[
https://issues.apache.org/jira/browse/CLOUDSTACK-417?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rohit Yadav resolved CLOUDSTACK-417.
------------------------------------
Resolution: Fixed
Fixed on master:
commit dbe88c1ed3c120ff0e0f38c67b6a03e3665fe987
Author: Rohit Yadav <[email protected]>
Date: Fri Oct 26 21:33:25 2012 +0530
> Handle password server securely to run on port 8080 on VR
> ---------------------------------------------------------
>
> Key: CLOUDSTACK-417
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-417
> Project: CloudStack
> Issue Type: Bug
> Affects Versions: 4.0.0
> Reporter: Rohit Yadav
> Assignee: Rohit Yadav
> Labels: security
> Fix For: 4.1.0
>
>
> When reset password feature is used, it runs cloud-passwd-srvr on virtual
> router on eth0, port 8080. By default this port is reachable from all IPs
> (0.0.0.0/0).
> So, for example:
> % telnet <vr-ip> 8080
> DomU_Request: send_my_password
> <output is password>
> Only guest vms, or vms in the guest cidr should be able to reach this port.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
