RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 859317 - Can't login the guest when set/update the graphics passwd to empty
Summary: Can't login the guest when set/update the graphics passwd to empty
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt
Version: 6.4
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Libvirt Maintainers
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-09-21 05:52 UTC by zhenfeng wang
Modified: 2015-01-08 10:46 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-09-21 08:02:09 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description zhenfeng wang 2012-09-21 05:52:37 UTC 
Description of problem:
Can't login the guest with the virt-viewer command when set/update the graphics passwd to empty

Version-Release number of selected component (if applicable):
libvirt-0.10.2-0rc1.el6.x86_64
qemu-img-rhev-0.12.1.2-2.312.el6.x86_64
kernel-2.6.32-308.el6.x86_64


How reproducible:
100%

Steps to Reproduce:
 1. Define guest with a graphics device like:
    .........................................
      <graphics type='vnc' port='-1' autoport='yes' passwd=""/>
    .........................................

 2. Connecting with vncviewer or virt-viewer .
      # virsh start  $vmname

      # virsh dumpxml --security-info $vmname
      <graphics type='vnc' port='-1' autoport='yes' passwd=""/>

      # virt-viewer testks
       can't connect the guest with this command

 3. The problem can be reproduced when changed the graphics passwd from an non-empty to an empty
    #virsh dumpxml testks --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd='123'>
    </graphics>

    # cat change-passwd.xml
    <graphics type='vnc' port='-1' autoport='yes'  listen='127.0.0.1' passwd=''/>
    # virsh update-device $vmname change-passwd.xml

    # virsh dumpxml testks --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd=''>
    </graphics>

    login the guest with virt-viewer command
    # virt-viewer testks
    can't connect the guest with this command

4. However when we changed the passwd to an non-empty,we can successfully login the guest

    #virsh dumpxml testks --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd='123'>
    </graphics>

    # virt-viewer testks

Actual results:
we can't login the guest when set the graphics passwd empty

Expected results:
when we do the limit which the empty passwd can't login the guest for the guest's logining ,and we should do the limit for the graphics passwd 's setting at the same time,better do a little check if is NULL.


Additional info
Comment 2 Daniel Berrangé 2012-09-21 08:02:09 UTC 
That is the expected behaviour, setting a password of ""  blocks all access to the VNC server.
Comment 3 vivian zhang 2014-09-25 03:38:59 UTC 
Hi, Daniel

When I try to do regression for this bug on RHEL7， I found that guest could be connected success with virt-viewer when set/update the graphics passwd to empty.
But according to your comment 2 above, libvirt will blocks all access to the VNC server when set a password to empty.
So could you please help us check is it acceptable on RHEL7? Thanks so much.

Below is my test steps on RHEL7:

Version-Release number of selected component (if applicable):
libvirt-1.2.8-3.el7.x86_64
qemu-kvm-rhev-2.1.0-5.el7.x86_64
kernel-3.10.0-150.el7.x86_64


How reproducible:
100%

Steps to Reproduce:
 1. Define guest with a graphics device like:
    .........................................
      <graphics type='vnc' port='-1' autoport='yes' passwd=""/>
    .........................................

 2. Connecting with vncviewer or virt-viewer .
      # virsh start dom2

      # virsh dumpxml dom2 --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd=''>
    </graphics>

      # virt-viewer dom2
   connect the guest success with empty password

 3. The problem can be reproduced when changed the graphics passwd from an non-empty to an empty
    # virsh dumpxml dom2 --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd='123'>
    </graphics>

    # cat change-passwd.xml
    <graphics type='vnc' port='-1' autoport='yes'  listen='127.0.0.1' passwd=''/>
    # virsh update-device dom2 change-passwd.xml

    # virsh dumpxml dom2 --security-info |grep graphics
    <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' passwd=''>
    </graphics>

    login the guest with virt-viewer command
    # virt-viewer testks
    also can connect the guest dom2 success with empty password

4. I produce the same steps on RHEL6.6 libvirt-0.10.2-46.el6.x86_64, the guest can not be connected when set graphics vnc password to empty, the same result with bug 859317.

Actual results:
we can login the guest when set the graphics passwd empty

Expected results:
I am not sure what is the right behaviour for RHEL7?

thank
vivian zhang
Comment 4 vivian zhang 2015-01-08 03:41:03 UTC 
Hello, Daniel

Since we still got no response about the spice and vnc passwd blank set permitted or not, this confused us during libvirt and virt-manager function test.
could you please help us answer this needinfo once you have a time to look at this?

thanks in advance
Comment 5 vivian zhang 2015-01-08 10:46:41 UTC 
for the issue on rhel7.1 described by commet 3 and 4 has been tracked by a new bug https://bugzilla.redhat.com/show_bug.cgi?id=1180092
Note You need to log in before you can comment on or make changes to this bug.