[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] RE: [Xen-devel] [PATCH] xen-2.0: privileged port connections
> > 1) ports < 1024 are reserved although 732 is currently unassigned > > Note that NFS uses such ports without asking prior permission. > I chose 732 because it's unassigned indeed. Grabbing any port <1024 should do, there's no need to just go for 732, but have a series of ports that are tried. > > 2) unix domain sockets would solve the same problem > > Yes. There's one but: > > With the patch you can currently configure xend from completely > open (xend-address '' and xend-privileged-port 0) > to closed (xend-address 'localhost' and xend-privileged-port 1) > except for root (and stuff I overlooked or did not do yet). > > If you go for Unix Domain Sockets instead TCP, you lose the ability > of remote control. Unless you support both. > > I did not investigate how difficult to do that would be. > If you have a patch, I'd volunteer to review :-) For Xen 2.x, unix domain sockets would be too much of a pain to implement over Twisted. Kurt's approach gets us closer toward 'secure by default'. Xen 3 will be very different. > > 4) you still have to find a way to deal with the consoles > > Before I start working on getting the consoles under control, I > wanted to see whether this approach is acceptable at all. I think it's a good band-aid. Perhaps a better way to handle consoles would be to use 'screend', and then have incoming ssh connections dispatched to particular screen sessions. > > 5) you still have to deal with xfrd > > It seems to listen on *:8002 ... > Is there no authentication either? Sigh. > > And we probably need to look into the event channel (8001) as well. Xfrd needs an option to listen only on localhost. (It's still needed for save/restore even if you don't use migrate). The event channel only ever needs to be localhost (and could probably be turned into a unix domain socket quite easily). Ian ------------------------------------------------------- This SF.net email is sponsored by Microsoft Mobile & Embedded DevCon 2005 Attend MEDC 2005 May 9-12 in Vegas. Learn more about the latest Windows Embedded(r) & Windows Mobile(tm) platforms, applications & content. Register by 3/29 & save $300 http://ads.osdn.com/?ad_idh83&alloc_id149&op=click _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.sourceforge.net/lists/listinfo/xen-devel
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |