3:16 p.m.
On Mon, Jan 15, 2007 at 08:44:22PM +0000, Mark McLoughlin wrote:
Hi Dan,
On Wed, 2007-01-10 at 23:59 +0000, Daniel P. Berrange wrote:
> I now have the QEMU backend working with full wire encryption using the
> TLS protocol, and so ready to start thinking about various authentication
> related issues.
If only we had decent SSH infrastructure. I'd love if apps could easily
use a library to request an SSH connection to a host, authenticate and
then apps could request tunnels over that shared per-user connection.
The actual TLS code in the server daemon & client backend was soo trivial
that I actually quite like it from that POV. Its the external administrative
bits where SSH wins I guess, by virtue of fact that most people already
have it widely deployed. Then again I'm far from certain everyone neccessarily
wants application remote access of this kind tied into the general SSH shell
service. While you can restrict what users can run by using authorized_keys
entries & and enumerating particular commands, this then starts to increase
the administrative complexity to point where there's less differentiation
between SSH & TLS setup.
> - The client needs to have the certificate of the CA in order
to
> validate the signature on the remote server's certificate
> (aka, just like web browsers need a set of CA certificates)
>
> Currently I just have it loading 'cert.pem' out of the current
> working directory of the app using libvirt. Obviously this is not
> a real solution.
Personally, I'd start with the assumption that essentially no-one will
install a CA signed cert for the libvirt server. So, first and foremost,
the client needs to be present self-signed certs to the user.
As for the CA certs, we should use /etc/pki/tls/cert.pem by default,
right? And perhaps allow users and admins to install other CA certs just
for libvirt.
Yeah, as Rich suggested, we should definitely try to use the appropriate
system directories for storing certs & CA certs if there's something sane
we can do here. For client apps we do still need a $HOME/.XXXX directory
since we need to be able to run clients without root privileges.
> - The server end can optionally require the client to present a
> certificate too, as its means of authenticating the client.
>
> This obviously requires a way of specifying the client certificate
> and secret key in libvirt when opening the connection.
For the networks stuff, I think the server will also need to be able to
connect to (and authenticate and be authenticated by) other servers.
Good point.
Also, as much as it sucks, I think we'll want password based
authentication as well as certificate based authentication. Very few
people will copy the client cert over to the server, I think.
I'd really like to just have everyone use mutual certificate authentication,
but I fear there is a class of people who just like passwords, or tieing into
a kerberos authentication system. As long as we don't lock ourselves out of
adding in extra auth at a later date though, I think I'd like to stick with
just certificates for the initial implementation.
> $HOME/.libvirt/tls/
> |
> +- ca
> | |
> | +- cert.pem
> | +- ca-crl.pem
> |
> +- client
> | |
> | +- cert.pem
> | +- key.pem
> |
> +- server
> |
> +- trusted.pem
Not entirely unreasonable, but I think I'd expect it to be in
~/.virt-manager and have a ~/.virshrc which you could point at it.
If it was ~/.libvirt, then I'd expect virt-manager to access the certs
through e.g. virConnectGetCertData() rather than making the directory
structure part of the API.
One final point on all that - "uggh".
I hear your pain. Perhaps we should design it so that it does use ~/.libvirt
at the client end and have the backend drivers just 'do the right thing'
loading the files as needed to avoid requiring every user of libvirt to know
about these APIs, except for an (optional) virConnectSetCertificateValidator
one ?
> typedef int (*virConnectCertificateValidator)(const char
*hostname, const char *cert);
>
> int virConnectSetCertificateValidator(virConnectCertificateValidator cb)
>
> The applications like virt-manager would probably want to present the
> certificate details to the user for validation, also optionally maintaining
> a list of previously trusted server certs.
The callback approach seems fine. I'd think about adding a
virConnectCertificate structure whose contents are only available
through accessor functions and passing that to the callback, though. For
future expansion.
Regards,
Dan.
--
|=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=|
|=- Perl modules: http://search.cpan.org/~danberr/ -=|
|=- Projects: http://freshmeat.net/~danielpb/ -=|
|=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|