Bug 658144
| Summary: | Make SASL work over UNIX domain sockets | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | RHEL Program Management <pm-rhel> |
| Component: | libvirt | Assignee: | Daniel Veillard <veillard> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.1 | CC: | cpelland, dallan, danken, eblake, iheim, jdenemar, kxiong, mjenner, plyons, pm-eus, xen-maint, yoyzhang |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-0.8.1-27.el6_0.1 | Doc Type: | Bug Fix |
| Doc Text: |
The "addrToString" methods did not work properly with UNIX domain sockets which did not have a normal "host:port" address. As a result SASL (Simple Authentication and Security Layer) could not be used over UNIX domain sockets. With this update, the "addrToString" methods are fixed and SASL is no longer restricted to TCP connections.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-04-14 16:19:15 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 641687 | ||
| Bug Blocks: | 570526 | ||
|
Description
RHEL Program Management
2010-11-29 14:11:43 UTC
Patches built into libvirt-0.8.1-27.el6_0.1 I am general sure about my test steps, but I have a little concern in https://bugzilla.redhat.com/show_bug.cgi?id=641687#c12 Could anyone please help confirm weather it is OK to regard this bug as pass or not? Thanks. Verified this bug with libvirt-0.8.1-27.el6_0.2.x86_64 - kernel-2.6.32-71.13.1.el6.x86_64 - qemu-kvm-0.12.1.2-2.113.el6_0.5.x86_64 Test steps: 1. Edit /etc/libvirt/libvirtd.conf to use 'sasl' as auth auth_unix_rw = "sasl" 2. # service libvirtd restart 3. # echo redhat | saslpasswd2 -p -a libvirt tester 4. # virsh -q qemu+unix:///system error: unknown command: 'qemu+unix:///system' [root@dhcp-65-132 ~]# virsh -c qemu+unix:///system Please enter your authentication name: tester Please enter your password: Welcome to virsh, the virtualization interactive terminal. Type: 'help' for help with commands 'quit' to quit virsh # list --all Id Name State ---------------------------------- virsh # quit 5. # virsh -c qemu+unix:///system --readonly Welcome to virsh, the virtualization interactive terminal. Type: 'help' for help with commands 'quit' to quit virsh > list --all Id Name State ---------------------------------- virsh > quit Verified with
libvirt: libvirt-0.8.1-27.el6_0.3
kernel: kernel-2.6.32-71.16.1.el6
qemu-kvm: qemu-kvm-0.12.1.2-2.113.el6_0.6
Steps
1. Edit /etc/libvirt/libvirtd.conf as below
auth_unix_ro="none"
auth_unix_rw = "sasl"
2.# service libvirtd restart
3.# saslpasswd2 -a libvirt test
4.# virsh -c qemu+unix:///system
Please enter your authentication name: test
Please enter your password:
Welcome to virsh, the virtualization interactive terminal.
Type: 'help' for help with commands
'quit' to quit
virsh #
5.
# virsh -c qemu+unix:///system --readonly
Welcome to virsh, the virtualization interactive terminal.
Type: 'help' for help with commands
'quit' to quit
virsh >
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0446.html
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
The "addrToString" methods did not work properly with UNIX domain sockets which did not have a normal "host:port" address. As a result SASL (Simple Authentication and Security Layer) could not be used over UNIX domain sockets. With this update, the "addrToString" methods are fixed and SASL is no longer restricted to TCP connections.
|