{"id":61,"date":"2018-08-21T13:58:21","date_gmt":"2018-08-21T21:58:21","guid":{"rendered":"http:\/\/iaastalk.com\/?p=61"},"modified":"2018-08-21T13:58:21","modified_gmt":"2018-08-21T21:58:21","slug":"openstack-nova-live-migration-security-sasl","status":"publish","type":"post","link":"http:\/\/iaastalk.com\/?p=61","title":{"rendered":"Openstack Nova Live Migration Security SASL"},"content":{"rendered":"<p class=\"p1\">Live migration set up<\/p>\n<p class=\"p1\">block based migration or leaving it with default<\/p>\n<p class=\"p1\"># \/etc\/nova\/nova.conf<\/p>\n<p class=\"p1\">block_migration_flag=VIR_MIGRATE_UNDEFINE_SOURCE,VIR_MIGRATE_PEER2PEER,VIR_MIGRATE_LIVE,VIR_MIGRATE_TUNNELLED,VIR_MIGRATE_NON_SHARED_INC,VIR_MIGRATE_AUTO_CONVERGE<\/p>\n<p class=\"p1\">====TCP based======<\/p>\n<p class=\"p1\">\/etc\/nova\/nova.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">[libvirt]<\/p>\n<p class=\"p1\">live_migration_uri = &#8220;qemu+tcp:\/\/%s\/system&#8221;<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">\/etc\/libvirt\/libvirtd.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">listen_tls = 0<\/p>\n<p class=\"p1\">listen_tcp = 1<\/p>\n<p class=\"p1\">unix_sock_group = &#8220;libvirt&#8221;<\/p>\n<p class=\"p1\">unix_sock_ro_perms = &#8220;0777&#8221;<\/p>\n<p class=\"p1\">unix_sock_rw<\/p>\n<p class=\"p1\">_perms = &#8220;0770&#8221;<\/p>\n<p class=\"p1\">auth_unix_ro = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_unix_rw = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_tcp = \u201cnone\u201d<\/p>\n<p class=\"p1\">\/etc\/default\/libvirtd<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">start_libvirtd=&#8221;yes&#8221;<\/p>\n<p class=\"p1\">libvirtd_opts=&#8221;-l&#8221;<\/p>\n<p class=\"p1\">*restart both libvirt-bin &amp; nova-compute *<\/p>\n<p class=\"p1\">testing<\/p>\n<p class=\"p1\">virsh -c qemu+tcp:\/\/hostname_peer\/system hostname<\/p>\n<p class=\"p1\">====TCP+SASL ======<\/p>\n<p class=\"p1\">install<\/p>\n<p class=\"p1\">apt update<\/p>\n<p class=\"p1\"><strong>apt install sasl2-bin<\/strong><\/p>\n<p class=\"p1\">\/etc\/nova\/nova.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">[libvirt]<\/p>\n<p class=\"p1\">live_migration_uri = &#8220;qemu+tcp:\/\/%s\/system&#8221;<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">\/etc\/libvirt\/libvirtd.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">listen_tls = 0<\/p>\n<p class=\"p1\">listen_tcp = 1<\/p>\n<p class=\"p1\">unix_sock_group = &#8220;libvirt&#8221;<\/p>\n<p class=\"p1\">unix_sock_ro_perms = &#8220;0777&#8221;<\/p>\n<p class=\"p1\">unix_sock_rw<\/p>\n<p class=\"p1\">_perms = &#8220;0770&#8221;<\/p>\n<p class=\"p1\">auth_unix_ro = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_unix_rw = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_tcp = \u201csasl\u201d<\/p>\n<p class=\"p1\">\/etc\/default\/libvirtd<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">start_libvirtd=&#8221;yes&#8221;<\/p>\n<p class=\"p1\">libvirtd_opts=&#8221;-l&#8221;<\/p>\n<p class=\"p1\">\/etc\/sasl2\/libvirt.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">mech_list: digest-md5<\/p>\n<p class=\"p1\">sasldb_path: \/etc\/sasldb2<\/p>\n<p class=\"p1\">create user test and give nova as password<\/p>\n<p class=\"p1\">\u2014\u2014\u2014<\/p>\n<p class=\"p1\">saslpasswd2 -a libvirt test<\/p>\n<p class=\"p1\">sasldblistusers2 -f \/etc\/sasldb2<\/p>\n<p class=\"p1\"><strong>enable libvirt client auto authenticate without prompt<\/strong><\/p>\n<p class=\"p1\">\u2014\u2014<\/p>\n<p class=\"p1\">\/etc\/libvirt\/auth.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">[credentials-defgrp]<\/p>\n<p class=\"p1\"><strong>authname<\/strong>=test<\/p>\n<p class=\"p1\">password=nova<\/p>\n<p class=\"p1\">[auth-libvirt-default]<\/p>\n<p class=\"p1\">credentials=defgrp<\/p>\n<p class=\"p1\">*restart both libvirt-bin &amp; nova-compute *<\/p>\n<p class=\"p1\">test, should just work, with not prompt for user&amp;password<\/p>\n<p class=\"p1\">virsh -c qemu+tcp:\/\/hostname_peer\/system hostname<\/p>\n<p class=\"p1\">=====================<\/p>\n<p class=\"p1\">====TLS full validation ======<\/p>\n<p class=\"p1\">key tools<\/p>\n<p class=\"p1\">apt-get install gnutls-bin<\/p>\n<p class=\"p1\">\/etc\/nova\/nova.