Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Received-SPF: pass (nike.apache.org: domain of creategui@gmail.com designates
 209.85.192.179 as permitted sender)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
Subject: Re: A secure way to reset VMs password
From: =?windows-1252?Q?Carlos_Re=E1tegui?= <creategui@gmail.com>
In-Reply-To: <3EF8BAA8-E5E0-486E-B320-950CDEAB5FAD@stratosec.co>
Date: Tue, 2 Dec 2014 21:59:37 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <F7CE7062-19DB-42E9-B936-97087445A27E@gmail.com>
References: 
 <2141478384.1845103.1417100080552.JavaMail.yahoo@jws10671.mail.bf1.yahoo.com>
 <CAP997Uc4AkyOx=99Uw5p76=yCkEt=4TAGxQ74FacXvpc40M+uA@mail.gmail.com>
 <7AC5249E-F7B5-4E83-8C24-4539758EA515@citrix.com>
 <1914494781.26900.1417203185233.JavaMail.zimbra@li.nux.ro>
 <1486029F-8BEB-4AC5-ADD6-42C0C350F3C8@stratosec.co>
 <D0A37C81.54CDA%chiradeep.vittal@citrix.com>
 <,<7BF7226B-DB9F-4952-92E0-EA95C86D5D8B@gmail.com> <>>
 <3EF8BAA8-E5E0-486E-B320-950CDEAB5FAD@stratosec.co>
To: dev@cloudstack.apache.org

I=92m all for providing choice, but not when one of them is not a =
good/secure one.


> On Dec 2, 2014, at 9:48 PM, John Kinsella <jlk@stratosec.co> wrote:
>=20
> It's not our place to enforce how users authenticate to their VMs. We =
provide flexible options, suggest best practices, and let them use the =
tool as best suits their needs.
>=20
> Excuse any typos - sent from mobile device
>=20
>> On Dec 2, 2014, at 21:22, Carlos Reategui <creategui@gmail.com> =
wrote:
>>=20
>> Why do passwords at all?  Why not just use ssh keys like AWS does. =
The functionality is already there just not in the ACS UI. Cloud-init =
already supports it which is available in most distros and therefore =
would not require CS specific scripts. At least not for linux. On =
windows I'm not exactly sure how AWS does it but I think it is also some =
kind of terminal services certificates so I think it could be made to =
work too.=20
>>=20
>> -Carlos
>>=20
>>=20
>>=20
>>> On Dec 2, 2014, at 2:35 PM, Chiradeep Vittal =
<Chiradeep.Vittal@citrix.com> wrote:
>>>=20
>>> You would need client-side certs as well since the password server =
needs to be able to validate WHO is asking for the password. Currently =
it is based on the client's IP address.
>>> Also the current scheme is a single-use password =97 as soon as the =
password is retrieved, it is not available to anybody else (of course a =
MITM could sniff the first exchange).
>>>=20
>>> You could eliminate a lot of MITM-style attacks by running the =
password server locally on each hypervisor (hard for VMW), or by =
attaching an ISO (containing the password) to the VM.
>>>=20
>>> From: John Kinsella <jlk@stratosec.co<mailto:jlk@stratosec.co>>
>>> Reply-To: =
"dev@cloudstack.apache.org<mailto:dev@cloudstack.apache.org>" =
<dev@cloudstack.apache.org<mailto:dev@cloudstack.apache.org>>
>>> Date: Tuesday, December 2, 2014 at 1:32 PM
>>> To: "dev@cloudstack.apache.org<mailto:dev@cloudstack.apache.org>" =
<dev@cloudstack.apache.org<mailto:dev@cloudstack.apache.org>>
>>> Subject: Re: A secure way to reset VMs password
>>>=20
>>> That password reset infrastructure has bigger issues than just SSL. =
The server side works, but that=92s about all I can say for it. This =
topic comes up every 6-12 months. :)
>>>=20
>>> I thought there was a Jira entry but I can=92t find it=85personally =
I=92d love to see the client and server sides both rewritten from =
scratch.
>>>=20
>>> John
>>>=20
>>> On Nov 28, 2014, at 11:33 AM, Nux! =
<nux@li.nux.ro<mailto:nux@li.nux.ro>> wrote:
>>> Jayapal,
>>> Not necesarily, one could run stunnel or nginx as SSL proxy on some =
other port (8443?), this way SSL and non-SSL connections will still work =
and give you plenty of time to update your templates, if you so wish.
>>> Am I missing any important bits here?
>>> Lucian
>>> --
>>> Sent from the Delta quadrant using Borg technology!
>>> Nux!
>>> www.nux.ro
>>> ----- Original Message -----
>>> From: "Jayapal Reddy Uradi" =
<jayapalreddy.uradi@citrix.com<mailto:jayapalreddy.uradi@citrix.com>>
>>> To: "<dev@cloudstack.apache.org<mailto:dev@cloudstack.apache.org>>" =
<dev@cloudstack.apache.org<mailto:dev@cloudstack.apache.org>>
>>> Cc: "Alireza Eskandari" =
<astro.alireza@yahoo.com<mailto:astro.alireza@yahoo.com>>
>>> Sent: Friday, 28 November, 2014 09:34:02
>>> Subject: Re: A secure way to reset VMs password
>>> Another point to note is all the vms in production has to update
>>> with the new cloud-set-guest-password scripts because of the new =
password reset
>>> method.
>>> Thanks,
>>> Jayapal
>>> On 28-Nov-2014, at 2:28 PM, Erik Weber =
<terbolous@gmail.com<mailto:terbolous@gmail.com>>
>>> wrote:
>>> On Thu, Nov 27, 2014 at 3:54 PM, Alireza Eskandari <
>>> =
astro.alireza@yahoo.com.invalid<mailto:astro.alireza@yahoo.com.invalid>> =
wrote:
>>> HiI viewed the bash script that resets Linux password (
>>> =
http://download.cloud.com/templates/4.2/bindir/cloud-set-guest-password.in=
)It
>>> seems that it doesn't use a secure way for transferring password =
string to
>>> instance.Instances on a shared network can sniff password requests =
and
>>> export requested password of other instances.I suggest to use SSL =
(https)
>>> instead of plan text.Regards
>>> I like the idea, but there's a couple of obstacles to overcome, =
namely
>>> which SSL certificates to use.
>>> - certificates need a subject name, ie. IP or hostname for web =
pages, you
>>> could solve this by making the mgmt server a CA and have each VR get =
a
>>> signed certificate by it, but it's complicated
>>> - if the community bundle a pre generated certificate it is commonly =
known
>>> and not to be trusted, also not sure how to handle subject name
>>> - assuming everyone to supply a valid certificate is quite =
complicated (CA
>>> must be on VR etc), and makes it considerably harder to get a =
working setup
>>> - using self signed causes issues with validation
>>> Don't get me wrong, I love the idea, but it's not just to flip a =
switch and
>>> have (proper) SSL in place.
>>> --
>>> Erik
>>>=20
>>>=20