- Schedule the scan on off-peak hours (to avoid the high network traffic)
- Make double-check to have a valid backup for the important images and configs file.
- I would also reach out to the vendor of the vulnerability scanner to inquire about any guidelines they may have for utilizing their software on Proxmox VE.

Sounds reasonable. Thank you very much for your help and swift reply...