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">[libvirt]<\/p>\n<p class=\"p1\">live_migration_uri = &#8220;qemu+tls:\/\/%s\/system&#8221;<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">\/etc\/libvirt\/libvirtd.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">listen_tls = 1<\/p>\n<p class=\"p1\">tls_no_verify_certificate = 0<\/p>\n<p class=\"p1\">tls_no_verify_address = 0<\/p>\n<p class=\"p1\">listen_tcp = 0<\/p>\n<p class=\"p1\">unix_sock_group = &#8220;libvirt&#8221;<\/p>\n<p class=\"p1\">unix_sock_ro_perms = &#8220;0777&#8221;<\/p>\n<p class=\"p1\">unix_sock_rw<\/p>\n<p class=\"p1\">_perms = &#8220;0770&#8221;<\/p>\n<p class=\"p1\">auth_unix_ro = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_unix_rw = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_tls = \u201cnone\u201d<\/p>\n<p class=\"p1\">\/etc\/default\/libvirtd<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">start_libvirtd=&#8221;yes&#8221;<\/p>\n<p class=\"p1\">libvirtd_opts=&#8221;-l&#8221;<\/p>\n<p class=\"p1\">generate key pairs &amp; certs following<\/p>\n<p><a class=\"external-link\" href=\"https:\/\/wiki.libvirt.org\/page\/TLSSetup\" rel=\"nofollow\">https:\/\/wiki.libvirt.org\/page\/TLSSetup<\/a><\/p>\n<p class=\"p1\">service nova-compute restart<\/p>\n<p class=\"p1\">virsh -c qemu+tls:\/\/venus-2\/system hostname<\/p>\n<p class=\"p1\">virsh -c qemu+tls:\/\/venus-6\/system hostname<\/p>\n<p class=\"p1\">*restart both libvirt-bin &amp; nova-compute *<\/p>\n<p class=\"p1\">test, should just work<\/p>\n<p class=\"p1\">virsh -c qemu+tls:\/\/hostname_peer\/system hostname<\/p>\n<p class=\"p1\">======================<\/p>\n<p class=\"p1\">===TLS no validation ======<\/p>\n<p class=\"p1\">key tools<\/p>\n<p class=\"p1\">apt-get install gnutls-bin<\/p>\n<p class=\"p1\">\/etc\/nova\/nova.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">[libvirt]<\/p>\n<p class=\"p1\">live_migration_uri = &#8220;qemu+tls:\/\/%s\/system&#8221;<\/p>\n<p class=\"p1\">..<\/p>\n<p class=\"p1\">\/etc\/libvirt\/libvirtd.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">listen_tls = 1<\/p>\n<p class=\"p1\">tls_no_verify_certificate = 1<\/p>\n<p class=\"p1\">tls_no_verify_address = 1<\/p>\n<p class=\"p1\">listen_tcp = 0<\/p>\n<p class=\"p1\">unix_sock_group = &#8220;libvirt&#8221;<\/p>\n<p class=\"p1\">unix_sock_ro_perms = &#8220;0777&#8221;<\/p>\n<p class=\"p1\">unix_sock_rw<\/p>\n<p class=\"p1\">_perms = &#8220;0770&#8221;<\/p>\n<p class=\"p1\">auth_unix_ro = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_unix_rw = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_tls = \u201cnone\u201d<\/p>\n<p class=\"p1\">\/etc\/default\/libvirtd<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">start_libvirtd=&#8221;yes&#8221;<\/p>\n<p class=\"p1\">libvirtd_opts=&#8221;-l&#8221;<\/p>\n<p class=\"p1\">generate key pairs &amp; certs following<\/p>\n<p><a class=\"external-link\" href=\"https:\/\/wiki.libvirt.org\/page\/TLSSetup\" rel=\"nofollow\">https:\/\/wiki.libvirt.org\/page\/TLSSetup<\/a><\/p>\n<p class=\"p1\">service libvirt-bin restart<\/p>\n<p class=\"p1\">service nova-compute restart<\/p>\n<p class=\"p1\">virsh -c qemu+tls:\/\/host-1\/system hostname<\/p>\n<p class=\"p1\">virsh -c qemu+tls:\/\/host-2\/system hostname<\/p>\n<p class=\"p1\">*restart both libvirt-bin &amp; nova-compute *<\/p>\n<p class=\"p1\">testing<\/p>\n<p class=\"p1\">virsh -c &#8220;qemu+tls:\/\/host-1\/system?no_verify=1&#8221; hostname<\/p>\n<p>virsh -c &#8220;qemu+tls:\/\/host-2\/system?no_verify=1&#8221; hostname<\/p>\n<p class=\"p1\">\n<p>&nbsp;<\/p>\n<p class=\"p1\">========TLS no validation + SASL========<\/p>\n<p class=\"p1\">following TLS no validation<\/p>\n<p class=\"p1\">a few changes<\/p>\n<p class=\"p1\">\/etc\/libvirt\/libvirtd.