question about phpVirtualBox

[GoogleCodeExporter]

Sorry if this is the wrong place, you don't seem to have a forum.  I figured I 
would ask this here as you are sure to know.

When phpVirtualBox talks to the hosts vboxwebsrv does it do it all in clear 
text?  Or does VirtualBox provide an encrypted channel for communication?  I am 
asking due to security concerns about the possibility of sending false commands 
to the host.

Thanks.

Original issue reported on code.google.com by gscarbor...@gmail.com on 22 Feb 2011 at 2:54

[GoogleCodeExporter]

Google Code hosting does not provide a forum :(.

vboxwebsrv does not offer an encrypted communication option. All communication 
between phpVirtualBox and vboxwebsrv uses XML / clear text. However, in order 
to send false commands to the host, the "hacking" end must know the username / 
password of the system user that is running vboxwebsrv.

Original comment by imooreya...@gmail.com on 22 Feb 2011 at 4:39

• Changed state: Done

[GoogleCodeExporter]

Thanks for the info.  Do you know if anyone sets this up using stunnel or
has any interest in doing so?  I was thinking of setting up VirtualBox on a
small cluster but need to make sure its secure.  If there is an interest, I
could write up a how-to.

Gary

Original comment by gscarbor...@gmail.com on 23 Feb 2011 at 1:24

[GoogleCodeExporter]

I don't know of anyone who has it running through stunnel. If you would like to 
write something up, I'd be happy to include it in the Wiki.

Original comment by imooreya...@gmail.com on 23 Feb 2011 at 1:34

[GoogleCodeExporter]

We use phpvirtualbox to connect to remote VB servers, ONLY using secure VPN 
connections.
HTH

Original comment by briangro...@gmail.com on 14 Mar 2011 at 7:22