On Wed, Nov 01, 2006 at 11:38:47AM +0000, Alastair Tse wrote:
> > - XenD should install its own PAM config file into /etc/pam.d
> > rather than re-using the context from the 'login' program
>
>
> Well, the problem I ran into is that every distro has their own
> custom PAM stack and any PAM stack we write will only work on one
> distro and not another. I believe this is a distro packaging problem.
> But your concern is still valid, maybe we have to provide a PAM stack
> for one at least one distro. Let's fight to see which one that will
> be :)
Back off, Gentoo-freak ;-)
> > - If we're using PAM then we must switch all communications to use
> > SSL by default - no network daemon should be using system
> > passwords over a cleartext network channel anymore. If we want
> > to keep a cleartext channel, then we should use a separate
> > password database & certainly not system logins
>
> Definitely. I've only been testing with a local UNIX domain socket.
> Anything that goes over the network needs SSL encryption, but the API
> docs don't make any mention of this, presumably because it doesn't
> really fall into the API.
Actually, I agreed at the last Xen Summit that we would add a list of
supported transports to that API document. The intention is that any server
meeting the spec can talk to any client meeting the spec, so of course we need
a list of supported transports too.
This list is something we need to write down -- HTTP/local, HTTP/TCP,
HTTP/SSL/TCP are the obvious ones, but if someone needs something else, it's
still open to discussion.
> My guess is we'll need to put some
> certificate configuration options in xend-config.sxp or run the Xen
> API on a different XMLRPC server than the one that currently serves xm.
Yeah, I think that we're certainly going to need to use a different port, even
if we're using the same dispatcher behind that. I'm not sure what to do about
certificate management -- any suggestions?
Ewan.
_______________________________________________
xen-api mailing list
xen-api@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-api
|
Home