mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-12-30 11:10:33 -07:00
e1a6dc91dd
Pre-Shared Keys (PSK) is a simpler mechanism for enabling TLS
connections than using certificates. It requires only a simple secret
key:
$ mkdir -m 0700 /tmp/keys
$ psktool -u rjones -p /tmp/keys/keys.psk
$ cat /tmp/keys/keys.psk
rjones:d543770c15ad93d76443fb56f501a31969235f47e999720ae8d2336f6a13fcbc
The key can be secretly shared between clients and servers. Clients
must specify the directory containing the "keys.psk" file and a
username (defaults to "qemu"). Servers must specify only the
directory.
Example NBD client:
$ qemu-img info \
--object tls-creds-psk,id=tls0,dir=/tmp/keys,username=rjones,endpoint=client \
--image-opts \
file.driver=nbd,file.host=localhost,file.port=10809,file.tls-creds=tls0,file.export=/
Example NBD server using qemu-nbd:
$ qemu-nbd -t -x / \
--object tls-creds-psk,id=tls0,endpoint=server,dir=/tmp/keys \
--tls-creds tls0 \
image.qcow2
Example NBD server using nbdkit:
$ nbdkit -n -e / -fv \
--tls=on --tls-psk=/tmp/keys/keys.psk \
file file=disk.img
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|---|---|---|
| .. | ||
| aes.c | ||
| afalg.c | ||
| afalgpriv.h | ||
| afsplit.c | ||
| block-luks.c | ||
| block-luks.h | ||
| block-qcow.c | ||
| block-qcow.h | ||
| block.c | ||
| blockpriv.h | ||
| cipher-afalg.c | ||
| cipher-builtin.c | ||
| cipher-gcrypt.c | ||
| cipher-nettle.c | ||
| cipher.c | ||
| cipherpriv.h | ||
| desrfb.c | ||
| hash-afalg.c | ||
| hash-gcrypt.c | ||
| hash-glib.c | ||
| hash-nettle.c | ||
| hash.c | ||
| hashpriv.h | ||
| hmac-gcrypt.c | ||
| hmac-glib.c | ||
| hmac-nettle.c | ||
| hmac.c | ||
| hmacpriv.h | ||
| init.c | ||
| ivgen-essiv.c | ||
| ivgen-essiv.h | ||
| ivgen-plain.c | ||
| ivgen-plain.h | ||
| ivgen-plain64.c | ||
| ivgen-plain64.h | ||
| ivgen.c | ||
| ivgenpriv.h | ||
| Makefile.objs | ||
| pbkdf-gcrypt.c | ||
| pbkdf-nettle.c | ||
| pbkdf-stub.c | ||
| pbkdf.c | ||
| random-gcrypt.c | ||
| random-gnutls.c | ||
| random-platform.c | ||
| secret.c | ||
| tlscreds.c | ||
| tlscredsanon.c | ||
| tlscredspriv.h | ||
| tlscredspsk.c | ||
| tlscredsx509.c | ||
| tlssession.c | ||
| trace-events | ||
| xts.c | ||