From mboxrd@z Thu Jan 1 00:00:00 1970 From: Anthony Liguori Subject: Re: [RFC][PATCH] Secure XML-RPC for Xend Date: Fri, 09 Jun 2006 07:10:23 -0500 Message-ID: <4489652F.7040702@us.ibm.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Ian Pratt Cc: xen-devel , Ewan Mellor List-Id: xen-devel@lists.xenproject.org Ian Pratt wrote: >> The following patch implements a secure XML-RPC protocol for Xend. >> Instead of using HTTPS with basic authentication and dealing with all >> that nasty OpenSSL/PAM integration, it just uses SSH. This gives you >> all the properties you want (great security and PAM integration) with >> very little code. >> > > I think we just have to bite the bullet on this one. OpenSSL/PAM > integration isn't that hard, and it makes things much cleaner from a > client point of view, which is what really matters. > It's tempting to use https/basic auth since it seems like it ought to just work with existing clients. However, that doesn't appear to be the case. Python doesn't seem to provide any real support for authentication out-of-the-box. It wouldn't be that hard to add but neither was an SSH transport. The other problem is that Python doesn't provide support for certificate verification. That's okay if you're just using Python to screen scrap but if you're in an enterprise environment it's not a very good thing. The other problem I'm concerned about is certificate management on our end. The average user is going have to end up using snake oil certs and I've always found configuring these things to be a real pain. Another advantage to the SSH approach is that it makes firewall rules easier to manage. There's no additional open port. This is a minor benefit of course but I thought I'd mention it anyway :-) Writing a client from scratch, I've found supporting the SSH method is far easy than https. Best of all, there's no additional server configuration. I'm clearly biased though, I'm interested to know what others think :-) Regards, Anthony Liguori > We can always use "stunnel" to make life easier. > > Ian > > > >> There are some minor issues so I'd rather it not be applied >> immediately. I'd like to get some feedback from people as to whether >> this approach is reasonable. A user-facing change is that now you can >> use the XM_SERVER environmental variable to specific an XML-RPC URI. >> >> For instance: >> >> XM_SERVER='ssh://root@rhesis.austin.ibm.com/RPC2' xm list >> >> Runs xm list on a local machine but does all of the RPCs over a secure >> connection (prompting for passwords). >> >> Thoughts? >> >> Regards, >> >> Anthony Liguori >> >> > >