)]}'
{"doc/admin-guide/source/compute-remote-console-access.rst":[{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":118,"context_line":"VNC proxy security"},{"line_number":119,"context_line":"------------------"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"The public facing interface of the VNC proxy should always be deployed"},{"line_number":122,"context_line":"with HTTPS to prevent attacks from malicious parties on the network"},{"line_number":123,"context_line":"between the tenant user and proxy server. When HTTPS is used, the"},{"line_number":124,"context_line":"TLS encryption only applies to data between the tenant user and proxy"},{"line_number":125,"context_line":"server. The data between the proxy server and compute node instance"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_ac887672","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":29},"updated":"2016-11-10 11:11:15.000000000","message":"\"Deploy the public facing interface of the VNC proxy to prevent attacks...\" - avoiding passive voice","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"The public facing interface of the VNC proxy should always be deployed"},{"line_number":122,"context_line":"with HTTPS to prevent attacks from malicious parties on the network"},{"line_number":123,"context_line":"between the tenant user and proxy server. When HTTPS is used, the"},{"line_number":124,"context_line":"TLS encryption only applies to data between the tenant user and proxy"},{"line_number":125,"context_line":"server. The data between the proxy server and compute node instance"},{"line_number":126,"context_line":"will still be in cleartext. To provide protection for the latter it"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0c9882bf","line":123,"range":{"start_line":123,"start_character":47,"end_line":123,"end_character":60},"updated":"2016-11-10 11:11:15.000000000","message":"When using HTTPS, the TLS ...","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":122,"context_line":"with HTTPS to prevent attacks from malicious parties on the network"},{"line_number":123,"context_line":"between the tenant user and proxy server. When HTTPS is used, the"},{"line_number":124,"context_line":"TLS encryption only applies to data between the tenant user and proxy"},{"line_number":125,"context_line":"server. The data between the proxy server and compute node instance"},{"line_number":126,"context_line":"will still be in cleartext. To provide protection for the latter it"},{"line_number":127,"context_line":"is neccessary to enable the \"VeNCrypt\" authentication scheme for VNC"},{"line_number":128,"context_line":"in both the compute nodes and noVNC proxy server hosts."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_6c8bbe68","line":125,"range":{"start_line":125,"start_character":46,"end_line":125,"end_character":53},"updated":"2016-11-10 11:11:15.000000000","message":"Compute","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":124,"context_line":"TLS encryption only applies to data between the tenant user and proxy"},{"line_number":125,"context_line":"server. The data between the proxy server and compute node instance"},{"line_number":126,"context_line":"will still be in cleartext. To provide protection for the latter it"},{"line_number":127,"context_line":"is neccessary to enable the \"VeNCrypt\" authentication scheme for VNC"},{"line_number":128,"context_line":"in both the compute nodes and noVNC proxy server hosts."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"QEMU/KVM compute node configuration"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_acef961c","line":127,"range":{"start_line":127,"start_character":28,"end_line":127,"end_character":40},"updated":"2016-11-10 11:11:15.000000000","message":"remove scare quotes","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":127,"context_line":"is neccessary to enable the \"VeNCrypt\" authentication scheme for VNC"},{"line_number":128,"context_line":"in both the compute nodes and noVNC proxy server hosts."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"QEMU/KVM compute node configuration"},{"line_number":131,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"Each compute node running QEMU/KVM with libvirt needs to have  a"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_4ce51a36","line":130,"range":{"start_line":130,"start_character":9,"end_line":130,"end_character":16},"updated":"2016-11-10 11:11:15.000000000","message":"Compute *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":130,"context_line":"QEMU/KVM compute node configuration"},{"line_number":131,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"Each compute node running QEMU/KVM with libvirt needs to have  a"},{"line_number":134,"context_line":"set of certificates issued to it."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- /etc/pki/libvirt-vnc/server-cert.pem"},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_4cbc3a06","line":134,"range":{"start_line":133,"start_character":0,"end_line":134,"end_character":33},"updated":"2016-11-10 11:11:15.000000000","message":"Ensure each Compute node running QEMU/KVM with libvert has a set of certificates issued: *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":133,"context_line":"Each compute node running QEMU/KVM with libvirt needs to have  a"},{"line_number":134,"context_line":"set of certificates issued to it."