On Fri, Feb 08, 2013 at 05:46:21PM +0100, Michael Hanselmann wrote: > 2013/2/8 Iustin Pop <[email protected]>: > > --- a/doc/security.rst > > +++ b/doc/security.rst > > +Restricted commands > > +~~~~~~~~~~~~~~~~~~~ > > + > > +The restricted commands feature is new in Ganeti 2.7. It enabled the > > s/enabled/enables/?
Oups, sorry. > > +administrator to run any commands in the > > +``/etc/ganeti/restricted-commands`` directory, if the feature has been > > +enabled at build time, subject to the following restrictions: > > + > > +- No parameters may be passed > > +- No absolute or relative path may be passed, only a filename > > +- The ``/etc/ganeti/restricted-commands`` directory must > > + be owned by root:root and have mode 0755 or stricter > > +- Executables must be regular files or symlinks, and must be executable > > + by root:root > > + > > +Note that it's not possible to list the contents of the directory, and > > +there is an intentional delay when trying execute a non-existing > > s/trying execute/trying to execute/ Ack, thanks. > > +filename (to slow-down dictionary attacks). > > I'd replace “filename” with “command”. Good suggestion, done. > > +Since for Ganeti itself this functionality is not needed, and is only > > +provided as a way to help administrate or recover nodes, it is a local > > +site decision whether to enable or not the restricted commands feature. > > Please also add a sentence saying that it's disabled by default. Done. > > +Conf daemon > > +----------- > > + > > +In Ganeti 2.7, the ``confd`` daemon (if enabled at build time), serves > > +both network-originated queries and local (UNIX socket) queries which > > +can make use of the internal RPC SSL certificate. This makes it a bit > > The bit about the certificates is a bit confusing. First I thought one > would use the certificate for LUXI. Can you re-word this a bit? Yeah, I wasn't happy with it either. See the interdiff. > > +more sensitive to bugs (a remote attacker could get direct access to the > > +intra-cluster RPC), so to harden security it's recommended to: > > + > > +- disable confd at build time if it's not needed in your setup > > +- otherwise, configure ganeti (at build time) to use separate users, so > > s/ganeti/Ganeti/ Done. > > + that the confd daemon doesn't also have access to the server SSL/TLS > > + certificates > > + > > +It is planned to split the two functionalities (local/remote querying) > > +of confd into two separate daemons in a future Ganeti version. Thanks for the review. Interdiff: diff --git a/doc/security.rst b/doc/security.rst index d6784af..4b4e976 100644 --- a/doc/security.rst +++ b/doc/security.rst @@ -60,7 +60,7 @@ directories are supervised and only trusted sources can populate them. Restricted commands ~~~~~~~~~~~~~~~~~~~ -The restricted commands feature is new in Ganeti 2.7. It enabled the +The restricted commands feature is new in Ganeti 2.7. It enables the administrator to run any commands in the ``/etc/ganeti/restricted-commands`` directory, if the feature has been enabled at build time, subject to the following restrictions: @@ -73,13 +73,15 @@ enabled at build time, subject to the following restrictions: by root:root Note that it's not possible to list the contents of the directory, and -there is an intentional delay when trying execute a non-existing -filename (to slow-down dictionary attacks). +there is an intentional delay when trying to execute a non-existing +command (to slow-down dictionary attacks). Since for Ganeti itself this functionality is not needed, and is only provided as a way to help administrate or recover nodes, it is a local site decision whether to enable or not the restricted commands feature. +By default, this feature is disabled. + Cluster issues -------------- @@ -124,13 +126,15 @@ Conf daemon ----------- In Ganeti 2.7, the ``confd`` daemon (if enabled at build time), serves -both network-originated queries and local (UNIX socket) queries which -can make use of the internal RPC SSL certificate. This makes it a bit -more sensitive to bugs (a remote attacker could get direct access to the -intra-cluster RPC), so to harden security it's recommended to: +both network-originated queries (about the static configuration) and +local (UNIX socket) queries (about the run-time configuration; answering +these means talking to other cluster nodes, which makes use of the +internal RPC SSL certificate). This makes it a bit more sensitive to +bugs (a remote attacker could get direct access to the intra-cluster +RPC), so to harden security it's recommended to: - disable confd at build time if it's not needed in your setup -- otherwise, configure ganeti (at build time) to use separate users, so +- otherwise, configure Ganeti (at build time) to use separate users, so that the confd daemon doesn't also have access to the server SSL/TLS certificates -- thanks! iustin
