From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36023) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XeO3Z-000192-6B for qemu-devel@nongnu.org; Wed, 15 Oct 2014 08:52:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XeO3T-0004K1-Ri for qemu-devel@nongnu.org; Wed, 15 Oct 2014 08:51:57 -0400 Received: from mx1.redhat.com ([209.132.183.28]:24069) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XeO3T-0004Ju-JE for qemu-devel@nongnu.org; Wed, 15 Oct 2014 08:51:51 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s9FCpoDL017163 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Wed, 15 Oct 2014 08:51:50 -0400 Date: Wed, 15 Oct 2014 13:51:47 +0100 From: "Daniel P. Berrange" Message-ID: <20141015125147.GC3741@redhat.com> References: <1413375585-20301-1-git-send-email-kraxel@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1413375585-20301-1-git-send-email-kraxel@redhat.com> Subject: Re: [Qemu-devel] [PATCH 0/6] vnc: add support for multiple vnc server instances. Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: qemu-devel@nongnu.org On Wed, Oct 15, 2014 at 02:19:39PM +0200, Gerd Hoffmann wrote: > Hi, > > This patch series adds support for multiple vnc server instances to > qemu. This comes handy in multiseat configurations as you can have > one vnc server for each set then. > > Some cleanups along the way (use QemuOpts). Also added support for > limiting the number of parallel vnc connections. > > To be done: monitor support. I think the best way to handle this is to > introduce a new command to query vnc server state, which returns a list > of vnc servers but otherwise works like "query-vnc". Alternative > approach would be to add a optional 'id=' parameter to query-vnc, but > then you'll need a new list-vnc command. > > Opinions on this? > > set_password and expire_password commands should be easy, they can be > extended with an optional 'id=' parameter. In any serious deployment password auth won't be something that's used due to its horrific insecurity. For TLS/SASL authentication protocols we currently have a single acces control list defined qemu_acl_init("vnc.x509dname") (validates x509 certificate) qemu_acl_init("vnc.username") (validates SASL user name) I think we are going to need to make one ACL list per seat. eg qemu_acl_init("vnc.x509dname") (validates x509 certificate on seat 0) qemu_acl_init("vnc.username") (validates SASL user name on seat 0) qemu_acl_init("vnc.x509dname.1") (validates x509 certificate on seat 1) qemu_acl_init("vnc.username.1") (validates SASL user name on seat 1) qemu_acl_init("vnc.x509dname.2") (validates x509 certificate on seat 2) qemu_acl_init("vnc.username.2") (validates SASL user name on seat 2) Note, not changing the first ACL names for compat reasons. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|