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- /etc/pki/libvirt-vnc/server-cert.pem"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"  A x509 certificate to be presented by the VNC server. The"},{"line_number":139,"context_line":"  CommonName should match the primary hostname of the compute"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_e5f613f8","line":136,"range":{"start_line":136,"start_character":2,"end_line":136,"end_character":38},"updated":"2016-11-10 04:12:03.000000000","message":":file:`etc/pki/libvirt-vnc/server-cert.pem`","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":136,"context_line":"- /etc/pki/libvirt-vnc/server-cert.pem"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"  A x509 certificate to be presented by the VNC server. The"},{"line_number":139,"context_line":"  CommonName should match the primary hostname of the compute"},{"line_number":140,"context_line":"  node. Use of subjectAltName is also permitted if there is"},{"line_number":141,"context_line":"  a need to use multiple hostnames or IP addresses to access"},{"line_number":142,"context_line":"  the same compute node"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_8c3812a2","line":139,"range":{"start_line":139,"start_character":54,"end_line":139,"end_character":61},"updated":"2016-11-10 11:11:15.000000000","message":"Compute * apply throughout please where applicable","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"  A x509 certificate to be presented by the VNC server. The"},{"line_number":139,"context_line":"  CommonName should match the primary hostname of the compute"},{"line_number":140,"context_line":"  node. Use of subjectAltName is also permitted if there is"},{"line_number":141,"context_line":"  a need to use multiple hostnames or IP addresses to access"},{"line_number":142,"context_line":"  the same compute node"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_05c78796","line":140,"range":{"start_line":140,"start_character":24,"end_line":140,"end_character":25},"updated":"2016-11-10 04:12:03.000000000","message":"``subjectAltName``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":139,"context_line":"  CommonName should match the primary hostname of the compute"},{"line_number":140,"context_line":"  node. Use of subjectAltName is also permitted if there is"},{"line_number":141,"context_line":"  a need to use multiple hostnames or IP addresses to access"},{"line_number":142,"context_line":"  the same compute node"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"- /etc/pki/libvirt-vnc/server-key.pem"},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_c5b2ef05","line":142,"range":{"start_line":142,"start_character":19,"end_line":142,"end_character":23},"updated":"2016-11-10 04:12:03.000000000","message":"Add a period","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":141,"context_line":"  a need to use multiple hostnames or IP addresses to access"},{"line_number":142,"context_line":"  the same compute node"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"- /etc/pki/libvirt-vnc/server-key.pem"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  The private key used to generate the server-cert.pem file"},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_8539d7a6","line":144,"range":{"start_line":144,"start_character":2,"end_line":144,"end_character":37},"updated":"2016-11-10 04:12:03.000000000","message":":file:`etc/pki/libvirt-vnc/server-key.pem`","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"- /etc/pki/libvirt-vnc/server-key.pem"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  The private key used to generate the server-cert.pem file"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- /etc/pki/libvirt-vnc/ca-cert.pem"},{"line_number":149,"context_line":"  The certificate authority cert used to sign server-cert.pem"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_85a397b1","line":146,"range":{"start_line":146,"start_character":55,"end_line":146,"end_character":59},"updated":"2016-11-10 04:12:03.000000000","message":"Add a period","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"- /etc/pki/libvirt-vnc/server-key.pem"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  The private key used to generate the server-cert.pem file"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- /etc/pki/libvirt-vnc/ca-cert.pem"},{"line_number":149,"context_line":"  The certificate authority cert used to sign server-cert.pem"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_ec434e11","line":146,"range":{"start_line":146,"start_character":39,"end_line":146,"end_character":54},"updated":"2016-11-10 11:11:15.000000000","message":"``server-cert.pem``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  The private key used to generate the server-cert.pem file"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- /etc/pki/libvirt-vnc/ca-cert.pem"},{"line_number":149,"context_line":"  The certificate authority cert used to sign server-cert.pem"},{"line_number":150,"context_line":"  and sign the VNC proxy server certs"},{"line_number":151,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_e544531c","line":148,"range":{"start_line":148,"start_character":2,"end_line":148,"end_character":34},"updated":"2016-11-10 04:12:03.000000000","message":":file:`etc/pki/libvirt-vnc/ca-cert.pem`","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":146,"context_line":"  The private key used to generate the server-cert.pem file"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- /etc/pki/libvirt-vnc/ca-cert.pem"},{"line_number":149,"context_line":"  The certificate authority cert used to sign server-cert.pem"},{"line_number":150,"context_line":"  and sign the VNC proxy server certs"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The certificates must have v3 basic constraints present to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0c4de23d","line":149,"range":{"start_line":149,"start_character":46,"end_line":149,"end_character":61},"updated":"2016-11-10 11:11:15.000000000","message":"``server-cert.pem``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- /etc/pki/libvirt-vnc/ca-cert.pem"},{"line_number":149,"context_line":"  The certificate authority cert used to sign server-cert.pem"},{"line_number":150,"context_line":"  and sign the VNC proxy server certs"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The certificates must have v3 basic constraints present to"},{"line_number":153,"context_line":"indicate the permitted key usage / purpose data."