On Wed, Oct 15, 2014 at 02:19:39PM +0200, Gerd Hoffmann wrote:
> Hi,
>
> This patch series adds support for multiple vnc server instances to
> qemu. This comes handy in multiseat configurations as you can have
> one vnc server for each set then.
>
> Some cleanups along the way (use QemuOpts). Also added support for
> limiting the number of parallel vnc connections.
>
> To be done: monitor support. I think the best way to handle this is to
> introduce a new command to query vnc server state, which returns a list
> of vnc servers but otherwise works like "query-vnc". Alternative
> approach would be to add a optional 'id=' parameter to query-vnc, but
> then you'll need a new list-vnc command.
>
> Opinions on this?
>
> set_password and expire_password commands should be easy, they can be
> extended with an optional 'id=' parameter.
In any serious deployment password auth won't be something that's used
due to its horrific insecurity. For TLS/SASL authentication protocols
we currently have a single acces control list defined
qemu_acl_init("vnc.x509dname") (validates x509 certificate)
qemu_acl_init("vnc.username") (validates SASL user name)
I think we are going to need to make one ACL list per seat. eg
qemu_acl_init("vnc.x509dname") (validates x509 certificate on seat 0)
qemu_acl_init("vnc.username") (validates SASL user name on seat 0)
qemu_acl_init("vnc.x509dname.1") (validates x509 certificate on seat 1)
qemu_acl_init("vnc.username.1") (validates SASL user name on seat 1)
qemu_acl_init("vnc.x509dname.2") (validates x509 certificate on seat 2)
qemu_acl_init("vnc.username.2") (validates SASL user name on seat 2)
Note, not changing the first ACL names for compat reasons.
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
