mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

doc: switch to modern syntax for VNC TLS setup

Browse Source 
The use of 'tls', 'x509' and 'x509verify' properties is the deprecated
backcompat syntax, replaced by use of TLS creds objects.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20180725092751.21767-2-berrange@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2018-07-25 10:27:50 +01:00 committed by Gerd Hoffmann
parent 77f60fb436
commit 756b9da719
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
qemu-doc.texi
View File

@ -1103,7 +1103,9 @@ support provides a secure session, but no authentication. This allows any
client to connect, and provides an encrypted session. client to connect, and provides an encrypted session.
@example @example
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio qemu-system-i386 [...OPTIONS...] \
-object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=no \
-vnc :1,tls-creds=tls0 -monitor stdio
@end example @end example
In the above example @code{/etc/pki/qemu} should contain at least three files, In the above example @code{/etc/pki/qemu} should contain at least three files,
@ -1118,10 +1120,14 @@ only be readable by the user owning it.
Certificates can also provide a means to authenticate the client connecting. Certificates can also provide a means to authenticate the client connecting.
The server will request that the client provide a certificate, which it will The server will request that the client provide a certificate, which it will
then validate against the CA certificate. This is a good choice if deploying then validate against the CA certificate. This is a good choice if deploying
in an environment with a private internal certificate authority. in an environment with a private internal certificate authority. It uses the
same syntax as previously, but with @code{verify-peer} set to @code{yes}
instead.
@example @example
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509verify=/etc/pki/qemu -monitor stdio qemu-system-i386 [...OPTIONS...] \
-object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \
-vnc :1,tls-creds=tls0 -monitor stdio
@end example @end example
@ -1132,7 +1138,9 @@ Finally, the previous method can be combined with VNC password authentication
to provide two layers of authentication for clients. to provide two layers of authentication for clients.
@example @example
qemu-system-i386 [...OPTIONS...] -vnc :1,password,tls,x509verify=/etc/pki/qemu -monitor stdio qemu-system-i386 [...OPTIONS...] \
-object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \
-vnc :1,tls-creds=tls0,password -monitor stdio
(qemu) change vnc password (qemu) change vnc password
Password: ******** Password: ********
(qemu) (qemu)
@ -1169,7 +1177,9 @@ credentials. This can be enabled, by combining the 'sasl' option
with the aforementioned TLS + x509 options: with the aforementioned TLS + x509 options:
@example @example
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509,sasl -monitor stdio qemu-system-i386 [...OPTIONS...] \
-object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \
-vnc :1,tls-creds=tls0,sasl -monitor stdio
@end example @end example
@node vnc_setup_sasl @node vnc_setup_sasl