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_e5ae1397","line":150,"range":{"start_line":150,"start_character":32,"end_line":150,"end_character":37},"updated":"2016-11-10 04:12:03.000000000","message":"s/certs/certificates.","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":150,"context_line":"  and sign the VNC proxy server certs"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The certificates must have v3 basic constraints present to"},{"line_number":153,"context_line":"indicate the permitted key usage / purpose data."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"It is strongly recommended that a dedicated certificate"},{"line_number":156,"context_line":"authority be used solely for the VNC service. This CA"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_6c501ed5","line":153,"range":{"start_line":153,"start_character":27,"end_line":153,"end_character":42},"updated":"2016-11-10 11:11:15.000000000","message":"use and purpose data *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":152,"context_line":"The certificates must have v3 basic constraints present to"},{"line_number":153,"context_line":"indicate the permitted key usage / purpose data."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"It is strongly recommended that a dedicated certificate"},{"line_number":156,"context_line":"authority be used solely for the VNC service. This CA"},{"line_number":157,"context_line":"may be a child of the master CA used for the OpenStack"},{"line_number":158,"context_line":"deployment. This is because libvirt does not currently"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0c740266","line":155,"updated":"2016-11-10 11:11:15.000000000","message":"We recommend a dedicated certificate *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":153,"context_line":"indicate the permitted key usage / purpose data."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"It is strongly recommended that a dedicated certificate"},{"line_number":156,"context_line":"authority be used solely for the VNC service. This CA"},{"line_number":157,"context_line":"may be a child of the master CA used for the OpenStack"},{"line_number":158,"context_line":"deployment. This is because libvirt does not currently"},{"line_number":159,"context_line":"have a mechanism to restrict what certs can be presented"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_2c71c676","line":156,"range":{"start_line":156,"start_character":51,"end_line":156,"end_character":53},"updated":"2016-11-10 11:11:15.000000000","message":"CA? New acronym. Define here or earlier please :)","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":157,"context_line":"may be a child of the master CA used for the OpenStack"},{"line_number":158,"context_line":"deployment. This is because libvirt does not currently"},{"line_number":159,"context_line":"have a mechanism to restrict what certs can be presented"},{"line_number":160,"context_line":"by the proxy server when connecting to the VNC servers"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"For further details on certificate creation, consult the QEMU"},{"line_number":163,"context_line":"documentation on VNC server certificate setup."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_4c6a7a82","line":160,"range":{"start_line":160,"start_character":45,"end_line":160,"end_character":54},"updated":"2016-11-10 11:11:15.000000000","message":"servers. * (add a period)","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":159,"context_line":"have a mechanism to restrict what certs can be presented"},{"line_number":160,"context_line":"by the proxy server when connecting to the VNC servers"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"For further details on certificate creation, consult the QEMU"},{"line_number":163,"context_line":"documentation on VNC server certificate setup."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Libvirt must be configured to enable the VeNCrypt authentication"},{"line_number":166,"context_line":"scheme for the VNC server. In the /etc/libvirt/qemu.conf the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_ec118e05","line":163,"range":{"start_line":162,"start_character":57,"end_line":163,"end_character":46},"updated":"2016-11-10 11:11:15.000000000","message":"Could you add a link to this please? :)","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":162,"context_line":"For further details on certificate creation, consult the QEMU"},{"line_number":163,"context_line":"documentation on VNC server certificate setup."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Libvirt must be configured to enable the VeNCrypt authentication"},{"line_number":166,"context_line":"scheme for the VNC server. In the /etc/libvirt/qemu.conf the"},{"line_number":167,"context_line":"following settings must be uncommented:"},{"line_number":168,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0cfb22c2","line":165,"range":{"start_line":165,"start_character":0,"end_line":165,"end_character":26},"updated":"2016-11-10 11:11:15.000000000","message":"Configure libvirt to enable ... *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":163,"context_line":"documentation on VNC server certificate setup."