<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 12/29/2010 11:45 AM, Neil Wilson wrote:
<blockquote cite="mid:1293641126.3399.124.camel@lenovo-3000-n100"
type="cite">
<pre wrap="">Hi,
At the moment SASL VNC authentication in libvirt allows any of the
userids to access any of the VNC consoles on a particular libvirt host.
There is a section in the qemu_command code marked "TODO: Support ACLs
later" and we would really like the ability to have per VM user
authorization to the VNC console from within libvirt.
Essentially the people who are accessing the VNC consoles are not
administrators and have no access to the Host server - so these ACLs
need to be completely based on a separate list of userids to any access
mechanism for the libvirtd itself.
Given that the VNC restrictions are enforced within qemu from the
monitor system, I'm presuming the authorization list is going to have to
be passed in via XML and be capable of being updated throughout the life
of a VM session. Unless there's another way of doing it...
What's the feeling about how this feature should be provided within
libvirt?
</pre>
</blockquote>
<p>One issue is probably around migration and the server
(qemu-referenced) x509 certificates. If the certificates are
embedded (rather than referenced) in the domain XML they will
automatically migrate when the VM migrates, which is desirable.
Otherwise migration becomes (again) problematic and layers above
libvirt would have to take care of their migration.<br>
</p>
<p>The VNC session will still be lost due to the change of host and
thus the IP address and the client user will need to learn about
the new VNC port as well. <br>
</p>
<p>Quoting from Qemu documentation webpage:<br>
</p>
<p><a class="moz-txt-link-freetext" href="http://wiki.qemu.org/download/qemu-doc.html#vnc_005fsecurity">http://wiki.qemu.org/download/qemu-doc.html#vnc_005fsecurity</a><br>
</p>
<p><quote><br>
</p>
<h3 class="subsection">3.10.3 With x509 certificates</h3>
<p>The QEMU VNC server also implements the VeNCrypt extension
allowing use of
TLS for encryption of the session, and x509 certificates for
authentication.
The use of x509 certificates is strongly recommended, because TLS
on its
own is susceptible to man-in-the-middle attacks. Basic x509
certificate
support provides a secure session, but no authentication. This
allows any
client to connect, and provides an encrypted session.<br>
</p>
<pre class="example">qemu [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio
</pre>
<p>In the above example <code>/etc/pki/qemu</code> should contain
at least three files, <code>ca-cert.pem</code>, <code>server-cert.pem</code>
and <code>server-key.pem</code>. Unprivileged users will want to
use a private directory, for example <code>$HOME/.pki/qemu</code>.
NB the <code>server-key.pem</code> file should be protected with
file mode 0600 to only be readable by the user owning it.</p>
<pre class="example"></quote>
</pre>
<p><br>
It looks like the above mentioned 3 files would need to be
embedded...<br>
<br>
</p>
<p> Stefan<br>
</p>
<br>
</body>
</html>