A couple more slight modifications are needed to the spec file (see below).
As far as I can see this still has to be configured manually because the
settings to enable it are commented out in /etc/matahari-broker.conf,
and auth is still set to no. I think we need some way to enable this
automatically, at least when we are running mathari-vios-proxy-host.
However maybe that's best deferred a little bit, because we really need
to ensure that consoles (both the ones we ship and qmf-tool) have an
easy way to authenticate using this db. The obvious way to do that is to
have a matahari-specific qpidc.conf, but that is not yet available in Qpid.
I'm not clear on how saslpasswd2 works. If it's just setting the
password to the default "consoleuser" then this feature pretty useless
out of the box. We really want it to generate a random key for each
machine during installation. Can you confirm?
I'm also not clear on what the untrusteduser account is doing. I see
from your other patch that the broker on the guest appears to use this
username to connect, in which case it is probably relying on the
passwords to be the same on the host & guest? (What we really want is
for the host to install a key in /var/lib/matahari on the guest to
authenticate the guest broker. If only we had some sort of... system
management application...) In any event, there are no ACLs mentioning
it, so I don't know what it is actually doing.
Some general questions for the list regarding this feature:
- It looks like we're allowing only those authenticated as consoleuser
to act as consoles, and anyone to act as an agent. How can we prevent
unprivileged processes from spoofing agents? Do we need to?
-
https://github.com/matahari/matahari/wiki/Using-a-Qpid-Broker-to-Aggregat...
states that the broker the agents connect to need not have any ACLs set
up. I don't believe this is correct, as that will effectively give
unprivileged users root access to the box just by connecting to the
local broker as a console.
- Slightly off-topic, but the fact that security is enforced by the
broker makes our practice of looking up a DNS SRV entry for the broker
by default (though *not* in the default configuration on Linux) look a
little insecure, since spoofing a fake DNS entry is probably not the
hardest way to get root access to a box. The only secure way of doing
this is with SSL, which requires configuring the various certificates in
advance.
- In fact, isn't that the only secure way of connecting to a broker in
general?
- All in all it doesn't feel like security has been baked into the
design from the start. All the components are there, but configuring
them is tricky and we are still a long way from an installation that is
both usable and secure by default out of the box.
regards,
Zane.
On 17/10/11 19:02, Adam Stokes wrote:
Builds an access policy file so that an administrator
could bind an untrusted broker to a trusted. This allows
for setting up a push-route federation link from matahari
brokers that may reside on a qemu guest which would not
need extensive permissions in order to access a trusted broker.
See:
https://github.com/matahari/matahari/wiki/Using-a-Qpid-Broker-to-Aggregat...
Signed-off-by: Adam Stokes<astokes(a)fedoraproject.org>
---
CMakeLists.txt | 9 +++++++++
matahari-broker.conf.in | 5 +++++
matahari-policy.acl | 22 ++++++++++++++++++++++
matahari-sasl.conf.in | 3 +++
matahari.spec.in | 5 +++++
5 files changed, 44 insertions(+), 0 deletions(-)
create mode 100644 matahari-policy.acl
create mode 100644 matahari-sasl.conf.in
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 077687d..6eadedf 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -132,6 +132,9 @@ else(WIN32)
configure_file(${CMAKE_CURRENT_SOURCE_DIR}/matahari-vios-proxy.sysconf.in
${CMAKE_CURRENT_BINARY_DIR}/matahari-vios-proxy.sysconf @ONLY)
+ configure_file(${CMAKE_CURRENT_SOURCE_DIR}/matahari-sasl.conf.in
+ ${CMAKE_CURRENT_BINARY_DIR}/matahari-sasl.conf conf @ONLY)
+
install(DIRECTORY DESTINATION ${localstatedir}/lib/matahari
DIRECTORY_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
GROUP_READ GROUP_WRITE GROUP_EXECUTE)
@@ -148,6 +151,12 @@ else(WIN32)
install(FILES ${CMAKE_CURRENT_BINARY_DIR}/matahari-broker.conf DESTINATION
${sysconfdir})
install(FILES ${CMAKE_CURRENT_BINARY_DIR}/matahari-vios-proxy.sysconf DESTINATION
${sysconfdir}/sysconfig RENAME matahari-vios-proxy)
+
+ # ACL Policy
+ install(FILES ${CMAKE_CURRENT_BINARY_DIR}/matahari-policy.acl DESTINATION
share/matahari)
+
+ # SASL
+ install(FILES ${CMAKE_CURRENT_BINARY_DIR}/matahari-sasl.conf DESTINATION
${sysconfdir}/sasl2)
# Check for systemd
include(FindPkgConfig)
