Re: protecting xen startup

[Mike Wray <mike.wray@hpl.hp.com>]

Charles Coffing wrote:
> Right, xend is just an HTTP interface to Xen via system calls or ioctls 
> (xend <--> linux <--> Xen).
> 
> There's also a daemon (xfrd) running on 8002.
> 
> There currently is no authentication on either port.
> 
> In the source tree, look at docs/misc/xend.tex, although some details
> are out of date.
> 

Correct, though you can configure the interface listened to by xend
in the xend config. The default is open. To disable network access
configure 'localhost'. See 'xend-address' in '/etc/xen/xend-config.sxp'.

Xend is implemented using the Twisted framework in Python, and this
supports configuring https and authentication in front of web
services - we just haven't got around to it.

There's currently no security on port 8002 for the transfer daemon (xfrd).
There are various things that could be done. For example xfrd
could be set to listen on loopback only and you could use ssh or stunnel
to secure the comms and forward ports. I'm hoping to get around to securing
this.

> 
> HTH,
> Charles
>  
>  
> 
>>>>Luke Kenneth Casson Leighton <lkcl@lkcl.net> 11/23/04 10:05 am >>> 
> 
> hi, 
>  
> i notice that there's a management interface on port 8000. 
>  
> i seek to protect this interface such that nothing but a trusted program
> 
> (think selinux) may run, manage, start up or shut down xen oses. 
>  
> so: where can i find out information about the structure of the 
> xen management interface? 
>  
> is the port 8000 stuff just providing a web server (/etc/init.d/xend) 
> front-end to some extra system calls? 
>  
> is the port 8000 stuff actually running in the xen boot-up stuff? 
>  
> if it's some extra system calls that's very good because it will be 
> possible to add selinux security hooks to protect each system call. 
>  
> ta, 
>  
> l. 
>  

Mike




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/