Skip to content

mrngm/go-dromaius

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

go-dromaius

go-dromaius is a tool that wraps commands from libvirt's virsh. It allows a hypervisor administrator to give users access to their virtual machine(s) without giving full access to all virtual machines.

Rationale

Usually, a hypervisor administrator can use polkit(8) to restrict access to users. See for example this answer to a Serverfault question on restricting access to KVM virtual machines. Unfortunately, all examples assume a polkit version >= 0.106, whereas this version is still not available in Ubuntu 19.04 (disco) nor Debian 10 (Buster). The restrictions available in polkit < 0.106 are not fine-grained enough to restrict access to one virtual machine. See also these posts.

Supported commands

go-dromaius supports the following commands:

  • start
  • reboot
  • shutdown
  • destroy
  • reset
  • console

Building

  • cd cmd/dromaius && go build

Setup

  • Create a user, e.g.:
# adduser --system --disabled-password --shell /bin/bash --ingroup nogroup --home /var/lib/dromaius dromaius
  • Prepare the .ssh/ directory:
# mkdir -p /var/lib/dromaius/.ssh
# touch /var/lib/dromaius/.ssh/authorized_keys
# chown dromaius:nogroup /var/lib/dromaius/.ssh/
# chmod 700 /var/lib/dromaius/.ssh/
# chmod 600 /var/lib/dromaius/.ssh/authorized_keys
  • By default (in Debian), the libvirt-sock UNIX socket has mode 777, allowing read/write access to all. If your configuration is different, make sure the dromaius user is in the correct group, and the socket has the correct user/group/mode settings
  • Per supplied SSH key, add the following line to /var/lib/dromaius/.ssh/authorized_keys:
command="/var/lib/dromaius/dromaius -cmd interactive -host <full hostname of the VM>",no-agent-forwarding,no-port-forwarding,no-X11-forwarding <ssh-key>
  • Set the allowed hosts in /var/lib/dromaius/dromaius.json (see dromaius.json.example)
  • Let the user use ssh dromaius@vm-host to access the interactive console.

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Packages

No packages published

Contributors 4

  •  
  •  
  •  
  •  

Languages