diff --git a/matahari-broker.conf.in b/matahari-broker.conf.in
index 8aeec38..c082bb2 100644
--- a/matahari-broker.conf.in
+++ b/matahari-broker.conf.in
@@ -23,3 +23,8 @@
# "qpidd --help" or "man qpidd" for more details.
cluster-mechanism=ANONYMOUS
auth=no
+
+# ACL
+# acl-file=/usr/share/matahari/matahari-policy.acl
+# SASL
+# sasl-config=/etc/sasl2/matahari-sasl.conf
diff --git a/matahari-policy.acl b/matahari-policy.acl
new file mode 100644
index 0000000..9e24320
--- /dev/null
+++ b/matahari-policy.acl
@@ -0,0 +1,22 @@
+group consoles consoleuser@QPID
+
+acl allow consoles create exchange name=qmf.default.direct
+acl allow consoles access exchange name=qmf.default.direct
+acl allow consoles bind exchange name=qmf.default.topic routingkey=direct-console.*
+acl allow consoles bind exchange name=qmf.default.topic routingkey=agent.*
+acl allow consoles publish exchange name=qmf.default.topic routingkey=direct-agent.*
+acl allow consoles publish exchange name=qmf.default.topic routingkey=console.*
+acl allow consoles publish exchange name=qmf.default.direct routingkey=broker
+
+acl allow all bind exchange name=qmf.default.topic routingkey=direct-agent.*
+acl allow all bind exchange name=qmf.default.topic routingkey=console.*
+acl allow all publish exchange name=qmf.default.topic routingkey=direct-console.*
+acl allow all publish exchange name=qmf.default.topic routingkey=agent.*
+acl allow all create link
+
+acl allow all create queue
+acl allow all create exchange name=qmf.default.topic
+acl allow all access exchange name=qmf.default.topic
+acl allow all consume
+
+acl deny all all
diff --git a/matahari-sasl.conf.in b/matahari-sasl.conf.in
new file mode 100644
index 0000000..8ce3e99
--- /dev/null
+++ b/matahari-sasl.conf.in
@@ -0,0 +1,3 @@
+mech_list: plain
+sasldb_path: @localstatedir(a)/lib/matahari/matahari.sasldb
+auxprop_plugin: sasldb
diff --git a/matahari.spec.in b/matahari.spec.in
index 130c4d8..0728a04 100644
--- a/matahari.spec.in
+++ b/matahari.spec.in
@@ -365,6 +365,9 @@ systemctl --system daemon-reload
/sbin/chkconfig --add matahari-broker
%endif
/sbin/service matahari-broker condrestart
+# SASL
+echo consoleuser | saslpasswd2 -f %{_localstatedir}/lib/matahari/matahari.sasldb -c
consoleuser@QPID -p
+echo untrusted | saslpasswd2 -f %{_localstatedir}/lib/matahari/matahari.sasldb -c
untrusted@QPID -p
Presumably we want to do this _before_ restarting the broker. And
probably only if the db doesn't already exist.
Please also add "Requires(post): cyrus-sasl" to the broker subpackage.
%preun broker
if [ $1 = 0 ]; then
@@ -567,8 +570,10 @@ test "x%{buildroot}" != "x"&& rm -rf
%{buildroot}
%endif
%config(noreplace) %{_sysconfdir}/sysconfig/matahari-broker
%config(noreplace) %{_sysconfdir}/matahari-broker.conf
+%config(noreplace) %{_sysconfdir}/sasl2/matahari-sasl.conf
%attr(755, root, root) %{_sbindir}/matahari-brokerd
%{_mandir}/man8/matahari-brokerd.8*
+%{_datadir}/matahari/matahari-policy.acl
%doc AUTHORS COPYING
%if %{systemd}