RE: [Xen-devel] [PATCH] xen-2.0: privileged port connections

["Ian Pratt" <m+Ian.Pratt@xxxxxxxxxxxx>]

> > 1) ports < 1024 are reserved although 732 is currently unassigned
> 
> Note that NFS uses such ports without asking prior permission.
> I chose 732 because it's unassigned indeed.

Grabbing any port <1024 should do, there's no need to just go for 732,
but have a series of ports that are tried. 
 
> > 2) unix domain sockets would solve the same problem
> 
> Yes. There's one but: 
> 
> With the patch you can currently configure xend from completely
> open (xend-address '' and xend-privileged-port 0)
> to closed (xend-address 'localhost' and xend-privileged-port 1)
> except for root (and stuff I overlooked or did not do yet).
> 
> If you go for Unix Domain Sockets instead TCP, you lose the ability
> of remote control. Unless you support both.
> 
> I did not investigate how difficult to do that would be.
> If you have a patch, I'd volunteer to review :-)

For Xen 2.x, unix domain sockets would be too much of a pain to
implement over Twisted. Kurt's approach gets us closer toward 'secure by
default'.

Xen 3 will be very different.

> > 4) you still have to find a way to deal with the consoles
> 
> Before I start working on getting the consoles under control, I 
> wanted to see whether this approach is acceptable at all.

I think it's a good band-aid.

Perhaps a better way to handle consoles would be to use 'screend', and
then have incoming ssh connections dispatched to particular screen
sessions.
 
> > 5) you still have to deal with xfrd
> 
> It seems to listen on *:8002 ... 
> Is there no authentication either? Sigh.
> 
> And we probably need to look into the event channel (8001) as well.

Xfrd needs an option to listen only on localhost. (It's still needed for
save/restore even if you don't use migrate).

The event channel only ever needs to be localhost (and could probably be
turned into a unix domain socket quite easily).


Ian


-------------------------------------------------------
This SF.net email is sponsored by Microsoft Mobile & Embedded DevCon 2005
Attend MEDC 2005 May 9-12 in Vegas. Learn more about the latest Windows
Embedded(r) & Windows Mobile(tm) platforms, applications & content.  Register
by 3/29 & save $300 http://ads.osdn.com/?ad_idh83&alloc_id149&op=click
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel