service.
Original message
From: Logan Barfield lbarfi...@tqhosting.com
Date: 03/12/2014 19:32 (GMT+03:30)
To: dev@cloudstack.apache.org
Subject: Re: A secure way to reset VMs password
Passwords are most definitely a necessity, but not having SSH Keys in the
GUI
19:32 (GMT+03:30)
To: dev@cloudstack.apache.org
Subject: Re: A secure way to reset VMs password
Passwords are most definitely a necessity, but not having SSH Keys in the
GUI at this point just doesn't make any sense.
To clarify my thoughts on the current password system: I think a re-write
I'm all for making the password reset system more secure, as long as it
isn't required. I don't think the risk is substantial for isolated
networks, and being forced to reconfigure every template would be a big
hassle.
I do agree that SSH Key injection should also be available in the GUI.
It's a
To: dev@cloudstack.apache.org
Sent: Wednesday, 3 December, 2014 04:44:33
Subject: Re: A secure way to reset VMs password
A stupid question!
I can't find the source of windows version of password manager! Where is it?
Sent from Samsung Mobile.
div Original message
: A secure way to reset VMs password
Why do passwords at all? Why not just use ssh keys like AWS does. The
functionality is already there just not in the ACS UI. Cloud-init already
supports it which is available in most distros and therefore would not require
CS specific scripts. At least
are still used a lot.
--
Sent from the Delta quadrant using Borg technology!
Nux!
www.nux.ro
- Original Message -
From: Carlos Reategui create...@gmail.com
To: dev@cloudstack.apache.org
Sent: Wednesday, 3 December, 2014 05:19:07
Subject: Re: A secure way to reset VMs password
- Original Message -
From: Carlos Reategui create...@gmail.com
To: dev@cloudstack.apache.org
Sent: Wednesday, 3 December, 2014 05:19:07
Subject: Re: A secure way to reset VMs password
Why do passwords at all? Why not just use ssh keys like AWS does. The
functionality is already
Eskandari astro.alir...@yahoo.com
Sent: Friday, 28 November, 2014 09:34:02
Subject: Re: A secure way to reset VMs password
Another point to note is all the vms in production has to update
with the new cloud-set-guest-password scripts because of the new password
reset
method.
Thanks
Subject: Re: A secure way to reset VMs password
That password reset infrastructure has bigger issues than just SSL. The server
side works, but that’s about all I can say for it. This topic comes up every
6-12 months. :)
I thought there was a Jira entry but I can’t find it…personally I’d love
@cloudstack.apache.org /divdivSubject: Re: A secure way
to reset VMs password /divdiv
/divYou would need client-side certs as well since the password server needs
to be able to validate WHO is asking for the password. Currently it is based on
the client's IP address.
Also the current scheme is a single-use password
@cloudstack.apache.org
dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
Date: Tuesday, December 2, 2014 at 1:32 PM
To: dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
Subject: Re: A secure way to reset VMs password
is it?
Sent from Samsung Mobile.
div Original message /divdivFrom: Chiradeep Vittal
chiradeep.vit...@citrix.com /divdivDate:03/12/2014 02:05 (GMT+03:30)
/divdivTo: dev@cloudstack.apache.org /divdivSubject: Re: A secure way
to reset VMs password /divdiv
/divYou would need
@cloudstack.apache.org
dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
Date: Tuesday, December 2, 2014 at 1:32 PM
To: dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
Subject: Re: A secure way to reset VMs password
there.https://issues.apache.org/jira/browse/CLOUDSTACK-8009
Thanks
From: John Kinsella j...@stratosec.co
To: dev@cloudstack.apache.org dev@cloudstack.apache.org
Sent: Wednesday, December 3, 2014 9:18 AM
Subject: Re: A secure way to reset VMs password
It's not our place to enforce how
@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
Subject: Re: A secure way to reset VMs password
That password reset infrastructure has bigger issues than just SSL. The
server side works, but that’s about all I can say for it. This topic
@cloudstack.apache.org
dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
Date: Tuesday, December 2, 2014 at 1:32 PM
To: dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
dev@cloudstack.apache.orgmailto:dev@cloudstack.apache.org
Subject: Re: A secure way to reset VMs password
@cloudstack.apache.org
Subject: Re: A secure way to reset VMs password
That password reset infrastructure has bigger issues than just SSL. The
server side works, but that’s about all I can say for it. This topic comes
up every 6-12 months. :)
I thought there was a Jira entry but I can’t find
@cloudstack.apache.org dev@cloudstack.apache.org
Sent: Wednesday, December 3, 2014 9:18 AM
Subject: Re: A secure way to reset VMs password
It's not our place to enforce how users authenticate to their VMs. We provide
flexible options, suggest best practices, and let them use the tool as best
suits
On Thu, Nov 27, 2014 at 3:54 PM, Alireza Eskandari
astro.alir...@yahoo.com.invalid wrote:
HiI viewed the bash script that resets Linux password (
http://download.cloud.com/templates/4.2/bindir/cloud-set-guest-password.in)It
seems that it doesn't use a secure way for transferring password
Another point to note is all the vms in production has to update
with the new cloud-set-guest-password scripts because of the new password reset
method.
Thanks,
Jayapal
On 28-Nov-2014, at 2:28 PM, Erik Weber terbol...@gmail.com
wrote:
On Thu, Nov 27, 2014 at 3:54 PM, Alireza Eskandari
For me personaly, this Cloudstack feature is used only during damn I
forgot my password and during deploying new VM from template.
After I get access to VM - the password should be really changed anyway.
I agree it's unsecure, but again you are supposed to change it - and not
hope that the
@cloudstack.apache.org
Cc: Alireza Eskandari astro.alir...@yahoo.com
Sent: Friday, 28 November, 2014 12:05:53
Subject: Re: A secure way to reset VMs password
For me personaly, this Cloudstack feature is used only during damn I
forgot my password and during deploying new VM from template.
After
way to reset VMs password
Another point to note is all the vms in production has to update
with the new cloud-set-guest-password scripts because of the new password
reset
method.
Thanks,
Jayapal
On 28-Nov-2014, at 2:28 PM, Erik Weber terbol...@gmail.com
wrote:
On Thu, Nov 27
HiI viewed the bash script that resets Linux password
(http://download.cloud.com/templates/4.2/bindir/cloud-set-guest-password.in)It
seems that it doesn't use a secure way for transferring password string to
instance.Instances on a shared network can sniff password requests and export
Sent: Thursday, 27 November, 2014 14:54:40
Subject: A secure way to reset VMs password
HiI viewed the bash script that resets Linux password
(http://download.cloud.com/templates/4.2/bindir/cloud-set-guest-password.in)It
seems that it doesn't use a secure way for transferring password string
PM
Subject: Re: A secure way to reset VMs password
+1 on this, Alireza I think it would be best if you submitted a bug in
https://issues.apache.org/jira/
--
Sent from the Delta quadrant using Borg technology!
Nux!
www.nux.ro
26 matches
Mail list logo
