[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [RFC][PATCH] Secure XML-RPC for Xend

Ian Pratt wrote:
The following patch implements a secure XML-RPC protocol for Xend.
Instead of using HTTPS with basic authentication and dealing with all
that nasty OpenSSL/PAM integration, it just uses SSH.  This gives you
all the properties you want (great security and PAM integration) with
very little code.

I think we just have to bite the bullet on this one. OpenSSL/PAM
integration isn't that hard, and it makes things much cleaner from a
client point of view, which is what really matters.

It's tempting to use https/basic auth since it seems like it ought to just work with existing clients. However, that doesn't appear to be the case.

Python doesn't seem to provide any real support for authentication out-of-the-box. It wouldn't be that hard to add but neither was an SSH transport.

The other problem is that Python doesn't provide support for certificate verification. That's okay if you're just using Python to screen scrap but if you're in an enterprise environment it's not a very good thing.

The other problem I'm concerned about is certificate management on our end. The average user is going have to end up using snake oil certs and I've always found configuring these things to be a real pain.

Another advantage to the SSH approach is that it makes firewall rules easier to manage. There's no additional open port. This is a minor benefit of course but I thought I'd mention it anyway :-)

Writing a client from scratch, I've found supporting the SSH method is far easy than https. Best of all, there's no additional server configuration.

I'm clearly biased though, I'm interested to know what others think :-)


Anthony Liguori

We can always use "stunnel" to make life easier.


There are some minor issues so I'd rather it not be applied
immediately.  I'd like to get some feedback from people as to whether
this approach is reasonable.  A user-facing change is that now you can
use the XM_SERVER environmental variable to specific an XML-RPC URI.

For instance:

XM_SERVER='ssh://root@xxxxxxxxxxxxxxxxxxxxx/RPC2' xm list

Runs xm list on a local machine but does all of the RPCs over a secure
connection (prompting for passwords).



Anthony Liguori

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.