2013/2/8 Iustin Pop <[email protected]>: > --- a/doc/security.rst > +++ b/doc/security.rst > +Restricted commands > +~~~~~~~~~~~~~~~~~~~ > + > +The restricted commands feature is new in Ganeti 2.7. It enabled the
s/enabled/enables/? > +administrator to run any commands in the > +``/etc/ganeti/restricted-commands`` directory, if the feature has been > +enabled at build time, subject to the following restrictions: > + > +- No parameters may be passed > +- No absolute or relative path may be passed, only a filename > +- The ``/etc/ganeti/restricted-commands`` directory must > + be owned by root:root and have mode 0755 or stricter > +- Executables must be regular files or symlinks, and must be executable > + by root:root > + > +Note that it's not possible to list the contents of the directory, and > +there is an intentional delay when trying execute a non-existing s/trying execute/trying to execute/ > +filename (to slow-down dictionary attacks). I'd replace “filename” with “command”. > +Since for Ganeti itself this functionality is not needed, and is only > +provided as a way to help administrate or recover nodes, it is a local > +site decision whether to enable or not the restricted commands feature. Please also add a sentence saying that it's disabled by default. > +Conf daemon > +----------- > + > +In Ganeti 2.7, the ``confd`` daemon (if enabled at build time), serves > +both network-originated queries and local (UNIX socket) queries which > +can make use of the internal RPC SSL certificate. This makes it a bit The bit about the certificates is a bit confusing. First I thought one would use the certificate for LUXI. Can you re-word this a bit? > +more sensitive to bugs (a remote attacker could get direct access to the > +intra-cluster RPC), so to harden security it's recommended to: > + > +- disable confd at build time if it's not needed in your setup > +- otherwise, configure ganeti (at build time) to use separate users, so s/ganeti/Ganeti/ > + that the confd daemon doesn't also have access to the server SSL/TLS > + certificates > + > +It is planned to split the two functionalities (local/remote querying) > +of confd into two separate daemons in a future Ganeti version. Michael
