From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49559) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dspRW-0001zw-0H for qemu-devel@nongnu.org; Fri, 15 Sep 2017 08:09:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dspRS-0007fW-0c for qemu-devel@nongnu.org; Fri, 15 Sep 2017 08:09:57 -0400 Received: from mx1.redhat.com ([209.132.183.28]:43300) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dspRR-0007ew-R1 for qemu-devel@nongnu.org; Fri, 15 Sep 2017 08:09:53 -0400 Date: Fri, 15 Sep 2017 13:09:46 +0100 From: "Daniel P. Berrange" Message-ID: <20170915120946.GH13610@redhat.com> Reply-To: "Daniel P. Berrange" References: <20170915090253.12201-1-famz@redhat.com> <20170915114001.GG13610@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] [PULL v4 00/38] Test and build patches List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Maydell Cc: Fam Zheng , QEMU Developers On Fri, Sep 15, 2017 at 01:03:54PM +0100, Peter Maydell wrote: > On 15 September 2017 at 12:40, Daniel P. Berrange wrote: > > IIUC, the public part of the key gets exposed to the guest images via > > cloud-init metadata. During boot the guest read this metadata and add > > the public key to authorized_keys. The private key is used by the test > > suite on the host so that it can now login to the guests. > > > > So the risk here is that if these guests were exposed to the LAN in any > > way, someone could grab our private key and login to these guests. > > > > What saves us is that the VMs are run with user mode slirp networking > > so AFAICT, aren't exposed to the LAN. > > If I'm reading the right bit of the script we run QEMU with a > hostfwd specification using 0.0.0.0 as the host part -- doesn't > that listen on all interfaces including the LAN ones? Actually yes, you are right, my bad. That needs to be fixed to use 127.0.0.1 for sure. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|