Re: [RFC][PATCH] Secure XML-RPC for Xend

[Anthony Liguori <aliguori@us.ibm.com>]

Ian Pratt wrote:
>> The following patch implements a secure XML-RPC protocol for Xend.
>> Instead of using HTTPS with basic authentication and dealing with all
>> that nasty OpenSSL/PAM integration, it just uses SSH.  This gives you
>> all the properties you want (great security and PAM integration) with
>> very little code.
>>     
>
> I think we just have to bite the bullet on this one. OpenSSL/PAM
> integration isn't that hard, and it makes things much cleaner from a
> client point of view, which is what really matters.
>   

It's tempting to use https/basic auth since it seems like it ought to 
just work with existing clients.  However, that doesn't appear to be the 
case.

Python doesn't seem to provide any real support for authentication 
out-of-the-box.  It wouldn't be that hard to add but neither was an SSH 
transport.

The other problem is that Python doesn't provide support for certificate 
verification.  That's okay if you're just using Python to screen scrap 
but if you're in an enterprise environment it's not a very good thing.

The other problem I'm concerned about is certificate management on our 
end.  The average user is going have to end up using snake oil certs and 
I've always found configuring these things to be a real pain.

Another advantage to the SSH approach is that it makes firewall rules 
easier to manage.  There's no additional open port.  This is a minor 
benefit of course but I thought I'd mention it anyway :-)

Writing a client from scratch, I've found supporting the SSH method is 
far easy than https.  Best of all, there's no additional server 
configuration.

I'm clearly biased though, I'm interested to know what others think :-)

Regards,

Anthony Liguori

> We can always use "stunnel" to make life easier.
>
> Ian
>
>  
>   
>> There are some minor issues so I'd rather it not be applied
>> immediately.  I'd like to get some feedback from people as to whether
>> this approach is reasonable.  A user-facing change is that now you can
>> use the XM_SERVER environmental variable to specific an XML-RPC URI.
>>
>> For instance:
>>
>> XM_SERVER='ssh://root@rhesis.austin.ibm.com/RPC2' xm list
>>
>> Runs xm list on a local machine but does all of the RPCs over a secure
>> connection (prompting for passwords).
>>
>> Thoughts?
>>
>> Regards,
>>
>> Anthony Liguori
>>
>>     
>
>