Bug 1041128

Summary: [RFE][nova]: Reset established vnc connections
Product: Red Hat OpenStack Reporter: RHOS Integration <rhos-integ>
Component: RFEsAssignee: RHOS Maint <rhos-maint>
Status: CLOSED UPSTREAM QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: markmc, yeylon
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: https://blueprints.launchpad.net/nova/+spec/reset-vnc-console
Whiteboard: upstream_milestone_none upstream_status_unknown upstream_definition_review
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-19 17:35:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description RHOS Integration 2013-12-12 13:44:56 UTC 
Cloned from launchpad blueprint https://blueprints.launchpad.net/nova/+spec/reset-vnc-console.

Description:

Currently a vnc console access token provides unlimited time access to the VM once a connection is established. While the token validity period can be controlled, an established connection cannot be torn without altering either vm state or proxy service. 

This has security implications. Suppose a token leaks to an adversary, by means of active snooping or human carelessness, and the adversary makes a connection, she can then passively watch the VM console and gather sufficient information to get an ssh connection. While it is difficult to prevent user errors, Nova can help an alerted user by providing a safety abort mechanism. The aim of this blueprint is to provide such a mechanism to a user to reset all established vnc connections to a given VM.

Specification URL (additional information):

None