gstfsd, the root service on each compute that rewrites a shut-off VM's
/etc/shadow and authorized_keys, did what any client on its port asked.
Now it needs GSTFSD_KEY (64 hexadecimal characters, in the unit's
/etc/default/webvirt-gstfsd) and does not start without it. Each
connection gets a new challenge; the panel signs its request for it
with HMAC-SHA256 and gstfsd checks the signature before any change, so
a request recorded on one connection is refused on another. gstfsd
signs its reply for the same challenge and the panel's nonce, and the
panel accepts only that reply.
Each compute has a gstfsd key, the host's GSTFSD_KEY: the compute forms
and the API take it and never show it, and an empty value on an edit
keeps it. The bootstrap script makes the key file once, readable by
root only; the README shows how to make it and where the panel takes
it. The traffic is still not encrypted: a remote panel's port stays
open to the panel's address only.
Found by provisioning disposable computes with the bootstrap:
- Ubuntu and Debian: a socket-activated libvirtd ignores libvirtd_opts
"-l", so TCP needs libvirtd-tcp.socket; Ubuntu also kept SASL on
gssapi instead of digest-md5.
- EL10: only virtqemud and virtproxyd were enabled, so storage, network,
interface and other drivers did not answer; and the SELinux policy lets
virtproxyd read but not map the SASL database, so TCP logins failed
(a one-rule module allows it).
- Run from a clone, the bootstrap installs that clone's gstfsd and unit
instead of downloading them.
The RHEL manual install failed at libvirt-devel, which is in CRB; the
installer already enables it. openSUSE's nginx.conf has its own port-80
server for localhost, which the RHEL steps already warn about. The
bootstrap skipped /etc/os-release as a symlink, which on openSUSE Leap
is the only release file, so it found no distribution.
The compute bootstrap installs gstfsd and webvirt-gstfsd.service in one
helper and no longer installs or restarts supervisor; the README's
compute step does the same, a remote panel's bind goes into a drop-in,
and a compute moving from supervisor removes its gstfsd program.
echodebug compared _ECHO_DEBUG and BS_TRUE with -eq, but neither is set
anywhere, so each step printed "[: : integer expression expected". It
now prints debug lines only when _ECHO_DEBUG=1 is set.
The quoting of the tr argument in the /etc/os-release parsing put the
closing parenthesis inside a single-quoted string, so sh and bash
stopped with "unexpected EOF while looking for matching )" before doing
anything: 'curl ... | sudo sh' failed on every distribution. It is now
tr -d "\"'"; bash -n and shellcheck -S error pass.
Also drops the spice_listen edits of qemu.conf; only VNC is used.
