You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

Introduction

Purpose

User should be able to reset the ssh key for a VM, i.e., to associate a new/different ssh key for a VM

Feature Specifications

Feature Objective

  • This feature provides reset of a SSH key for an existing VM which means resetting the old ssh key that is assigned to the VM previously with the new ssh key.
  • User should be able to provide the keypair name which is already created or registered.
  • After resetting the ssh key for the VM, if the template used by VM is password enabled then Encrypted.Password entry needs to be updated in the DB.
  • Password for the VM is to be encrypted with the new ssh public key.
  • This feature can also be applicable for a VM which does not have ssh key before. (i.e., for setting a ssh keypair for a VM)

Use cases

If a user lost the SSH keypair that got assigned to a VM  then there will be no access to that VM. If somehow the key got compromised and user wants to change the ssh key. At these points there should be a way to reset the SSH Key for the VM. 

Architecture and Design description

  • The design is similar to the reset password feature, things change in terms of the SSH keypair.
  • User is able to use an existing keypair or a new keypair to reset ssh key
    • Prior to use reset ssh key api, user can create a new keypair or register a keypair by providing publickey.
    • To create a new keypair there is an api createSSHKeyForVirtualMachine=com.cloud.api.commands.CreateSSHKeyPairCmd 
    • To register a new keypair there is an api registerSSHKeyForVirtualMachine=com.cloud.api.commands.ResetSSHKeyPairCmd 
  • User provides the keypair name in reset ssh api
  • During resetting, if the template used by VM is password enabled then Encrypted.Password entry needs to be updated in the DB
    • Since the password is not saved anywhere, a new password is to be generated for the VM, encrypt it with the new public key and update the entry Encrypted.Password.
    • There is no provision to get the password of a VM to encrypt it with new ssh public key. (Since password is transient)
  • Send user data to virtual router for updating the new public key and password (if password enabled template).

web services APIs

  • resetSSHKeyForVirtualMachine=com.cloud.api.commands.ResetSSHKeyCmd
    • o   Parameters
      • id : The ID of the virtual machine
      • name: name of the ssh keypair
      • account: Account name of owner
      • domainid: Domain ID of owner
    • Response
      • Uservm details (UserVmResponse)
      • name: name of the ssh keypair
      • password: the password (if exists) of the virtual machine

 

Command example:    http://localhost:8096/client/api?command=resetSSHKeyForVirtualMachine&account=admin&domainid=1&id=9936af8e-e899-4d13-b66d-2d72c7044a83&name=keypair1

(Keypair1 is the name of the sshkeypair that is already created/registered)

UI flow

Since, there is no provision in UI to associate the ssh key while deploying a VM, the suggestion is not to have a UI for resetting the VM's ssh key.

  • No labels