Bug 859317 - Can't login the guest when set/update the graphics passwd to empty
Can't login the guest when set/update the graphics passwd to empty
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt (Show other bugs)
6.4
x86_64 Linux
medium Severity medium
: rc
: ---
Assigned To: Libvirt Maintainers
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-21 01:52 EDT by zhenfeng wang
Modified: 2015-01-08 05:46 EST (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-09-21 04:02:09 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description zhenfeng wang 2012-09-21 01:52:37 EDT
Description of problem:
Can't login the guest with the virt-viewer command when set/update the graphics passwd to empty

Version-Release number of selected component (if applicable):
libvirt-0.10.2-0rc1.el6.x86_64
qemu-img-rhev-0.12.1.2-2.312.el6.x86_64
kernel-2.6.32-308.el6.x86_64


How reproducible:
100%

Steps to Reproduce:
 1. Define guest with a graphics device like:
    .........................................
      <graphics type='vnc' port='-1' autoport='yes' passwd=""/>
    .........................................

 2. Connecting with vncviewer or virt-viewer .
      # virsh start  $vmname

      # virsh dumpxml --security-info $vmname
      <graphics type='vnc' port='-1' autoport='yes' passwd=""/>

      # virt-viewer testks
       can't connect the guest with this command

 3. The problem can be reproduced when changed the graphics passwd from an non-empty to an empty
    #virsh dumpxml testks --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd='123'>
    </graphics>

    # cat change-passwd.xml
    <graphics type='vnc' port='-1' autoport='yes'  listen='127.0.0.1' passwd=''/>
    # virsh update-device $vmname change-passwd.xml

    # virsh dumpxml testks --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd=''>
    </graphics>

    login the guest with virt-viewer command
    # virt-viewer testks
    can't connect the guest with this command

4. However when we changed the passwd to an non-empty,we can successfully login the guest

    #virsh dumpxml testks --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd='123'>
    </graphics>

    # virt-viewer testks

Actual results:
we can't login the guest when set the graphics passwd empty

Expected results:
when we do the limit which the empty passwd can't login the guest for the guest's logining ,and we should do the limit for the graphics passwd 's setting at the same time,better do a little check if is NULL.


Additional info
Comment 2 Daniel Berrange 2012-09-21 04:02:09 EDT
That is the expected behaviour, setting a password of ""  blocks all access to the VNC server.
Comment 3 vivian zhang 2014-09-24 23:38:59 EDT
Hi, Daniel

When I try to do regression for this bug on RHEL7, I found that guest could be connected success with virt-viewer when set/update the graphics passwd to empty.
But according to your comment 2 above, libvirt will blocks all access to the VNC server when set a password to empty.
So could you please help us check is it acceptable on RHEL7? Thanks so much.

Below is my test steps on RHEL7:

Version-Release number of selected component (if applicable):
libvirt-1.2.8-3.el7.x86_64
qemu-kvm-rhev-2.1.0-5.el7.x86_64
kernel-3.10.0-150.el7.x86_64


How reproducible:
100%

Steps to Reproduce:
 1. Define guest with a graphics device like:
    .........................................
      <graphics type='vnc' port='-1' autoport='yes' passwd=""/>
    .........................................

 2. Connecting with vncviewer or virt-viewer .
      # virsh start dom2

      # virsh dumpxml dom2 --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd=''>
    </graphics>

      # virt-viewer dom2
   connect the guest success with empty password

 3. The problem can be reproduced when changed the graphics passwd from an non-empty to an empty
    # virsh dumpxml dom2 --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd='123'>
    </graphics>

    # cat change-passwd.xml
    <graphics type='vnc' port='-1' autoport='yes'  listen='127.0.0.1' passwd=''/>
    # virsh update-device dom2 change-passwd.xml

    # virsh dumpxml dom2 --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd=''>
    </graphics>

    login the guest with virt-viewer command
    # virt-viewer testks
    also can connect the guest dom2 success with empty password

4. I produce the same steps on RHEL6.6 libvirt-0.10.2-46.el6.x86_64, the guest can not be connected when set graphics vnc password to empty, the same result with bug 859317.

Actual results:
we can login the guest when set the graphics passwd empty

Expected results:
I am not sure what is the right behaviour for RHEL7?

thank
vivian zhang
Comment 4 vivian zhang 2015-01-07 22:41:03 EST
Hello, Daniel

Since we still got no response about the spice and vnc passwd blank set permitted or not, this confused us during libvirt and virt-manager function test.
could you please help us answer this needinfo once you have a time to look at this?

thanks in advance
Comment 5 vivian zhang 2015-01-08 05:46:41 EST
for the issue on rhel7.1 described by commet 3 and 4 has been tracked by a new bug https://bugzilla.redhat.com/show_bug.cgi?id=1180092

Note You need to log in before you can comment on or make changes to this bug.