Use secure websockets for console access
As documented in NoVNC under known issues:
when using Firefox, if you use foreman via https, firefox might block the connection (see limiations below), to fix it, goto about:config and enable network.websocket.allowInsecureFromHTTPS
Foreman defaults to https:// only, so every firefox user runs into this. It would also increase security if all console access was encrypted. Websockify does support it, so it's mostly a matter of passing the correct parameters. Ideally the used certificates would be overrideable through settings.yaml.
#1 Updated by Ewoud Kohl van Wijngaarden about 9 years ago
- Status changed from New to Ready For Testing
https://github.com/theforeman/foreman/pull/1024 already tested with VMware and VNC. Needs testing with SPICE.
#2 Updated by Dominic Cleal about 9 years ago
- Has duplicate Feature #4224: Support for TLS Spice connections for console access on libvirt Compute ressources added
#3 Updated by Dominic Cleal over 8 years ago
- Bugzilla link set to https://bugzilla.redhat.com/show_bug.cgi?id=1107647
#4 Updated by Daniel Lobato Garcia over 8 years ago
- Has duplicate Feature #1662: Add settings options to secure VNC sessions between Foreman server and client added
#5 Updated by The Foreman Bot over 8 years ago
- Target version set to 1.8.0
- Pull request https://github.com/theforeman/foreman/pull/1024 added
#6 Updated by Daniel Lobato Garcia over 8 years ago
- Category changed from Compute resources to Security
- Assignee set to Daniel Lobato Garcia
#7 Updated by Daniel Lobato Garcia over 8 years ago
- Status changed from Ready For Testing to Closed
#8 Updated by Dominic Cleal over 8 years ago
- Legacy Backlogs Release (now unused) set to 10
#9 Updated by Ewoud Kohl van Wijngaarden over 8 years ago
https://github.com/theforeman/puppet-foreman/pull/202 enables support by default in the installer.
#10 Updated by Dominic Cleal over 8 years ago
- Related to Bug #7018: SPICE libvirt websockets connections aren't encrypted added
fixes #3601: Use secure websockets if available
Websockets_ssl* settings must be configured with the appropriate
certificates for this to work.