noVNC requires password authentication
At present, whoever gets the noVNC Console URL can access to a specified VM. Obviously, the current novVNC lacks necessary protection from unwelocom guests.
To solve this security issue, i propose a Password Authentication for noVNC Console.
Blueprint information
- Status:
- Not started
- Approver:
- Balazs Gibizer
- Priority:
- Undefined
- Drafter:
- pandatt
- Direction:
- Approved
- Assignee:
- pandatt
- Definition:
- Approved
- Series goal:
- Accepted for wallaby
- Implementation:
-
Deferred
- Milestone target:
-
wallaby-3
- Started by
- Completed by
Related branches
Related bugs
Sprints
Whiteboard
This would be an API change, so you would need to propose a spec for this. Please see the documentation for more details: https:/
Gerrit topic: https:/
Addressed by: https:/
Proposal for a safer noVNC console with password authentication
[efried 20200214] Spec approved
[efried 20200220] Agreed in the Nova meeting to Direction:Approve all Definition:Approved blueprints http://
Gerrit topic: https:/
Addressed by: https:/
WIP: nova supports password encrypted VNC
Addressed by: https:/
Re-proposes 'Proposal for a safer remote console with password authentication'
[gibi 20200414] we hit feature freeze in Ussuri, so it is deferred to Victoria
[gibi 20200518] spec approved for Victoria
[gibi 20200928] as we hit feature freeze I'm deferring this from Victoria
Addressed by: https:/
Re-proposes 'Proposal for a safer remote console with password authentication
[gibi 20201203] spec was merged for wallaby, so the bp is retargeted to wallaby
[20210308 gibi]: during code review it turned out that we need more systematic discussion about the solution. As we are late in the W cycle I defer this from Wallaby.
