Hide Forgot
Description of problem: BZ1003117 introduced easy way how to define plain-text communication between engine and hosts. But to make it work practically, one has to modify vdsm.conf on the hosts. As 'EncryptHostCommunication' is now available to admins, it would be probably wise to offer configuration of the other part (hosts) - ssl knob inside host properties dialog. Version-Release number of selected component (if applicable): is21 How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
This is already supported, if you deploy host after setting of the EncryptHostCommunication to false at engine side. Please reopen if not working.
So if I already have host in the setup before EncryptHostCommunication=false am I left to do manual kung-fu? This is the point of my BZ.
(In reply to Jiri Belka from comment #2) > So if I already have host in the setup before EncryptHostCommunication=false > am I left to do manual kung-fu? This is the point of my BZ. We do not touch vdsm configuration post host-deploy. Besides, turning off SSL via engine after deployment is breaking security trust. Had the ssl setting was per host, I could have imagine that something can be done. Reopening, while I do not think this should be implemented.
Arthur , Please see comment 3 and decide what should be done here
We do have some missing parts to make this feature complete: 1. Make EncryptHostCommunication configurable per host. 2. Engine should be able to switch between Encrypted/PlainText without the admin manually configuring vdsm.conf for each host. 2.1 Engine should be able to fail-back if it switched between encrypted/plain-text and failed to communicate with the host. 3. Add Cluster level configuration for encrypted / plain-text with hosts. 3. When moving hosts between clusters we should make sure a host can communicate with new security policy [ encrypted | plain-text ]before moving to the new cluster. 4. On hosts general tab we should indication if the communication with a host is encrypted or plaintext. Arthur
(In reply to Arthur Berezin from comment #5) > We do have some missing parts to make this feature complete: > > 1. Make EncryptHostCommunication configurable per host. > > 2. Engine should be able to switch between Encrypted/PlainText without the > admin manually configuring vdsm.conf for each host. > 2.1 Engine should be able to fail-back if it switched between > encrypted/plain-text and failed to communicate with the host. > > 3. Add Cluster level configuration for encrypted / plain-text with hosts. > > 3. When moving hosts between clusters we should make sure a host can > communicate with new security policy [ encrypted | plain-text ]before moving > to the new cluster. > > 4. On hosts general tab we should indication if the communication with a > host is encrypted or plaintext. > > > Arthur While I do not understand the actual requirement, nor the use case. I expect: vdsm to listen to both encrypted and plain text ports, similar to httpd for http and https. Or: vdsm to support startTLS protocol on single port, so we can work encrypted or plain on same port. And: add vdsm command via its protocol to enable/disable plain text communication. <then copy above requirements>
Thanks Alon. We introduced a new security feature, now it has to be visible to the user, and the user should be able to use it easily via UI at cluster level. Does both encrypted and plain text use port 54321, if not we have to take under account that other ports might be blocked by firewall, and alert the user.
> Thanks Alon. We introduced a new security feature, now it has to be visible to the user, and the user should be able to use it easily via UI at cluster level. when have we introduced security feature? the SSL protocol can be disabled only because in the past developers needed that to setup their development environment. disabling SSL will also disable protocol authentication, and allow *ANY* host to completely control vdsm. please explain what is the "security feature" and the reason to disable ssl post installation exposing the host. you are actually adding security vulnerability to the product!
Hello, I want to clean this as WONTFIX, if anyone has something to say, please speak now. Thanks,