RE: [Xen-users] XCP: Insecure Distro ?

[<admin@xxxxxxxxxxx>]

The only way somebody can access that file in the dom0 of XCP is if they
already have the root password and are logged into the XCP dom0 as root.

As several of us have already explained, the dom0 in XCP is a special part
of the appliance.  The dom0 is not intended to be used for running random
Perl scripts or letting multiple users log in.  Use a domU for doing those
things.

Also, in your comment, you use Xen and XCP interchangeably.  Xen is part of
XCP, but Xen and XCP are not the same thing.


-----Original Message-----
From: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
[mailto:xen-users-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Adrien Guillon
Sent: Wednesday, May 11, 2011 3:45 PM
To: Michael South
Cc: Xen List; Jonathan Tripathy
Subject: Re: [Xen-users] XCP: Insecure Distro ?

> In this case, adding a shadow file will not actually increase security.
The best it could do would be to provide "check the box" "warm and fuzzies"
for people who do not understand shadow's purpose. As such, it would be a
_false_ sense of security. This may be the case here; "if I have shadow
files, then it's safe to expose the dom0 login to the bare internet."

I don't believe this, rather I believe that if any daemon has a
problem at all... literally anything since it's globally readable...
the hash can be exposed.  I think that the discussion started to go
onto a tangent on security of management interfaces and all of these
topics which are indeed important, but tangential.  The security of
the system is now determined by the lowliest application, some defunct
Perl script running as "nobody" can now expose a password hash.  Yes,
as we discussed, we can isolate the network.  But I think you all have
to see that even with it isolated, the problem is still there.

As evidenced by this thread, there is quite a bit of good information
on "how Xen is meant to be used" which was not evident to me in the
documentation that I read.  I think that a nice wiki page on "best
practices" or "suggested setup" could convey to the rest of the world
what you have taken the time to convey to me.  Heck, someone can
probably write a nice article based on some of the ideas brought up in
this thread.  This would do a lot for others who are looking at Xen as
I was.

I still will not budge on the problems with /etc/passwd.  I understand
the evidence and arguments presented.  However, the issue is that any
user (I'm talking system users, not people here) can get access, even
if it is on "the internal network".  We have discussed the need to
separate a potentially insecure interface from the "big bad Internet",
and I agree fully with this.  However, in my view there is still a
problem.  It's like saying "yes, yes... if you ping the system it will
email you the password... but we don't allow ping see, we put it on a
separate isolated network where ping is not allowed... where do you
see a problem?!"  I believe, personally, this is avoidance of a
problem, and when it comes to open-source software I think problems
should be confronted, that is why I am here.

Regarding updates, could it be that shifting XCP to a Debian-based
distribution will help?  I admit I have some bias, since I prefer
Debian-based distros (although I did have a fling with Gentoo for a
few years, but it's over between us).  Should we, perhaps, make a
concerted effort to adjust XCP to be a hardened distro rather than
just a fork of something put out by Citrix?  This discussion likely
belongs on the devel list, but I just wanted to put it out there.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users



_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users