XenServer Disable Root
-
Plus the ability to clone, copy, etc.
-
Sure I understand it's like standing in front of the box - though I'm not sure why EVERY SINGLE USER in XC gets that level of access - it is truly remote access after all, so why aren't there levels of granted access?
I do understand someone physically standing in front of a server can own it, can root it via booting into other tools, but assuming they can't boot to other tools, aren't allowed to boot it period - how do they get around the logon prompt to get root access?
If I have a linux box in front of me, assuming I'm not allowed to reboot it, how do I get root? all I have is my own personal non root logon name.. now what? Does console access itself somehow grant me some extra permission?
-
@Dashrender said in XenServer Disable Root:
Sure I understand it's like standing in front of the box - though I'm not sure why EVERY SINGLE USER in XC gets that level of access - it is truly remote access after all, so why aren't there levels of granted access?
Because it isn't a cloud platform. It's not meant for multiple users.
-
@Dashrender said in XenServer Disable Root:
If I have a linux box in front of me, assuming I'm not allowed to reboot it, how do I get root? all I have is my own personal non root logon name.. now what? Does console access itself somehow grant me some extra permission?
You can't. but with XC, you can reboot.
-
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
If I have a linux box in front of me, assuming I'm not allowed to reboot it, how do I get root? all I have is my own personal non root logon name.. now what? Does console access itself somehow grant me some extra permission?
You can't. but with XC, you can reboot.
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
-
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
-
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
I'm not really sure what John wanted these non admin to be able to do that they wouldn't have root in the first place.
-
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
-
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
I'm not exactly sure what you mean by a cloud? You mean a real cloud like AWS? growing and shrinking as needed dynamically? or do you mean something like DO?
-
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
Not that I ever tried, but I thought VMWare with Vsphere could allow these types of users, who could admin VMs, but not change the host itself, etc.
-
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
I'm not exactly sure what you mean by a cloud? You mean a real cloud like AWS? growing and shrinking as needed dynamically? or do you mean something like DO?
Both and neither. Those are hosted clouds and both do the same thing, more or less. So both are cloud and yes that's what I mean because they both do user provisioning as that is part of cloud. Neither grow or shrink really, so not sure what you mean there.
OpenStack is the obvious choice, bolts right on to Xen.
-
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
Not that I ever tried, but I thought VMWare with Vsphere could allow these types of users, who could admin VMs, but not change the host itself, etc.
They do, that's a feature there. But one that XO brings, too.
-
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
I'm not exactly sure what you mean by a cloud? You mean a real cloud like AWS? growing and shrinking as needed dynamically? or do you mean something like DO?
Both and neither. Those are hosted clouds and both do the same thing, more or less. So both are cloud and yes that's what I mean because they both do user provisioning as that is part of cloud. Neither grow or shrink really, so not sure what you mean there.
OpenStack is the obvious choice, bolts right on to Xen.
Yeah something like OpenStack (that's a real cloud computing, right?) the auto grow/shrink platform?
-
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
I'm not exactly sure what you mean by a cloud? You mean a real cloud like AWS? growing and shrinking as needed dynamically? or do you mean something like DO?
Just for general reference, I always mean the same thing when I say cloud
A cloud is a specific architectural design and I always mean it literally like that. That architecture requires user management to function. so while auto-provisioning isn't needed here, it just comes along for the ride. -
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
I'm not exactly sure what you mean by a cloud? You mean a real cloud like AWS? growing and shrinking as needed dynamically? or do you mean something like DO?
Both and neither. Those are hosted clouds and both do the same thing, more or less. So both are cloud and yes that's what I mean because they both do user provisioning as that is part of cloud. Neither grow or shrink really, so not sure what you mean there.
OpenStack is the obvious choice, bolts right on to Xen.
Yeah something like OpenStack (that's a real cloud computing, right?) the auto grow/shrink platform?
As real as it gets! But doesn't grow or shrink.
-
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
I'm not exactly sure what you mean by a cloud? You mean a real cloud like AWS? growing and shrinking as needed dynamically? or do you mean something like DO?
