208 lines
6.4 KiB
Diff
208 lines
6.4 KiB
Diff
changeset: 1147:7481eafdde8d
|
|
user: berrange
|
|
date: Fri Oct 12 18:54:15 2007 +0000
|
|
files: libvirt.spec.in qemud/Makefile.am qemud/libvirtd.conf src/Makefile.am src/qemu.conf
|
|
description:
|
|
Added default example configs for libvirtd/qemu driver
|
|
|
|
|
|
diff -r c48e81e685a3 -r 7481eafdde8d qemud/libvirtd.conf
|
|
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
|
|
+++ b/qemud/libvirtd.conf Fri Oct 12 18:54:15 2007 +0000
|
|
@@ -0,0 +1,141 @@
|
|
+# Master libvirt daemon configuration file
|
|
+#
|
|
+# For further information consult http://libvirt.org/format.html
|
|
+
|
|
+
|
|
+# Flag listening for secure TLS connections on the public TCP/IP port.
|
|
+# NB, must pass the --listen flag to the libvirtd process for this to
|
|
+# have any effect.
|
|
+#
|
|
+# It is neccessary to setup a CA and issue server certificates before
|
|
+# using this capability.
|
|
+#
|
|
+# This is enabled by default, uncomment this to disable it
|
|
+# listen_tls = 0
|
|
+
|
|
+# Listen for unencrypted TCP connections on the public TCP/IP port.
|
|
+# NB, must pass the --listen flag to the libvirtd process for this to
|
|
+# have any effect.
|
|
+#
|
|
+# NB, this is insecure. Do not use except for development.
|
|
+#
|
|
+# This is disabled by default, uncomment this to enable it.
|
|
+# listen_tcp = 1
|
|
+
|
|
+
|
|
+
|
|
+# Override the port for accepting secure TLS connections
|
|
+# This can be a port number, or service name
|
|
+#
|
|
+# tls_port = "16514"
|
|
+
|
|
+# Override the port for accepting insecure TCP connections
|
|
+# This can be a port number, or service name
|
|
+#
|
|
+# tcp_port = "16509"
|
|
+
|
|
+
|
|
+
|
|
+# Flag toggling mDNS advertizement of the libvirt service.
|
|
+#
|
|
+# Alternatively can disable for all services on a host by
|
|
+# stopping the Avahi daemon
|
|
+#
|
|
+# This is enabled by default, uncomment this to disable it
|
|
+# mdns_adv = 0
|
|
+
|
|
+# Override the default mDNS advertizement name. This must be
|
|
+# unique on the immediate broadcast network.
|
|
+#
|
|
+# The default is "Virtualization Host HOSTNAME", where HOSTNAME
|
|
+# is subsituted for the short hostname of the machine (without domain)
|
|
+#
|
|
+# mdns_name "Virtualization Host Joe Demo"
|
|
+
|
|
+
|
|
+
|
|
+# Set the UNIX domain socket group ownership. This can be used to
|
|
+# allow a 'trusted' set of users access to management capabilities
|
|
+# without becoming root.
|
|
+#
|
|
+# This is restricted to 'root' by default.
|
|
+# unix_sock_group "libvirt"
|
|
+
|
|
+# Set the UNIX socket permissions for the R/O socket. This is used
|
|
+# for monitoring VM status only
|
|
+#
|
|
+# Default allows any user. If setting group ownership may want to
|
|
+# restrict this to:
|
|
+# unix_sock_ro_perms "0777"
|
|
+
|
|
+# Set the UNIX socket permissions for the R/W socket. This is used
|
|
+# for full management of VMs
|
|
+#
|
|
+# Default allows only root. If setting group ownership may want to
|
|
+# relax this to:
|
|
+# unix_sock_rw_perms "octal-perms" "0770"
|
|
+
|
|
+
|
|
+
|
|
+# Flag to disable verification of client certificates
|
|
+#
|
|
+# Client certificate verification is the primary authentication mechanism.
|
|
+# Any client which does not present a certificate signed by the CA
|
|
+# will be rejected.
|
|
+#
|
|
+# Default is to always verify. Uncommenting this will disable
|
|
+# verification - make sure an IP whitelist is set
|
|
+# tls_no_verify_certificate 1
|
|
+
|
|
+# Flag to disable verification of client IP address
|
|
+#
|
|
+# Client IP address will be verified against the CommonName field
|
|
+# of the x509 certificate. This has minimal security benefit since
|
|
+# it is easy to spoof source IP.
