Re: [Libvir] PATCH: 3/10: auth configuration support

On Thu, Nov 29, 2007 at 05:18:06PM +0000, Daniel P. Berrange wrote: > This patch provides the ability to configure what authentication mechanism > is used on each socket - UNIX RW, UNIX RO, TCP, and TLS sockets - all can > have independant settings. By default the UNIX & TLS sockets have no auth, > and the TCP socket has SASL auth enabled. The /etc/libvirt/libvirtd.conf > file lets you override these options. > > There is also a new sasl_allowed_username_list = ["admin"] config > param to let you whitelist the users you want to allow. This supports > use of wildcards. The username is dependnat on the SASL auth mechanism. > For DIGEST-MD5 it will be plain usernames, for Kerberos it will be a > username + realm, eg admin EXAMPLE COM > > After discussion with Rich, I also remove the tls_allowed_ip_list for > whitelisting source IP addresses. This was a) not protecting us because > it was only checked after the TLS handshake - thus allowing trivial DOS > attack b) much easier to handle via tcp wrappers, or IPtables. c) only > ever checked for the TLS socket d) IP addresses are easily spoofed. > > If summary, if you're using a real authentication mechanism, this is > only useful for protecting against DOS attacks & that's better done by > iptables. Rebased to take account of Jim's changes, and incorporated fixes to the config file