This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] XCP: Insecure Distro ?

To: <xen-users@xxxxxxxxxxxxxxxxxxx>
Subject: Re: [Xen-users] XCP: Insecure Distro ?
From: A Cold Penguin <verycoldpenguin@xxxxxxxxxxx>
Date: Tue, 10 May 2011 07:16:12 +0000
Delivery-date: Tue, 10 May 2011 00:17:48 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
Importance: Normal
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
> The points highlighted don't represent security risks if the dom0 is
> properly isolated on a secure management network.

Unfortunately there are some situations where even having an air-gap between networks, is not considered secure enough.
Having the password hashes in world-readable files is basically a no-no, and would mean that this product could not go into production use.
Basically this appears to be a relaxation in security against the 'norm', if this is only required due to keeping different pool members in sync,
I think that investigation should be made into an alternative method of synchronising the members.
Xen-users mailing list