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">listen_tls = 1<\/p>\n<p class=\"p1\">tls_no_verify_certificate = 1<\/p>\n<p class=\"p1\">tls_no_verify_address = 1<\/p>\n<p class=\"p1\">listen_tcp = 0<\/p>\n<p class=\"p1\">unix_sock_group = &#8220;libvirt&#8221;<\/p>\n<p class=\"p1\">unix_sock_ro_perms = &#8220;0777&#8221;<\/p>\n<p class=\"p1\">unix_sock_rw<\/p>\n<p class=\"p1\">_perms = &#8220;0770&#8221;<\/p>\n<p class=\"p1\">auth_unix_ro = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_unix_rw = &#8220;none&#8221;<\/p>\n<p class=\"p1\">auth_tls = \u201csasl\u201d<\/p>\n<p class=\"p1\">\/etc\/sasl2\/libvirt.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">mech_list: digest-md5<\/p>\n<p class=\"p1\">sasldb_path: \/etc\/sasldb2<\/p>\n<ul class=\"ul1\">\n<li class=\"li1\">scram-sha-1 requires properly signed certs<\/li>\n<\/ul>\n<p class=\"p1\">create user test and give nova as password<\/p>\n<p class=\"p1\">\u2014\u2014\u2014<\/p>\n<p class=\"p1\">saslpasswd2 -a libvirt test<\/p>\n<p class=\"p1\">sasldblistusers2 -f \/etc\/sasldb2<\/p>\n<p class=\"p1\">libvirt client auto authenticate without prompt<\/p>\n<p class=\"p1\">\u2014\u2014<\/p>\n<p class=\"p1\">\/etc\/libvirt\/auth.conf<\/p>\n<p class=\"p1\">\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n<p class=\"p1\">[credentials-defgrp]<\/p>\n<p class=\"p1\">authname=test<\/p>\n<p class=\"p1\">password=nova<\/p>\n<p class=\"p1\">[auth-libvirt-default]<\/p>\n<p class=\"p1\">credentials=defgrp<\/p>\n<p class=\"p1\">*restart both libvirt-bin &amp; nova-compute *<\/p>\n<p class=\"p1\">testing<\/p>\n<p class=\"p1\">virsh -c &#8220;qemu+tls:\/\/host-1\/system?no_verify=1&#8221; hostname<\/p>\n<p class=\"p1\">====ssh tunneling ======<\/p>\n<p class=\"p1\">No libvirt change required<\/p>\n<p class=\"p1\">only nova.conf and generate keys for user nova<\/p>\n<p class=\"p1\">nova.conf<\/p>\n<p class=\"p1\">live_migration_uri = &#8220;qemu+ssh:\/\/nova@%s\/system?no_verify=1&amp;keyfile=\/var\/lib\/nova\/.ssh\/id_rsa&#8221;<\/p>\n<p class=\"p1\">see user nova<span class=\"Apple-converted-space\">\u00a0 <\/span>and path to its private key file is specified in the url<\/p>\n<p class=\"p1\">add public keys to authenticated hosts files.<\/p>\n<p class=\"p1\">Note: nova user login shell required.. further research required to limit set of binaries..<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Live migration set up block based migration or leaving it with default # \/etc\/nova\/nova.conf block_migration_flag=VIR_MIGRATE_UNDEFINE_SOURCE,VIR_MIGRATE_PEER2PEER,VIR_MIGRATE_LIVE,VIR_MIGRATE_TUNNELLED,VIR_MIGRATE_NON_SHARED_INC,VIR_MIGRATE_AUTO_CONVERGE ====TCP based====== \/etc\/nova\/nova.conf \u2014\u2014\u2014\u2014\u2014\u2014 .. [libvirt] live_migration_uri = &#8220;qemu+tcp:\/\/%s\/system&#8221; .. \/etc\/libvirt\/libvirtd.conf \u2014\u2014\u2014\u2014\u2014\u2014 listen_tls = 0 listen_tcp = 1 unix_sock_group = &#8220;libvirt&#8221; unix_sock_ro_perms = &#8220;0777&#8221; unix_sock_rw _perms = &#8220;0770&#8221; auth_unix_ro = &#8220;none&#8221; auth_unix_rw = &#8220;none&#8221; auth_tcp = \u201cnone\u201d \/etc\/default\/libvirtd \u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014 start_libvirtd=&#8221;yes&#8221; [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts\/61"}],"collection":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=61"}],"version-history":[{"count":1,"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts\/61\/revisions"}],"predecessor-version":[{"id":62,"href":"http:\/\/iaastalk.com\/index.php?rest_route=\/wp\/v2\/posts\/61\/revisions\/62"}],"wp:attachment":[{"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=61"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=61"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/iaastalk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=61"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}