Decrypt and display VM generated password
Use Case
I launch an instance, choosing a Windows image and a pub key:
- on VM boot, Windows generates a random password for the Admin session
- the password is encrypted with the pub key and sent to the metadata server (for example with cloudbase-init)
- I can already retrieve this admin password via API with: nova get-password <VM-id> <Private-key>
Horizon Blueprint: "Being able to display and decrypt this password on Horizon"
- A popup display the encrypted password
- The user has to provide its private key to decrypt this password
- The private key should not transit over the network and being proceeded on the server side
- The private key should be used on the client side (any JS lib available for decryption? Use of HTML 5 FIle API / FileReader?)
- The password may not be available immediately after the launch of the instance (have to wait the VM to boot and generate the password)
- Several ways to provide the private key: copy and past inside an input, "browse > select a file", drag & drop
- Should be inspired by the way Amazon does this (either for the internal client side processing - if it does - and for UX aspects): more details to be sent later
Blueprint information
- Status:
- Complete
- Approver:
- David Lyle
- Priority:
- Medium
- Drafter:
- Cédric Soulas
- Direction:
- Needs approval
- Assignee:
- Ala Rezmerita
- Definition:
- New
- Series goal:
- Accepted for icehouse
- Implementation:
-
Implemented
- Milestone target:
-
2014.1
- Started by
- Cédric Soulas
- Completed by
- David Lyle
Related branches
Related bugs
Sprints
Whiteboard
Gerrit topic: https:/
Addressed by: https:/
Decrypt and display VM generated password
The demos are available here:
Demos:
1. Windows instance : https:/
2. Ubuntu instance : https:/
In order to test "Retrieve password" on devstack with Linux instances:
0. Checkout horizon review https:/
1. boot an instance
2. once connected on the instance do:
#curl --silent --fail http://
#PASSWORD=`openssl rand -base64 48 | tr -d '/+' | cut -c1-10`
#ENCRYPTED=`echo "$PASSWORD" | openssl rsautl -encrypt -pubin -inkey my_ssl_key -keyform PEM | openssl base64 -e -A`
#curl -X POST http://
#curl --silent --fail http://
3.Use horizon in order to retrieve the password
[jpichon 2014.03.03] Adding missing milestone + assigning correct owner
[jpichon 2014.03.05] Per discussion on #openstack-dev, the patch is close and has seen several round of reviews including from cores and someone from the security team. The Selenium tests can be pulled out and the related issues resolved in a separate patch.
Addressed by: https:/
Add selenium tests to instance Retrieve Password action
Addressed by: https:/
Add unit tests to instance Retrieve Password action
Work Items
Dependency tree
* Blueprints in grey have been implemented.
