XenServer Disable Root
-
@DustinB3403 said in XenServer Disable Root:
Sudo is available.
Ok, so the rest is easy. Just allow your user to be a sudo'er (add them to the sudo grouip on most systems or check your sudoers config file)
-
It's general SCAP standards. We are using Open SCAP since it covers a little more. Here's just the general profile.
http://static.open-scap.org/ssg-guides/ssg-rhel6-guide-common.html
-
@thwr said in XenServer Disable Root:
@DustinB3403 said in XenServer Disable Root:
Sudo is available.
Ok, so the rest is easy. Just allow your user to be a sudo'er (add them to the sudo grouip on most systems or check your sudoers config file)
Well with XenCenter it's not that simple. Any user created is added as a Pool Admin and has control over the VMs.
If you connect as a new user with XenCenter you now have root access through the console.
-
I'm linking to an old, old document here. It should still work the same way for XenServer 6.5, I'm not sure about XenServer 7. Is the XenServer 7 management OS still based on CentOS 6.5?
Anyway, CentOS 5.1 docs. Looks like the Red Hat Documentation is the same.
I'd shy away from disabling it via PAM. If you are forcing people to use sudo (even if they do something like 'sudo -i'), everything they do gets logged. Which is why you always want to login to your normal user account and then su or sudo in order to do system level work.
-
@stacksofplates said in XenServer Disable Root:
@thwr said in XenServer Disable Root:
@DustinB3403 said in XenServer Disable Root:
Sudo is available.
Ok, so the rest is easy. Just allow your user to be a sudo'er (add them to the sudo grouip on most systems or check your sudoers config file)
Well with XenCenter it's not that simple. Any user created is added as a Pool Admin and has control over the VMs.
If you connect as a new user with XenCenter you now have root access through the console.
Sorry, only played once with XenServer many years ago. That's just a common Linux / BSD / *NIX approach and basically the same thing that Ubuntu does.
-
I might end up switching to KVM if I can't get it to work. It will give me support through Red Hat and I can use our normal profile to kickstart with and just add the hypervisor role.
KVM is nice because I just add a user to the libvirt group and they can control the VMs but still have regular system permissions.
-
I also want to know what SCAP is? Disabling the ability to make changes to a system isn't really a good idea in general.
-
@travisdh1 said in XenServer Disable Root:
I'm linking to an old, old document here. It should still work the same way for XenServer 6.5, I'm not sure about XenServer 7. Is the XenServer 7 management OS still based on CentOS 6.5?
Anyway, CentOS 5.1 docs. Looks like the Red Hat Documentation is the same.
I'd shy away from disabling it via PAM. If you are forcing people to use sudo (even if they do something like 'sudo -i'), everything they do gets logged. Which is why you always want to login to your normal user account and then su or sudo in order to do system level work.
Ya we have to use sudo.
I didn't think it logged correctly if you did a sudo su or sudo -i.
-
@stacksofplates said in XenServer Disable Root:
@travisdh1 said in XenServer Disable Root:
I'm linking to an old, old document here. It should still work the same way for XenServer 6.5, I'm not sure about XenServer 7. Is the XenServer 7 management OS still based on CentOS 6.5?
Anyway, CentOS 5.1 docs. Looks like the Red Hat Documentation is the same.
I'd shy away from disabling it via PAM. If you are forcing people to use sudo (even if they do something like 'sudo -i'), everything they do gets logged. Which is why you always want to login to your normal user account and then su or sudo in order to do system level work.
Ya we have to use sudo.
I didn't think it logged correctly if you did a sudo su or sudo -i.
It should, if it doesn't I'd say something is broken.
-
@travisdh1 said in XenServer Disable Root:
I also want to know what SCAP is? Disabling the ability to make changes to a system isn't really a good idea in general.
It's not disabling root, it's disabling remote root access. The problem is I would have remote root access through XenCenter.
-
@stacksofplates said in XenServer Disable Root:
I might end up switching to KVM if I can't get it to work. It will give me support through Red Hat and I can use our normal profile to kickstart with and just add the hypervisor role.
KVM is nice because I just add a user to the libvirt group and they can control the VMs but still have regular system permissions.
Keep in mind that there are not many backup options available with KVM. Even @KOOLER had to ask, and I bet he knows what he's doing: https://community.spiceworks.com/topic/1577463-kvm-vm-backup
-
The SCAP guide here says you only need to disable root SSH access, not ROOT on the local console.
I think you'd be fine.
http://static.open-scap.org/ssg-guides/ssg-rhel6-guide-common.html > Ctrl+f "disable root"
-
Which the hardening guide I've posted shows how to disable SSH root access.
-
@DustinB3403 said in XenServer Disable Root:
The SCAP guide here says you only need to disable root SSH access, not ROOT on the local console.
I think you'd be fine.
http://static.open-scap.org/ssg-guides/ssg-rhel6-guide-common.html > Ctrl+f "disable root"
You still have remote root access through XenCenter. I know how to turn off remote root through SSH.
If I do a useradd and give that user no extra permissions, I can log in as that user in XenCenter and they now have root access. Plus, root can still log in through XenCenter.
-
@thwr said in XenServer Disable Root:
@stacksofplates said in XenServer Disable Root:
I might end up switching to KVM if I can't get it to work. It will give me support through Red Hat and I can use our normal profile to kickstart with and just add the hypervisor role.
KVM is nice because I just add a user to the libvirt group and they can control the VMs but still have regular system permissions.
Keep in mind that there are not many backup options available with KVM. Even @KOOLER had to ask, and I bet he knows what he's doing: https://community.spiceworks.com/topic/1577463-kvm-vm-backup
Ya, we do both agent based and I have a couple KVM machines running. I use the qemu-guest-agent to allow filesystem freezing. I take a snapshot, then unfreeze the fs. Export the snapshot to a file on a remote system, then delete the snapshot. Takes like 20 seconds per VM. So we are covered with that.
-
So your concern shouldn't be "How do I disable root" but it should be; How do I ensure no one else has XenCenter installed and access to my servers?
-
@DustinB3403 said in XenServer Disable Root:
So your concern shouldn't be "How do I disable root" but it should be; How do I ensure no one else has XenCenter installed and access to my servers?
No it should still be how do I disable remote root access. That's the issue that needs to be resolved.
-
To which,
What I would do is remove the XC installable from XenServer's webconsole, and configure everything on Xen Orchestra.
Then do a sweep of your network ensuring no one has XenCenter that isn't supposed to.
-
@stacksofplates said in XenServer Disable Root:
@DustinB3403 said in XenServer Disable Root:
So your concern shouldn't be "How do I disable root" but it should be; How do I ensure no one else has XenCenter installed and access to my servers?
No it should still be how do I disable remote root access. That's the issue that needs to be resolved.
But that issue has already been solved.
Remote root access is disabled via the information I've already provided.You're contriving a separate issue into this one.
Remove XenCenter installable from the XS systems, and uninstall it from everyones' computers.
Problem solved.
-
@DustinB3403 said in XenServer Disable Root:
To which,
What I would do is remove the XC installable from XenServer's webconsole, and configure everything on Xen Orchestra.
Then do a sweep of your network ensuring no one has XenCenter that isn't supposed to.
So first off, I can't do a sweep of our network. We have like 800 people working here and I don't control the network. Second, to meet SCAP we need to disable all remote root access. If I can't do that, then it doesn't work.