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Libvirt must be configured to enable the VeNCrypt authentication"},{"line_number":166,"context_line":"scheme for the VNC server. In the /etc/libvirt/qemu.conf the"},{"line_number":167,"context_line":"following settings must be uncommented:"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"- vnc_tls\u003d1"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_65e3e333","line":166,"range":{"start_line":166,"start_character":34,"end_line":166,"end_character":56},"updated":"2016-11-10 04:12:03.000000000","message":":file:`/etc/libvirt/qemu.conf` file","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":166,"context_line":"scheme for the VNC server. In the /etc/libvirt/qemu.conf the"},{"line_number":167,"context_line":"following settings must be uncommented:"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"- vnc_tls\u003d1"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"  This instructs libvirt to enable the VeNCrypt auth scheme"},{"line_number":172,"context_line":"  when launching QEMU, passing it the certificates shown"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_054ea73a","line":169,"range":{"start_line":169,"start_character":2,"end_line":169,"end_character":11},"updated":"2016-11-10 04:12:03.000000000","message":"``vnc_tls\u003d1``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":172,"context_line":"  when launching QEMU, passing it the certificates shown"},{"line_number":173,"context_line":"  above."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"- vnc_tls_x509_verify\u003d1"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"  This instructs QEMU to require that all VNC clients"},{"line_number":178,"context_line":"  present a valid x509 certificate. Assuming a dedicated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_254bab2b","line":175,"range":{"start_line":175,"start_character":2,"end_line":175,"end_character":23},"updated":"2016-11-10 04:12:03.000000000","message":"``vnc_tls_x509_verify\u003d1``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":180,"context_line":"  approved VNC proxy servers can connect to the compute"},{"line_number":181,"context_line":"  nodes."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"After changing the qemu.conf file the libvirtd service must"},{"line_number":184,"context_line":"be restarted::"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"  systemctl restart libvirtd.service"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0575c762","line":183,"range":{"start_line":183,"start_character":19,"end_line":183,"end_character":28},"updated":"2016-11-10 04:12:03.000000000","message":":file:`qemu.conf`","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":181,"context_line":"  nodes."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"After changing the qemu.conf file the libvirtd service must"},{"line_number":184,"context_line":"be restarted::"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"  systemctl restart libvirtd.service"},{"line_number":187,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_6c157ee3","line":184,"range":{"start_line":184,"start_character":12,"end_line":184,"end_character":14},"updated":"2016-11-10 11:11:15.000000000","message":"use a code block, not the double :: please :)","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":183,"context_line":"After changing the qemu.conf file the libvirtd service must"},{"line_number":184,"context_line":"be restarted::"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"  systemctl restart libvirtd.service"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Changes will not apply to any existing running guests on"},{"line_number":189,"context_line":"the compute node, so this configuration should be done before"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_45541fc9","line":186,"range":{"start_line":186,"start_character":2,"end_line":186,"end_character":36},"updated":"2016-11-10 04:12:03.000000000","message":"$ systemctl restart libvirtd.service","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":189,"context_line":"the compute node, so this configuration should be done before"},{"line_number":190,"context_line":"launching any instances."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"noVNC proxy server config"},{"line_number":193,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"The noVNC proxy server will initially only support the \u0027none\u0027"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_65684388","line":192,"range":{"start_line":192,"start_character":19,"end_line":192,"end_character":25},"updated":"2016-11-10 04:12:03.000000000","message":"configuration","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":192,"context_line":"noVNC proxy server config"},{"line_number":193,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"The noVNC proxy server will initially only support the \u0027none\u0027"},{"line_number":196,"context_line":"authentication scheme, which does no checking. It is thus"},{"line_number":197,"context_line":"neccessary to enable the \u0027vencrypt\u0027 auth scheme by editing"},{"line_number":198,"context_line":"the nova.conf file to set::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_ecdfce37","line":195,"range":{"start_line":195,"start_character":23,"end_line":195,"end_character":50},"updated":"2016-11-10 11:11:15.000000000","message":"initially only supports *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":193,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"The noVNC proxy server will initially only support the \u0027none\u0027"},{"line_number":196,"context_line":"authentication scheme, which does no checking. It is thus"},{"line_number":197,"context_line":"neccessary to enable the \u0027vencrypt\u0027 auth scheme by editing"},{"line_number":198,"context_line":"the nova.conf file to set::"},{"line_number":199,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_8cbbb2e4","line":196,"range":{"start_line":196,"start_character":47,"end_line":196,"end_character":57},"updated":"2016-11-10 11:11:15.000000000","message":"Therefore, it is necessary *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":194,"context_line":""},{"line_number":195,"context_line":"The noVNC proxy server will initially only support the \u0027none\u0027"},{"line_number":196,"context_line":"authentication scheme, which does no checking. It is thus"},{"line_number":197,"context_line":"neccessary to enable the \u0027vencrypt\u0027 auth scheme by editing"},{"line_number":198,"context_line":"the nova.conf file to set::"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"  [vnc]"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_ccb12a03","line":197,"range":{"start_line":197,"start_character":25,"end_line":197,"end_character":35},"updated":"2016-11-10 11:11:15.000000000","message":"``vencrypt``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":195,"context_line":"The noVNC proxy server will initially only support the \u0027none\u0027"},{"line_number":196,"context_line":"authentication scheme, which does no checking. It is thus"},{"line_number":197,"context_line":"neccessary to enable the \u0027vencrypt\u0027 auth scheme by editing"},{"line_number":198,"context_line":"the nova.conf file to set::"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"  [vnc]"},{"line_number":201,"context_line":"  auth_schemes\u003dvencrypt,none"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_6cc3be57","line":198,"range":{"start_line":198,"start_character":4,"end_line":198,"end_character":13},"updated":"2016-11-10 11:11:15.000000000","message":"``nova.conf``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":195,"context_line":"The noVNC proxy server will initially only support the \u0027none\u0027"},{"line_number":196,"context_line":"authentication scheme, which does no checking. It is thus"},{"line_number":197,"context_line":"neccessary to enable the \u0027vencrypt\u0027 auth scheme by editing"},{"line_number":198,"context_line":"the nova.conf file to set::"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"  [vnc]"},{"line_number":201,"context_line":"  auth_schemes\u003dvencrypt,none"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_ecad0e9c","line":198,"range":{"start_line":198,"start_character":25,"end_line":198,"end_character":27},"updated":"2016-11-10 11:11:15.000000000","message":"ditto as above please :)","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":200,"context_line":"  [vnc]"},{"line_number":201,"context_line":"  auth_schemes\u003dvencrypt,none"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"The auth schemes should be listed in order of preference."},{"line_number":204,"context_line":"If enabling VeNCrypt on an existing deployment which already"},{"line_number":205,"context_line":"has instances running, the noVNC proxy server must initially"},{"line_number":206,"context_line":"be allowed to use ``vencrypt`` or ``none``. Once it is"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0c97a248","line":203,"range":{"start_line":203,"start_character":0,"end_line":203,"end_character":34},"updated":"2016-11-10 11:11:15.000000000","message":"List the auth schemes in order of preference. *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":214,"context_line":"As well as enabling the auth scheme it neccessary to"},{"line_number":215,"context_line":"provide certificates to the noVNC proxy."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"- /etc/pki//nova-novncproxy/client-cert.pem"},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"  A x509 certificate to be presented to the VNC server. The"},{"line_number":220,"context_line":"  CommonName should match the primary hostname of the compute"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_05fce7b6","line":217,"range":{"start_line":217,"start_character":2,"end_line":217,"end_character":43},"updated":"2016-11-10 04:12:03.000000000","message":"see markup in comment line 144","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":222,"context_line":"  validation of the CommonName, future versions will allow"},{"line_number":223,"context_line":"  for setting up access controls based on the CommonName."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"- /etc/pki//nova-novncproxy/client-key.pem"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"  The private key used to generate the client-cert.pem file"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_25f9ebc7","line":225,"range":{"start_line":225,"start_character":2,"end_line":225,"end_character":42},"updated":"2016-11-10 04:12:03.000000000","message":"see markup in comment line 144","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"- /etc/pki//nova-novncproxy/client-key.pem"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"  The private key used to generate the client-cert.pem file"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"- /etc/pki/nova-novncproxy/ca-cert.pem"},{"line_number":230,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0c7ec218","line":227,"range":{"start_line":227,"start_character":39,"end_line":227,"end_character":54},"updated":"2016-11-10 