|
From: | Eric Blake |
Subject: | Re: [Qemu-devel] [PATCH] doc: switch to modern syntx for VNC TLS setup |
Date: | Thu, 28 Jun 2018 08:22:13 -0500 |
User-agent: | Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 |
On 06/28/2018 08:17 AM, Daniel P. Berrangé wrote:
Ping, anyone have comments on this, besides the typo in $SUBJECT, also repeated in commit msg On Thu, Jun 07, 2018 at 11:10:19AM +0100, Daniel P. Berrangé wrote:The use of 'tls', 'x509' and 'x509verify' properties is the legacy backcompat syntx, replaced by use of TLS creds objects. Signed-off-by: Daniel P. Berrangé <address@hidden> --- qemu-doc.texi | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/qemu-doc.texi b/qemu-doc.texi index f00706b999..d526870479 100644 --- a/qemu-doc.texi +++ b/qemu-doc.texi @@ -1097,7 +1097,9 @@ support provides a secure session, but no authentication. This allows any client to connect, and provides an encrypted session.@example-qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio +qemu-system-i386 [...OPTIONS...] \ + -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=no \
I'd use --object here (especially since -object cannot be used on qemu-nbd, but --object tls-creds-x509 can).
+ -vnc :1,tls-creds=tls0 -monitor stdio @end exampleIn the above example @code{/etc/pki/qemu} should contain at least three files,@@ -1112,10 +1114,14 @@ only be readable by the user owning it. Certificates can also provide a means to authenticate the client connecting. The server will request that the client provide a certificate, which it will then validate against the CA certificate. This is a good choice if deploying -in an environment with a private internal certificate authority. +in an environment with a private internal certificate authority. It uses the +same syntax as previously, but with @code{verify-peer} set to @code{yes} +instead.@example-qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509verify=/etc/pki/qemu -monitor stdio +qemu-system-i386 [...OPTIONS...] \ + -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \
multiple times in this patch. Otherwise looks good to me. -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3266 Virtualization: qemu.org | libvirt.org
[Prev in Thread] | Current Thread | [Next in Thread] |