Both and neither. Those are hosted clouds and both do the same thing, more or less. So both are cloud and yes that's what I mean because they both do user provisioning as that is part of cloud. Neither grow or shrink really, so not sure what you mean there.
OpenStack is the obvious choice, bolts right on to Xen.
Yeah something like OpenStack (that's a real cloud computing, right?) the auto grow/shrink platform?
As real as it gets! But doesn't grow or shrink.
I thought that was one of the main gains in cloud computing - the ability to bring more resources online as needed, and then turn them off (stop paying for them) when you don't?
-
As for John's need -
@stacksofplates who are you giving access to the XS that wouldn't/shouldn't have root access to anyway? I guess today if you really need to give department level access to a VM, you do that through XO and those users, assuming those users don't exist/have permission in XC you should be good to go.
-
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
@scottalanmiller said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
So what I'm asking - why can't you take rebooting away from an XC user? That seems like a highly short sited implementation.
Because XC doesn't have a user permissions system, plain and simple. XC isn't for that. XO is, OpenStack is. If you want that and you have XC, you've selected the wrong tool for the job,
AWWW - now the knowledge is coming forth.
So, pre XO, how were non admins suppose to be able to manage VMs on XS? or were they not?
They were not. Why would non-admins be using a system like this? If you wanted something like that why not run a cloud?
I'm not exactly sure what you mean by a cloud? You mean a real cloud like AWS? growing and shrinking as needed dynamically? or do you mean something like DO?
Both and neither. Those are hosted clouds and both do the same thing, more or less. So both are cloud and yes that's what I mean because they both do user provisioning as that is part of cloud. Neither grow or shrink really, so not sure what you mean there.
OpenStack is the obvious choice, bolts right on to Xen.
Yeah something like OpenStack (that's a real cloud computing, right?) the auto grow/shrink platform?
As real as it gets! But doesn't grow or shrink.
I thought that was one of the main gains in cloud computing - the ability to bring more resources online as needed, and then turn them off (stop paying for them) when you don't?
That's not a feature of cloud computing. That's a feature of scale-out architecture... to an extent.
-
@Dashrender said in XenServer Disable Root:
As for John's need -
@stacksofplates who are you giving access to the XS that wouldn't/shouldn't have root access to anyway? I guess today if you really need to give department level access to a VM, you do that through XO and those users, assuming those users don't exist/have permission in XC you should be good to go.
Ya the XO users wouldn't have any XenServer permissions.
I'm more thinking along the lines of keeping in line with requirements/compliance issues placed on us. I've thought about it a little more and I'm sure I can pull off explaining it's the same as iLO or iDRAC. It's just I know who I have to explain this stuff to compliance wise, and it's like explaining quantum physics to a 3rd grader.
It's just these are the kind of people that see you can type root from your desktop and log into a machine from anywhere. So to them, that's root access, and you're going to have a really hard time explaining/changing their mind. Just something I have to deal with (which is why I was trying to find a way to disable it so I can save myself the trouble).
-
@stacksofplates said in XenServer Disable Root:
@Dashrender said in XenServer Disable Root:
As for John's need -
@stacksofplates who are you giving access to the XS that wouldn't/shouldn't have root access to anyway? I guess today if you really need to give department level access to a VM, you do that through XO and those users, assuming those users don't exist/have permission in XC you should be good to go.
Ya the XO users wouldn't have any XenServer permissions.
I'm more thinking along the lines of keeping in line with requirements/compliance issues placed on us. I've thought about it a little more and I'm sure I can pull off explaining it's the same as iLO or iDRAC. It's just I know who I have to explain this stuff to compliance wise, and it's like explaining quantum physics to a 3rd grader.
It's just these are the kind of people that see you can type root from your desktop and log into a machine from anywhere. So to them, that's root access, and you're going to have a really hard time explaining/changing their mind. Just something I have to deal with (which is why I was trying to find a way to disable it so I can save myself the trouble).
Wouldn't the solution to the "see you type root from your desktop" be an explanation of the technology?
Don't get me wrong, I am totally for you doing what needs to be done, but if they don't understand the technology, how can they best determine the security around said technology?
