|
xen-users
Re: [Xen-users] XCP: Insecure Distro ?
Why is flaming always the first line with you people? He brought up 2
very important issues in the
form of questions which should be addressed:
1. Security flaw in XCP?
2. Where are the patches/updates going to come from and how?
If you want to flame someone go ahead and flame me, but Adrien's
questions seem sincere and important!
Regards,
Randy Katz
On 5/9/2011 2:51 PM, Chris Petrolino wrote:
Do you know how many "commercial" Linux based appliances there are out
there? How many of them follow the patch cycle of the Linux flavor
they are based on?
Have you offered the community any suggestions on how to improve the
security model of XCP? We are all ears.
As for updates not having the potential to break things, I strongly disagree.
Kind Regards,
Christopher James Petrolino
On May 9, 2011, at 5:30 PM, Adrien Guillon<aj.guillon@xxxxxxxxx> wrote:
Security updates are common, and generally do not make major interface
changes by design. I have no desire to update anything aside from
receiving fixes for buffer overflows, or other exploits that are found
in the wild. The system in question should be in production for
several years, and security patches are inevitable during that period
of time.
It likely took some effort to eliminate /etc/shadow in the first
place, as this has been standard practice for a very long time. I
will not debate the merits of storing hashes in /etc/passwd or
/etc/shadow because that debate ended a very long time ago. Quite
simply this distro has a major security flaw.
On Mon, May 9, 2011 at 5:16 PM, riki<phobie@xxxxxxxx> wrote:
Well, you are right from the multi-user point of view regarding the passwd
file, but XCP is designed as appliance, xe utility or something speaking
xapi is a way of interfacing it, no user other than root should access dom0.
Updates - question of stability, i hope you do not want to risk reload of
all your VM`s due to libc changes or something like that :). You need to
update what? Xen hypervisor? Openvswitch, xapi toolstack? Everything should
be locked down on lower levels (network access to dom0, physical access to
appliances).
Try to change the point of view and stop looking at it as a standard
multiuser linux enviroment.
r.
On 05/09/2011 10:41 PM, Adrien Guillon wrote:
Hello mailing list!
I have been working with XCP a little bit, and I have the impression
that this distro is insecure. First, it does not look like update
repositories are enabled inside /etc/yum.repos.d, although I'm from an
apt background so I may be misinterpreting that. Where will my
security updates come from?
Next, it appears that the root password hash is directly stored inside
/etc/passwd, which is set to world-readable! There does not appear to
be an /etc/shadow file at all.
Unfortunately I am dropping the distro entirely due to security
concerns, I hope that these problems can be fixed.
AJ
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
|
|
Home