[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] Individual passwords for guest VNC servers ?
On Fri, Sep 22, 2006 at 02:54:24PM +0100, Ian Pratt wrote: > > Passing around passwords either on the command line, or environment is > a > > big red flag from a security POV. Also the Xen guest & xend config > files > > all default to world readable. I think we should follow the Apache > model > > and store the passwords out-of-band from the main config. eg > > > > (vncpasswordfile '/etc/xen/vncpassword') > > > > At this point it would make sense to have one password file for all > guests, > > and store them in format: 'vm-name: pw-hash' > > The new life cycle management stuff in post 3.0.3 xend changes this > quite a bit as a config file is only used when initially creating a VM, > and then information about it gets stored in xend's database. The > current password associated with a VM would be one of the parameters > stored in the database, and should be updated using 'xm vnc-password' or > shuch like. As long as XenD makes sure its DB is not world readable, this sounds reasonable. > > As Ian just suggested we could have command 'xm password' for > updating > > these passwords (cf apache's htpasswd command) > > > > Now when launching qemu-dm, we can either pass the path to the > password > > file on its command line, eg -passwordfile /etc/xen/password, or > > passs the actual password to qemu-dm down a pipe (eg qemu-dm would > read > > the password from filehandle 3 upon startup). The latter would be my > > preference, since then we could isolate the password handling stuff in > > Xend, and not duplicate it in qemu-dm, and the paravirt equivalent. > > I wouldn't rely on qemu-dm staying in dom0. I think the information > should be passed transiently via xenstore. Yeah, that's probably best solution particularly since qemu-dm is already reading/writing to the xenstore it should be little work to also fetch the password from there. Dan, -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=| _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-devel
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |