I don't think anyone is intentionally trying to be a flamer here but I
also don't think it is the most productive to send a message to the
list that says "XCP is missing X and Y so I'm not going to use it. I
too have found several things that are important to me lacking from
XCP, but I also see the amazing potential and appreciate all the hard
work that has been put into it so far. Anyway back to what the OP
brought up -
1. /etc/shadow is still not present in XenServer 5.6 fp1 as far as I
can tell. See here -
http://forums.citrix.com/message.jspa?messageID=1552977
2. It certainly would be nice to see dedicated XCP repositories
created, but my hunch is that there are probably a lot of reasons why
it hasn't happened yet.
On Mon, May 9, 2011 at 8:26 PM, Randy Katz <rkatz@xxxxxxxxxxxxxxxxxxxxx> wrote:
> Why is flaming always the first line with you people? He brought up 2 very
> important issues in the
> form of questions which should be addressed:
>
> 1. Security flaw in XCP?
> 2. Where are the patches/updates going to come from and how?
>
> If you want to flame someone go ahead and flame me, but Adrien's questions
> seem sincere and important!
>
> Regards,
> Randy Katz
>
> On 5/9/2011 2:51 PM, Chris Petrolino wrote:
>>
>> Do you know how many "commercial" Linux based appliances there are out
>> there? How many of them follow the patch cycle of the Linux flavor
>> they are based on?
>>
>> Have you offered the community any suggestions on how to improve the
>> security model of XCP? We are all ears.
>>
>> As for updates not having the potential to break things, I strongly
>> disagree.
>>
>> Kind Regards,
>>
>> Christopher James Petrolino
>>
>>
>> On May 9, 2011, at 5:30 PM, Adrien Guillon<aj.guillon@xxxxxxxxx> wrote:
>>
>>> Security updates are common, and generally do not make major interface
>>> changes by design. I have no desire to update anything aside from
>>> receiving fixes for buffer overflows, or other exploits that are found
>>> in the wild. The system in question should be in production for
>>> several years, and security patches are inevitable during that period
>>> of time.
>>>
>>> It likely took some effort to eliminate /etc/shadow in the first
>>> place, as this has been standard practice for a very long time. I
>>> will not debate the merits of storing hashes in /etc/passwd or
>>> /etc/shadow because that debate ended a very long time ago. Quite
>>> simply this distro has a major security flaw.
>>>
>>>
>>> On Mon, May 9, 2011 at 5:16 PM, riki<phobie@xxxxxxxx> wrote:
>>>>
>>>> Well, you are right from the multi-user point of view regarding the
>>>> passwd
>>>> file, but XCP is designed as appliance, xe utility or something speaking
>>>> xapi is a way of interfacing it, no user other than root should access
>>>> dom0.
>>>>
>>>> Updates - question of stability, i hope you do not want to risk reload
>>>> of
>>>> all your VM`s due to libc changes or something like that :). You need
>>>> to
>>>> update what? Xen hypervisor? Openvswitch, xapi toolstack? Everything
>>>> should
>>>> be locked down on lower levels (network access to dom0, physical access
>>>> to
>>>> appliances).
>>>>
>>>> Try to change the point of view and stop looking at it as a standard
>>>> multiuser linux enviroment.
>>>>
>>>> r.
>>>>
>>>> On 05/09/2011 10:41 PM, Adrien Guillon wrote:
>>>>>
>>>>> Hello mailing list!
>>>>>
>>>>> I have been working with XCP a little bit, and I have the impression
>>>>> that this distro is insecure. First, it does not look like update
>>>>> repositories are enabled inside /etc/yum.repos.d, although I'm from an
>>>>> apt background so I may be misinterpreting that. Where will my
>>>>> security updates come from?
>>>>>
>>>>> Next, it appears that the root password hash is directly stored inside
>>>>> /etc/passwd, which is set to world-readable! There does not appear to
>>>>> be an /etc/shadow file at all.
>>>>>
>>>>> Unfortunately I am dropping the distro entirely due to security
>>>>> concerns, I hope that these problems can be fixed.
>>>>>
>>>>> AJ
>>>>>
>>>>> _______________________________________________
>>>>> Xen-users mailing list
>>>>> Xen-users@xxxxxxxxxxxxxxxxxxx
>>>>> http://lists.xensource.com/xen-users
>>>>
>>>> _______________________________________________
>>>> Xen-users mailing list
>>>> Xen-users@xxxxxxxxxxxxxxxxxxx
>>>> http://lists.xensource.com/xen-users
>>>>
>>> _______________________________________________
>>> Xen-users mailing list
>>> Xen-users@xxxxxxxxxxxxxxxxxxx
>>> http://lists.xensource.com/xen-users
>>
>> _______________________________________________
>> Xen-users mailing list
>> Xen-users@xxxxxxxxxxxxxxxxxxx
>> http://lists.xensource.com/xen-users
>>
>
>
> _______________________________________________
> Xen-users mailing list
> Xen-users@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-users
>
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
Home