Comments (2)
I've been working on this in github.com/hallyn/lxd #cert.4. The current state of it is:
Client and server talk over tlsv1.2.
Client and server create certificates at first startup.
Client sends his certificate to server at remote add time.
Server stores client certificates under /var/lib/lxd/clientcerts/[ServerName].
Server rejects communications (except trust/add, which will require password) from unknown certificates.
Server accepts password setting over /trust post.
The client does not yet present server certificate fingerprint for user to ok/deny.
The client does not check server certificates at connect time.
The server does not yet check the password at /trust/add.
(I'm probably forgetting other remaining gotchas)
The result at the moment is fully usable and an improvement over the current master branch, since at least communications are now encrypted.
This is all done over old-web interface. It'll all need to be switched to the specified rest apis. I figure we'll do all of that conversion at once, hopefully next week.
from lxd.
The caveat about server not checking password at /trust/add is no longer applicable
from lxd.
Related Issues (20)
- Allow `lxc init/launch` of an instance where the source image is in another project
- lxd/lxc cannot write on /tmp/snap-private-tmp/snap.lxd/tmp HOT 4
- Enable optimized backups when using the Ceph RBD driver HOT 1
- Clarify the availability of optimized backups for the storage drivers HOT 2
- Add support for optimized-storage backups with ceph
- Investigate whether image export requests over devlxd should use the instances' project
- OVN load balancer backend health checks
- Desktop image cannot be unlocked HOT 1
- [Bug][6.1] : `lxc config device add <device_name> eth0 none` fails with ws error HOT 10
- "Unable to run feature checks during QEMU initialization: open /tmp/1373261747: no such file or directory" breaks VM use cases HOT 10
- Unable to join LXD Cluster on 6.1 HOT 29
- Support of Backup Management
- Guest has no networking for over five minutes HOT 6
- "Failed to write files: Operation not supported" when running systemd-sysusers inside a container HOT 2
- lxd fails in unpredictable ways when used with an unsupported "future" guest
- Container issues with Ubuntu Oracular systemd version 256-1ubuntu1 HOT 7
- Don't fail when notifiying a server that is shutting down when using NotifyAlive
- snap remove lxd apparently deletes external zfs zpool but the disk is not re-usuable
- Setting preseed through `daemon.preseed` fails on Ubuntu Core HOT 14
- Ambiguous Configuration Edit Methods with YAML Files HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lxd.