On Mon, Nov 07, 2016 at 04:59:44PM -0800, Ashish Mittal wrote: > Source code for the qnio library that this code loads can be downloaded from: > https://github.com/MittalAshish/libqnio.git > > Sample command line using the JSON syntax: > ./qemu-system-x86_64 -name instance-00000008 -S -vnc 0.0.0.0:0 -k en-us > -vga cirrus -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5 > -msg timestamp=on > 'json:{"driver":"vxhs","vdisk-id":"c3e9095a-a5ee-4dce-afeb-2a59fb387410", > "server":{"host":"172.172.17.4","port":"9999"}}' > > Sample command line using the URI syntax: > qemu-img convert -f raw -O raw -n > /var/lib/nova/instances/_base/0c5eacd5ebea5ed914b6a3e7b18f1ce734c386ad > vxhs://192.168.0.1:9999/c6718f6b-0401-441d-a8c3-1f0064d75ee0
I'm wondering what the security story is here. QEMU is connecting to a remote TCP server but apparently not providing any username or password or other form of credentials to authenticate itself with. This seems to imply that the network server accepts connections to access disks from any client anywhere. Surely this isn't correct, and there must be some authentication scheme in there, to prevent the server being wide open to any malicious attacker, whether on the network, or via a compromised QEMU process accessing volumes it shouldn't ? If there is authentication, then how is QEMU providing the credentials ? Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|
