text_combined: bmordiconnicholsoncom ben mord hi inspired mode operation supported vmware base disk image shared multiple virtual machine vm instances base image never altered vm instance instead vm instance writes changes redo log future hard disk reads vm instance incorporate base image appropriate redo log present current disk image specific virtual machine described thanks duane providing link honeypots mailing list httpwwwvmwarecomsupportreferencecommondisk_sharinghtml could basic concept used easily make selffixing clientserver applications efficiently automatically recover attacks even attacks discovered imagine physical architectures production clientserver systems layered example basic web application might web server running apache connected application server running j2ee net business logic connected database server persistence one whose disk image really evolve time database server even often put static rdbms software one partition changeable datafiles another partition partition volatile datafiles must allowed change one boot next paritions may need writable say swap space changes could eliminated reboot someone cracks system probably change image shouldnt changed eg might leverage buffer overflow iis apache install trojan backdoor exposed web server web server ran base image writing changes delta redo partition every night automatically erased redo partition rebooted downtime involved machine would minimal deleting data rather restoring backup system redundant web servers load balancing high availability could scheduled way system always accessible baseredo partition concept could implemented level feature hardware raid allowing greater performance reliability hack resistance concept could also applied application servers even database server partitions except partitions contain table data files course anyone already new concept concept discussed abandoned reasons dont yet know use physical architecture basic web application example post concept could course applied server systems would allow hardwareseparation volatile nonvolatile disk images would analogous performing nightly ghosting operations would efficient involve less downtime thanks opinions ben tue 3 sep 2002 150427 0400 use base image delta image automated recovery attacks