[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v2 1/6] qemu-nbd: add support for authorization
From: |
Dr. David Alan Gilbert |
Subject: |
Re: [Qemu-devel] [PATCH v2 1/6] qemu-nbd: add support for authorization of TLS clients |
Date: |
Wed, 20 Jun 2018 15:45:01 +0100 |
User-agent: |
Mutt/1.10.0 (2018-05-17) |
* Daniel P. Berrangé (address@hidden) wrote:
> On Wed, Jun 20, 2018 at 03:22:53PM +0100, Dr. David Alan Gilbert wrote:
> > * Daniel P. Berrangé (address@hidden) wrote:
> > > From: "Daniel P. Berrange" <address@hidden>
> > >
> > > Currently any client which can complete the TLS handshake is able to use
> > > the NBD server. The server admin can turn on the 'verify-peer' option
> > > for the x509 creds to require the client to provide a x509 certificate.
> > > This means the client will have to acquire a certificate from the CA
> > > before they are permitted to use the NBD server. This is still a fairly
> > > low bar to cross.
> > >
> > > This adds a '--tls-authz OBJECT-ID' option to the qemu-nbd command which
> > > takes the ID of a previously added 'QAuthZ' object instance. This will
> > > be used to validate the client's x509 distinguished name. Clients
> > > failing the authorization check will not be permitted to use the NBD
> > > server.
> > >
> > > For example to setup authorization that only allows connection from a
> > > client
> > > whose x509 certificate distinguished name is
> > >
> > > CN=laptop.example.com,O=Example Org,L=London,ST=London,C=GB
> > >
> > > use:
> > >
> > > qemu-nbd --object tls-creds-x509,id=tls0,dir=/home/berrange/qemutls,\
> > > endpoint=server,verify-peer=yes \
> > > --object
> > > authz-simple,id=auth0,identity=CN=laptop.example.com,,\
> > > O=Example Org,,L=London,,ST=London,,C=GB \
> >
> > I'm confused about how that gets parsed, what differentiates the ,s
> > that separate the arguments (e.g. ,id= ,identity=) and the ,s that
> > separate the options within the identity string (e.g. the ,ST=London)
>
> That's why I've doubled up - eg ',,' must be used when you need to
> include a literal ',' in a value without it being interpreted as
> starting a new option
OK, yeh I forgot about the obscure double-comma rule.
> > Would:
> > --object authz-simple,identity=CN=laptop.example.com,,O=Example
> > Org,,L=London,,ST=London,,C=GB,id=auth0
> >
> > be equivalent?
>
> Yes
OK.
Dave
>
>
> Regards,
> Daniel
> --
> |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o- https://fstop138.berrange.com :|
> |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
--
Dr. David Alan Gilbert / address@hidden / Manchester, UK
- [Qemu-devel] [PATCH v2 0/6] Add authorization support to all network services, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v2 2/6] nbd: allow authorization with nbd-server-start QMP command, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v2 3/6] migration: add support for a "tls-authz" migration parameter, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v2 4/6] chardev: add support for authorization for TLS clients, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v2 6/6] monitor: deprecate acl_show, acl_reset, acl_policy, acl_add, acl_remove, Daniel P . Berrangé, 2018/06/20
- [Qemu-devel] [PATCH v2 5/6] vnc: allow specifying a custom authorization object name, Daniel P . Berrangé, 2018/06/20