...

No schema changes. Some configuration items will be created.

Configurations

The following new configurations will be added

• Global configuration to limit the max upload size of template/volume - max.post.upload.size
• hidden configuration to save sha1 PSK on the management server - upload.post.psk
• management server upload polling interval and polling timeout - upload.post.interval, upload.post.timeout
• time interval at which the GC or cleanup thread should run - upload.post.gc.interval

Security

• The NFS Store url, path and some other information are exposed to the end user in the response to getUploadParams. This is done so that agent gets all the information required to upload the template with the POST request. One option can be to encrypt the entire JSON and then send it across as part of response
• The Apache web server will only accept upload requests over HTTPS
• Proxy between apache and agent is internal to the SSVM. Hence no security threat here.
• SSVM PSK location can only be accessed by admin. Hence no security threat.

...

1. SSL CA certificates - what kind of certificates will be used?
2. PSK length - for now it can be a fixed length, later on it can be made configurable.

3. Upload url should be active only for one call - Its partially handled now (see below for details). The limitation needs to be addressed.

4. Recommended configuration of SSVM and apache web serverCreate a separate section to list out all the global config params
   

Bug Reference & Branch

CLOUDSTACK-....

...