This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


RE: [Xen-users] Web Console Access

To: "Felix Kuperjans" <felix@xxxxxxxxxxxxxxxxxx>, <xen-users@xxxxxxxxxxxxxxxxxxx>
Subject: RE: [Xen-users] Web Console Access
From: "Jonathan Tripathy" <jonnyt@xxxxxxxxxxx>
Date: Fri, 18 Jun 2010 13:26:52 +0100
Delivery-date: Fri, 18 Jun 2010 05:29:28 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <46C13AA90DB8844DAB79680243857F0F0AFD30@xxxxxxxxxxxxxxxxxxx> <4C1B5E61.8090002@xxxxxxxxxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index: AcsO3VWzkn1qHtuATyejEvIbLzBbdgABDJnU
Thread-topic: [Xen-users] Web Console Access
Hi Felix,
Thanks for the email.
>a simple init=/bin/bash added to the kernel command line allows resetting the root password...
ok this worries me. Can you please explain this a little further? Do you need to have access to the Dom0 to begin with?

From: xen-users-bounces@xxxxxxxxxxxxxxxxxxx on behalf of Felix Kuperjans
Sent: Fri 18/06/2010 12:54
To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] Web Console Access

Hi Jonathan,

do you definitely need a web console (so really browser-based) or would you consider a SSH-based console?

I personally prefer SSH because it is more secure, easier to set up and it is somehow the default way of accessing remote consoles. You can do a modified SSH setup that only allows access to the console, or optionally, access to xm console, xm list, xm shutdown, xm create but restricted to the own VM of your customer. With chroot-jails etc., other commands cannot be executed.
SSH also has the advantage of good copy & paste of larger commands, and the possibility to work with multiple client certificates and / or passwords. Probably your administrative interface allows uploading of multiple public keys, so that your customers can have multiple adminsitrative accounts for the server (but only one can access the console at a time).

I've got no experiences with ajaxterm, but you should really control its security:
Console access is quite useful for hackers, e.g. some customer may forget to log out root or if you use pvgrub / pygrub, a simple init=/bin/bash added to the kernel command line allows resetting the root password...
So it must be a really secure application, not vulnerable to XSS, SQL Injections, Connection hijacking, ... and SSL encrypted.

Felix Kuperjans

Am 18.06.2010 13:02, schrieb Jonathan Tripathy:
Hi Everyone,
Does anyone have any idea on how to give my customers a "web console" for their VMs?
Using http://antony.lesuisse.org/software/ajaxterm/ I can manually set up a remote session for them, by doing
ajaxterm.py -c xm console <DOMNAME>
However is there any way to make this automatic? Maybe I could put it in the vif script?
_______________________________________________ Xen-users mailing list Xen-users@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-users
Xen-users mailing list
<Prev in Thread] Current Thread [Next in Thread>