[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-block] [PATCH v3 1/6] qemu-nbd: add support for authorization
From: |
Juan Quintela |
Subject: |
Re: [Qemu-block] [PATCH v3 1/6] qemu-nbd: add support for authorization of TLS clients |
Date: |
Wed, 17 Oct 2018 14:24:42 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) |
Daniel P. Berrangé <address@hidden> wrote:
> From: "Daniel P. Berrange" <address@hidden>
>
> Currently any client which can complete the TLS handshake is able to use
> the NBD server. The server admin can turn on the 'verify-peer' option
> for the x509 creds to require the client to provide a x509 certificate.
> This means the client will have to acquire a certificate from the CA
> before they are permitted to use the NBD server. This is still a fairly
> low bar to cross.
>
> This adds a '--tls-authz OBJECT-ID' option to the qemu-nbd command which
> takes the ID of a previously added 'QAuthZ' object instance. This will
> be used to validate the client's x509 distinguished name. Clients
> failing the authorization check will not be permitted to use the NBD
> server.
>
> For example to setup authorization that only allows connection from a client
> whose x509 certificate distinguished name is
>
> CN=laptop.example.com,O=Example Org,L=London,ST=London,C=GB
>
> use:
>
> qemu-nbd --object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
> endpoint=server,verify-peer=yes \
> --object authz-simple,id=auth0,identity=CN=laptop.example.com,,\
> O=Example Org,,L=London,,ST=London,,C=GB \
> --tls-creds tls0 \
> --tls-authz authz0
> ....other qemu-nbd args...
>
> Signed-off-by: Daniel P. Berrange <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
- [Qemu-block] [PATCH v3 0/6] Add authorization support to all network services, Daniel P . Berrangé, 2018/10/09
- [Qemu-block] [PATCH v3 1/6] qemu-nbd: add support for authorization of TLS clients, Daniel P . Berrangé, 2018/10/09
- Re: [Qemu-block] [PATCH v3 1/6] qemu-nbd: add support for authorization of TLS clients,
Juan Quintela <=
- [Qemu-block] [PATCH v3 2/6] nbd: allow authorization with nbd-server-start QMP command, Daniel P . Berrangé, 2018/10/09
- [Qemu-block] [PATCH v3 3/6] migration: add support for a "tls-authz" migration parameter, Daniel P . Berrangé, 2018/10/09
- [Qemu-block] [PATCH v3 4/6] chardev: add support for authorization for TLS clients, Daniel P . Berrangé, 2018/10/09
- [Qemu-block] [PATCH v3 5/6] vnc: allow specifying a custom authorization object name, Daniel P . Berrangé, 2018/10/09
- [Qemu-block] [PATCH v3 6/6] monitor: deprecate acl_show, acl_reset, acl_policy, acl_add, acl_remove, Daniel P . Berrangé, 2018/10/09