[libvirt] [PATCH] sasl auth：add default mapping of credentials to machines
hi,all: in production environment, it is important to keep safe. libvirt does automatic validation, but it needs to set up mapping for each machine. this patch is to add default certificate mapping , make it easy in lange scale environment. maybe another way is using regex to do exact match, if this idea is helpful, i can continue thanks
On Mon, Jun 13, 2016 at 05:58:06PM +0800, longguang.yue wrote:
From 98a2e7784f14f1c69dbb93e0bfb6539987aa16d4 Mon Sep 17 00:00:00 2001 From: yuelongguang <yuelongguang@le.com> Date: Mon, 13 Jun 2016 17:29:57 +0800 Subject: [PATCH] add default mapping of credentials to machine
--- src/util/virauthconfig.c | 7 +++++++ 1 file changed, 7 insertions(+)
Thanks, I've applied this patch, with an expanded commit message: commit 743db933ed6bbcdd3ca87dd43c8164f6992bc89e Author: yuelongguang <yuelongguang@le.com> Date: Mon Jun 13 17:29:57 2016 +0800 add default mapping of credentials to machine In the auth config file, it is currently required to have an entry for each hostname to connect to, eg [auth-libvirt-prod1.example.com] credentials=prod This is inconvenient when there are large numbers of machines all with the same credentials. Add support for a default entry: [auth-default] credentials=prod Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
this patch is for help document thanks very much At 2016-06-16 17:39:12, "Daniel P. Berrange" <berrange@redhat.com> wrote:
On Mon, Jun 13, 2016 at 05:58:06PM +0800, longguang.yue wrote:
From 98a2e7784f14f1c69dbb93e0bfb6539987aa16d4 Mon Sep 17 00:00:00 2001 From: yuelongguang <yuelongguang@le.com> Date: Mon, 13 Jun 2016 17:29:57 +0800 Subject: [PATCH] add default mapping of credentials to machine
--- src/util/virauthconfig.c | 7 +++++++ 1 file changed, 7 insertions(+)
Thanks, I've applied this patch, with an expanded commit message:
commit 743db933ed6bbcdd3ca87dd43c8164f6992bc89e Author: yuelongguang <yuelongguang@le.com> Date: Mon Jun 13 17:29:57 2016 +0800
add default mapping of credentials to machine
In the auth config file, it is currently required to have an entry for each hostname to connect to, eg
[auth-libvirt-prod1.example.com] credentials=prod
This is inconvenient when there are large numbers of machines all with the same credentials. Add support for a default entry:
[auth-default] credentials=prod
Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
On Thu, Jun 16, 2016 at 07:32:54PM +0800, longguang.yue wrote:
this patch is for help document
thanks very much
At 2016-06-16 17:39:12, "Daniel P. Berrange" <berrange@redhat.com> wrote:
On Mon, Jun 13, 2016 at 05:58:06PM +0800, longguang.yue wrote:
From 98a2e7784f14f1c69dbb93e0bfb6539987aa16d4 Mon Sep 17 00:00:00 2001 From: yuelongguang <yuelongguang@le.com> Date: Mon, 13 Jun 2016 17:29:57 +0800 Subject: [PATCH] add default mapping of credentials to machine
--- src/util/virauthconfig.c | 7 +++++++ 1 file changed, 7 insertions(+)
Thanks, I've applied this patch, with an expanded commit message:
commit 743db933ed6bbcdd3ca87dd43c8164f6992bc89e Author: yuelongguang <yuelongguang@le.com> Date: Mon Jun 13 17:29:57 2016 +0800
add default mapping of credentials to machine
In the auth config file, it is currently required to have an entry for each hostname to connect to, eg
[auth-libvirt-prod1.example.com] credentials=prod
This is inconvenient when there are large numbers of machines all with the same credentials. Add support for a default entry:
[auth-default] credentials=prod
Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
From c1def510347f4d45da696a612d04d3fa3917fcd4 Mon Sep 17 00:00:00 2001 From: yuelongguang <yuelongguang@le.com> Date: Thu, 16 Jun 2016 19:20:24 +0800 Subject: [PATCH] add help document relevant to default mapping of credentials to machines
* src/util/virauthconfig.c --- docs/auth.html.in | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/docs/auth.html.in b/docs/auth.html.in index 37f2978..bdd5fc2 100644 --- a/docs/auth.html.in +++ b/docs/auth.html.in @@ -76,7 +76,11 @@ password=letmein
[credentials-dev] username=joe -password=hello</pre> +password=hello + +[credentials-defgrp] +username=defuser +password=defpw</pre>
<p> The second set of groups provide mappings of credentials to @@ -90,7 +94,8 @@ credentials=$CREDENTIALS</pre>
<p> For example, following the previous example, here is how to - list some machines + map some machines. For convenience libvirt supports default mapping + of credentials to machines: </p>
<pre> @@ -106,8 +111,15 @@ credentials=test [auth-libvirt-prod1.example.com] credentials=prod
+[auth-libvirt-default] +credentials=defgrp + [auth-esx-dev1.example.com] -credentials=dev</pre> +credentials=dev + +[auth-esx-default] +credentials=defgrp</pre> +
<p> The following service types are known to libvirt
Thanks, will apply this shortly. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
participants (2)
-
Daniel P. Berrange -
longguang.yue