Encrypting guest OSes on ESXi 6?

Question

linux

Good afternoon.
1. Does it make sense to encrypt virtual machines if ESXi itself is unencrypted? Can an attacker, having gained physical access to the esxi server, gain access to the encrypted virtual system?
2. If anyone has experience, tell me how much the performance of the guest system drops? Are there any glitches in encrypted virtual OS on esxi? If VeraCrypt (for Windows) and dm-crypt (for Linux) are used.

Answer 1

if ESXi itself is unencrypted?

And what is "ESXi itself is encrypted?" What exactly are you going to encrypt in it?
It depends on what state this server will be in at the time of obtaining physical access. If it is turned off, then there is practically no chance to pull something out of the disks (it is assumed that the encryption keys you have are different on all machines, quite complex and not written on a piece of paper glued to this server). If enabled, some data can be pulled out. Having made, for example, a snapshot along with the contents of the VM RAM, and rummaging through this very RAM, they will catch something from caches and other similar places in RAM.

Answer 2

Does it make sense to encrypt virtual machines if ESXi itself is unencrypted

Think for yourself. They just cloned your system. The password of a privileged user is quite easy to kill. Although this is not necessary. Certain data is needed: application files, database, logs - all this is pulled off the disk quite easily. Now consider the losses from the fact that your data is completely gone.

can access the encrypted virtual system

In theory, no. But I would like to check it myself.

If anyone has experience, tell me how much the performance of the guest system drops?

That was a long time ago. In those years, the decline was in the region of 15% to 35%. A lot depends on how applications work with the disk.