|
|
+#
|
|
+# Uncommenting this will disable verification
|
|
+# tls_no_verify_address 1
|
|
+
|
|
+# Override the default server key file path
|
|
+#
|
|
+# key_file "/etc/pki/libvirt/private/serverkey.pem"
|
|
+
|
|
+# Override the default server certificate file path
|
|
+#
|
|
+# cert_file "/etc/pki/libvirt/servercert.pem"
|
|
+
|
|
+# Override the default CA certificate path
|
|
+#
|
|
+# ca_file "/etc/pki/CA/cacert.pem"
|
|
+
|
|
+# Specify a certificate revocation list.
|
|
+#
|
|
+# Defaults to not using a CRL, uncomment to enable it
|
|
+# crl_file "/etc/pki/CA/crl.pem"
|
|
+
|
|
+# A whitelist of allowed x509 Distinguished Names
|
|
+# This list may contain wildcards such as
|
|
+#
|
|
+# "C=GB,ST=London,L=London,O=Red Hat,CN=*"
|
|
+#
|
|
+# See the POSIX fnmatch function for the format of the wildcards.
|
|
+#
|
|
+# NB If this is an empty list, no client can connect, so comment out
|
|
+# entirely rather than using empty list to disable these checks
|
|
+#
|
|
+# By default, no DN's are checked
|
|
+# tls_allowed_dn_list ["DN1", "DN2"]
|
|
+
|
|
+
|
|
+# A whitelist of allowed client IP addresses
|
|
+#
|
|
+# This list may contain wildcards such as 192.168.* See the POSIX fnmatch
|
|
+# function for the format of the wildcards.
|
|
+#
|
|
+# NB If this is an empty list, no client can connect, so comment out
|
|
+# entirely rather than using empty list to disable these checks
|
|
+#
|
|
+# By default, no IP's are checked. This can be IPv4 or IPv6 addresses
|
|
+# tls_allowed_ip_list ["ip1", "ip2", "ip3"]
|
|
+
|
|
+
|
|
diff -r c48e81e685a3 -r 7481eafdde8d src/qemu.conf
|
|
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
|
|
+++ b/src/qemu.conf Fri Oct 12 18:54:15 2007 +0000
|
|
@@ -0,0 +1,49 @@
|
|
+# Master configuration file for the QEMU driver.
|
|
+# All settings described here are optional - if omitted, sensible
|
|
+# defaults are used.
|
|
+
|
|
+# VNC is configured to listen on 127.0.0.1 by default.
|
|
+# To make it listen on all public interfaces, uncomment
|
|
+# this next option.
|
|
+#
|
|
+# NB, strong recommendation to enable TLS + x509 certificate
|
|
+# verification when allowing public access
|
|
+#
|
|
+# vnc_listen = "0.0.0.0"
|
|
+
|
|
+
|
|
+# Enable use of TLS encryption on the VNC server. This requires
|
|
+# a VNC client which supports the VeNCrypt protocol extension.
|
|
+# Examples include vinagre, virt-viewer, virt-manager and vencrypt
|
|
+# itself. UltraVNC, RealVNC, TightVNC do not support this
|
|
+#
|
|
+# It is neccessary to setup CA and issue a server certificate
|
|
+# before enabling this.
|
|
+#
|
|
+# vnc_tls = 1
|
|
+
|
|
+
|
|
+# Use of TLS requires that x509 certificates be issued. The
|
|
+# default it to keep them in /etc/pki/libvirt-vnc. This directory
|
|
+# must contain
|
|
+#
|
|
+# ca-cert.pem - the CA master certificate
|
|
+# server-cert.pem - the server certificate signed with ca-cert.pem
|
|
+# server-key.pem - the server private key
|
|
+#
|
|
+# This option allows the certificate directory to be changed
|
|
+#
|
|
+# vnc_tls_x509_cert_dir = "/etc/pki/libvirt-vnc"
|
|
+
|
|
+
|
|
+# The default TLS configuration only uses certificates for the server
|
|
+# allowing the client to verify the server's identity and establish
|
|
+# and encrypted channel.
|
|
+#
|
|
+# It is possible to use x509 certificates for authentication too, by
|
|
+# issuing a x509 certificate to every client who needs to connect.
|
|
+#
|
|
+# Enabling this option will reject any client who does not have a
|
|
+# certificate signed by the CA in /etc/pki/libvirt-vnc/ca-cert.pem
|
|
+#
|
|
+# vnc_tls_x509_verify = 1
|
|
|