11:11:15.000000000","message":"``client-cert.pem``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":226,"context_line":""},{"line_number":227,"context_line":"  The private key used to generate the client-cert.pem file"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"- /etc/pki/nova-novncproxy/ca-cert.pem"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"  The certificate authority cert used to sign client-cert.pem"},{"line_number":232,"context_line":"  and sign the compute node VNC server certs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_45025fb5","line":229,"range":{"start_line":229,"start_character":2,"end_line":229,"end_character":38},"updated":"2016-11-10 04:12:03.000000000","message":"see markup in comment line 144","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":228,"context_line":""},{"line_number":229,"context_line":"- /etc/pki/nova-novncproxy/ca-cert.pem"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"  The certificate authority cert used to sign client-cert.pem"},{"line_number":232,"context_line":"  and sign the compute node VNC server certs."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"The certificates must have v3 basic constraints present to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_8c901245","line":231,"updated":"2016-11-10 11:11:15.000000000","message":"``client-cert.pem``","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":232,"context_line":"  and sign the compute node VNC server certs."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"The certificates must have v3 basic constraints present to"},{"line_number":235,"context_line":"indicate the permitted key usage / purpose data."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Once the certificates have been created, Nova must be told"},{"line_number":238,"context_line":"where to find them. This requires editting nova.conf to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_0ca5e2a0","line":235,"range":{"start_line":235,"start_character":32,"end_line":235,"end_character":35},"updated":"2016-11-10 11:11:15.000000000","message":"usage and purpose*","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":234,"context_line":"The certificates must have v3 basic constraints present to"},{"line_number":235,"context_line":"indicate the permitted key usage / purpose data."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Once the certificates have been created, Nova must be told"},{"line_number":238,"context_line":"where to find them. This requires editting nova.conf to"},{"line_number":239,"context_line":"set::"},{"line_number":240,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_ecb26ee4","line":237,"range":{"start_line":237,"start_character":41,"end_line":237,"end_character":45},"updated":"2016-11-10 11:11:15.000000000","message":"the Compute service (nova) *","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"da3189f440ab38afa18b177a63ae690e45a75a91","unresolved":false,"context_lines":[{"line_number":235,"context_line":"indicate the permitted key usage / purpose data."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Once the certificates have been created, Nova must be told"},{"line_number":238,"context_line":"where to find them. This requires editting nova.conf to"},{"line_number":239,"context_line":"set::"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"  [vnc]"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_c524af61","line":238,"range":{"start_line":238,"start_character":34,"end_line":238,"end_character":52},"updated":"2016-11-10 04:12:03.000000000","message":"editing the :file:`nova.conf`","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"e1f1cc18a8ace29e0cc9db94da422aaea37def26","unresolved":false,"context_lines":[{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Once the certificates have been created, Nova must be told"},{"line_number":238,"context_line":"where to find them. This requires editting nova.conf to"},{"line_number":239,"context_line":"set::"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"  [vnc]"},{"line_number":242,"context_line":"  vencrypt_client_key\u003d/etc/pki/nova-novncproxy/client-key.pem"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a629dbe_2cc9c659","line":239,"range":{"start_line":239,"start_character":3,"end_line":239,"end_character":5},"updated":"2016-11-10 11:11:15.000000000","message":"use a code block :)","commit_id":"dc2610f6bc94ab689804ca266cbe883ec5bb4046"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":123,"context_line":"tenant user and proxy server. When using HTTPS, the TLS encryption"},{"line_number":124,"context_line":"only applies to data between the tenant user and proxy server. The"},{"line_number":125,"context_line":"data between the proxy server and Compute node instance will still"},{"line_number":126,"context_line":"be in cleartext. To provide protection for the latter it is neccessary"},{"line_number":127,"context_line":"to enable the VeNCrypt authentication scheme for VNC in both the"},{"line_number":128,"context_line":"Compute nodes and noVNC proxy server hosts."},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_95672ee8","line":126,"range":{"start_line":126,"start_character":47,"end_line":126,"end_character":57},"updated":"2016-11-10 14:35:26.000000000","message":"latter, it (comma)","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":139,"context_line":"  ``CommonName`` should match the primary hostname of the Compute"},{"line_number":140,"context_line":"  node. Use of ``subjectAltName`` is also permitted if there is"},{"line_number":141,"context_line":"  a need to use multiple hostnames or IP addresses to access"},{"line_number":142,"context_line":"  the same Compute node."