Re: [Qemu-devel] [PATCH 0/6] vnc: add support for multiple vnc server instances.

[Daniel P. Berrange]

On Wed, Oct 15, 2014 at 02:19:39PM +0200, Gerd Hoffmann wrote:
>   Hi,
> 
> This patch series adds support for multiple vnc server instances to
> qemu.  This comes handy in multiseat configurations as you can have
> one vnc server for each set then.
> 
> Some cleanups along the way (use QemuOpts).  Also added support for
> limiting the number of parallel vnc connections.
> 
> To be done: monitor support.  I think the best way to handle this is to
> introduce a new command to query vnc server state, which returns a list
> of vnc servers but otherwise works like "query-vnc".  Alternative
> approach would be to add a optional 'id=' parameter to query-vnc, but
> then you'll need a new list-vnc command.
> 
> Opinions on this?
> 
> set_password and expire_password commands should be easy, they can be
> extended with an optional 'id=' parameter.

In any serious deployment password auth won't be something that's used
due to its horrific insecurity. For TLS/SASL authentication protocols
we currently have a single acces control list defined

   qemu_acl_init("vnc.x509dname")   (validates x509 certificate)
   qemu_acl_init("vnc.username")    (validates SASL user name)

I think we are going to need to make one ACL list per seat. eg

   qemu_acl_init("vnc.x509dname")   (validates x509 certificate on seat 0)
   qemu_acl_init("vnc.username")    (validates SASL user name on seat 0)

   qemu_acl_init("vnc.x509dname.1")   (validates x509 certificate on seat 1)
   qemu_acl_init("vnc.username.1")    (validates SASL user name on seat 1)

   qemu_acl_init("vnc.x509dname.2")   (validates x509 certificate on seat 2)
   qemu_acl_init("vnc.username.2")    (validates SASL user name on seat 2)

Note, not changing the first ACL names for compat reasons.

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|