[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/3] qapi-schema: Make @password in set_password
From: |
Daniel P. Berrange |
Subject: |
Re: [Qemu-devel] [PATCH 1/3] qapi-schema: Make @password in set_password optional |
Date: |
Tue, 17 Feb 2015 16:53:11 +0000 |
User-agent: |
Mutt/1.5.23 (2014-03-12) |
On Tue, Feb 17, 2015 at 05:40:45PM +0100, Michal Privoznik wrote:
> So, imagine you've started a guest with ticketing enabled. You've set
> some password to access your SPICE/VNC session. However, later you
> want to give the access to somebody else's and therefore disable the
> ticketing. Come on, be imaginative! Currently, there's no way how to
> achieve this. And while there are two possible ways to fulfill the
> goal: 1) invent new monitor command to disable ticketing, or 2) let
> @password argument to 'set_password' monitor command be optional, I'm
> choosing the latter. It's easier to implement, after all.
>
> The idea behind, how this will work, is: if user issues the command
> without the password field, it means they want to disable the
> ticketing. Any subsequent call to the call with password field filled
> in, will enable the ticketing again.
When password auth is enabled with VNC, the use of a NULL / empty string
password is explicitly intended to block access to the VNC server, by
causing the password auth to always return failure. Overloading the
'set_password' command such that a missing password changes the auth
scheme in use is a really surprising and bad side effect.
If we want to have the ability to change the authentication protocol
used for VNC/SPICE, then lets add a proper command for this. ie
create a 'set_graphics_auth' command to change auth protocol. This
is really better for VNC anyway, as there are far more possible auth
schemes than just password or no-password, and overloading the
'set_password' command can't handle that.
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|