<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><style>body { line-height: 1.5; }blockquote { margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; }body { font-size: 10.5pt; font-family: 微软雅黑; color: rgb(0, 0, 0); line-height: 1.5; }</style></head><body>
<div><span></span>Hi <span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;">Daniel</span></div><div><br></div><div>Thank you for your detailed replies.</div><div>You are <span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;">exactly the frist one to point out this </span><span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;">security issuse 3 years ago.</span></div><div><br></div><div>>> <span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">$HOME/.config/libvirt/auth.conf </span></div><div><br></div><div>I tried it , but still got the same error.</div><div>I also find another <span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;">disadvantage of SASL : </span></div><div><span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;">The username+password will be shown using this cmd: </span><span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;">strings /etc/libvirt/passwd.db</span></div><div><span style="background-color: window; font-size: 10.5pt; line-height: 1.5;">As your sugguestion , I think TLS is the best </span><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;"> </span><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">approach so far .</span></div><div><br></div><hr style="width: 210px; height: 1px;" color="#b5c4df" size="1" align="left">
<div><span>sosogh</span></div>
<blockquote style="margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em;"><div> </div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"><div style="PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-SIZE: 12px;FONT-FAMILY:tahoma;COLOR:#000000; BACKGROUND: #efefef; PADDING-BOTTOM: 8px; PADDING-TOP: 8px"><div><b>From:</b> <a href="mailto:berrange@redhat.com">Daniel P. Berrange</a></div><div><b>Date:</b> 2017-04-07 17:48</div><div><b>To:</b> <a href="mailto:sosogh@mail.com">sosogh</a></div><div><b>CC:</b> <a href="mailto:openstack@lists.openstack.org">openstack</a></div><div><b>Subject:</b> Re: [Openstack] libvirtd remote access security for Live migration</div></div></div><div><div>On Fri, Apr 07, 2017 at 09:27:16AM +0800, sosogh wrote:</div>
<div>> Hi list:</div>
<div>> </div>
<div>> I want to setup security for libvirtd.</div>
<div>> I have read these articles:</div>
<div>> https://wiki.openstack.org/wiki/OSSN/OSSN-0007</div>
<div>> https://www.ibm.com/support/knowledgecenter/en/linuxonibm/liabp/liabpkvmsecsrmsasl.htm</div>
<div>> </div>
<div>> My current conf is /etc/libvirt/libvirtd.conf:</div>
<div>> listen_tls = 0</div>
<div>> listen_tcp = 1</div>
<div>> auth_tcp = "sasl"</div>
<div>> </div>
<div>> And now I try :</div>
<div>> nova live-migration --block-migrate 4309758f-2e66-4c66-bcbb-5f5ee33956ad ip-10-8-8-232.clouds.com</div>
<div>> </div>
<div>> I found error on the src hv :</div>
<div>> Live Migration failure: operation failed: Failed to connect to remote libvirt URI</div>
<div>> qemu+tcp://ip-10-8-8-232.clouds.com/system: authentication failed: Failed to start</div>
<div>> SASL negotiation: -4 (SASL(-4): no mechanism available: No worthy mechs found)</div>
<div>> </div>
<div>> I try it with virsh ,it worked :</div>
<div>> root@ip-10-8-8-243:/var/log/nova# virsh -c qemu+tcp://ip-10-8-8-232.clouds.com/system</div>
<div>> Please enter your authentication name: admin</div>
<div>> Please enter your password: </div>
<div>> Welcome to virsh, the virtualization interactive terminal.</div>
<div>> </div>
<div>> Type: 'help' for help with commands</div>
<div>> 'quit' to quit</div>
<div>> </div>
<div>> virsh # </div>
<div>> virsh #</div>
<div> </div>
<div>Notice that when you use virsh it prompts for a username + password. There</div>
<div>is no way for nova to prompt for the username + password when doing live</div>
<div>migration. So the error you're getting is probably a result of Nova not</div>
<div>having provided any way for libvirt to query authentication credentials.</div>
<div>You could create a config file containing the credentials at</div>
<div> </div>
<div> $HOME/.config/libvirt/auth.conf for the</div>
<div> </div>
<div>nova user account. For this to be practical you would have to create the</div>
<div>same username+password on every single hypervisor host, as it would be</div>
<div>impractical to populate it with differnt creds for every possible host</div>
<div>in the cloud.</div>
<div> </div>
<div>Second, please note that while historically the libvirt SASL configuration has</div>
<div>defaulted to the DIGEST-MD5 mechanism, this mechanism is no longer considered</div>
<div>to be secure by modern standards as it is vulnerable to MITM attacks and</div>
<div>brute force of the MD5 hash.</div>
<div> </div>
<div>As such, from 3.2.0, libvirt has dropped DIGEST-MD5 by default and now</div>
<div>strongly recommends against its use. The only remaining *secure* SASL</div>
<div>mechanism that can be used on its own is Kerberos V5. That would not</div>
<div>suffer the problem with auth credentials, since the Kerberos ticket is</div>
<div>acquired out-of-band with no interactive prompts required.</div>
<div> </div>
<div>That said, I'm guessing it is unlikely you have kerberos deployed and</div>
<div>probably wouldn't want to start deploying it either.</div>
<div> </div>
<div>In the context of openstack my strong recommendation is to use TLS with</div>
<div>x509 certificates for libvirt remote access, since this aligns nicely</div>
<div>with the need to use TLS for almost every other service in OpenStack.</div>
<div> </div>
<div> </div>
<div>A future suggestion for interested Nova developers....</div>
<div> </div>
<div>Once using TLS w/x509 you could *also* layer in SASL to get an extra</div>
<div>layer of protection. The ideal approach would be for libvirt to have</div>
<div>TLS w/x509 certs setup and a SASL SCRAM mechanism enabled over TLS</div>
<div>during initial deployment.</div>
<div> </div>
<div>Then at the time Nova initiates a migration, the Nova scheduler would</div>
<div>create a one-time-password on the target host and give that to the</div>
<div>source host. This ensures that 2 libvirtd daemons cannot talk to each</div>
<div>other during normal operation - Nova scheduler would have to authorize</div>
<div>the connection between 2 nodes by setting up the auth credentials</div>
<div> </div>
<div>Regards,</div>
<div>Daniel</div>
<div>-- </div>
<div>|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|</div>
<div>|: http://libvirt.org -o- http://virt-manager.org :|</div>
<div>|: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|</div>
</div></blockquote>
</body></html>