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"- :file:`/etc/pki/libvirt-vnc/server-key.pem`"},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9e94ab43","line":142,"range":{"start_line":142,"start_character":11,"end_line":142,"end_character":18},"updated":"2016-11-10 14:35:26.000000000","message":"compute","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"- :file: `/etc/pki/libvirt-vnc/ca-cert.pem`"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"  The certificate authority cert used to sign ``server-cert.pem``"},{"line_number":151,"context_line":"  and sign the VNC proxy server certificates."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"The certificates must have v3 basic constraints present to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_55f676f9","line":150,"range":{"start_line":150,"start_character":28,"end_line":150,"end_character":32},"updated":"2016-11-10 14:35:26.000000000","message":"certificate","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":153,"context_line":"The certificates must have v3 basic constraints present to"},{"line_number":154,"context_line":"indicate the permitted key use and purpose data."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"We recommended that a dedicated certificate authority be used"},{"line_number":157,"context_line":"solely for the VNC service. This authority may be a child of the"},{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_353f4288","line":156,"range":{"start_line":156,"start_character":3,"end_line":156,"end_character":14},"updated":"2016-11-10 14:35:26.000000000","message":"recommend","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":164,"context_line":"manual page documentation on VNC server certificate setup."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Configure libvirt to enable the VeNCrypt authentication"},{"line_number":167,"context_line":"scheme for the VNC server. In the :file:`/etc/libvirt/qemu.conf`"},{"line_number":168,"context_line":"the following settings must be uncommented:"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"- ``vnc_tls\u003d1``"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_b5c6f265","line":167,"range":{"start_line":167,"start_character":30,"end_line":167,"end_character":33},"updated":"2016-11-10 14:35:26.000000000","message":"remove the or add the word \"file\". For example, \"In the :file:`/etc/libvirt/qemu.conf` file,\"","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Configure libvirt to enable the VeNCrypt authentication"},{"line_number":167,"context_line":"scheme for the VNC server. In the :file:`/etc/libvirt/qemu.conf`"},{"line_number":168,"context_line":"the following settings must be uncommented:"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"- ``vnc_tls\u003d1``"},{"line_number":171,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_35dbc250","line":168,"range":{"start_line":168,"start_character":0,"end_line":168,"end_character":42},"updated":"2016-11-10 14:35:26.000000000","message":"uncomment the following settings:","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"- ``vnc_tls\u003d1``"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"  This instructs libvirt to enable the VeNCrypt auth scheme"},{"line_number":173,"context_line":"  when launching QEMU, passing it the certificates shown"},{"line_number":174,"context_line":"  above."},{"line_number":175,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9ec90b5c","line":172,"range":{"start_line":172,"start_character":48,"end_line":172,"end_character":52},"updated":"2016-11-10 14:35:26.000000000","message":"authentication","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":178,"context_line":"  This instructs QEMU to require that all VNC clients"},{"line_number":179,"context_line":"  present a valid x509 certificate. Assuming a dedicated"},{"line_number":180,"context_line":"  CA is used for the VNC service, this ensures that only"},{"line_number":181,"context_line":"  approved VNC proxy servers can connect to the Compute"},{"line_number":182,"context_line":"  nodes."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"After changing the file:`qemu.conf` file the libvirtd service must"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_1e0b3b8f","line":181,"range":{"start_line":181,"start_character":48,"end_line":181,"end_character":55},"updated":"2016-11-10 14:35:26.000000000","message":"compute","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f6ddf42fbf20afc7f09060c4284e9c606af929ba","unresolved":false,"context_lines":[{"line_number":178,"context_line":"  This instructs QEMU to require that all VNC clients"},{"line_number":179,"context_line":"  present a valid x509 certificate. Assuming a dedicated"},{"line_number":180,"context_line":"  CA is used for the VNC service, this ensures that only"},{"line_number":181,"context_line":"  approved VNC proxy servers can connect to the Compute"},{"line_number":182,"context_line":"  nodes."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"After changing the file:`qemu.conf` file the libvirtd service must"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_8471be78","line":181,"range":{"start_line":181,"start_character":48,"end_line":181,"end_character":55},"in_reply_to":"9a629dbe_1e0b3b8f","updated":"2016-11-10 14:44:16.000000000","message":"Usage elsewhere in this file uses Compute, not compute, and previous reviewers told me to use Compute here and other places you point to.","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":181,"context_line":"  approved VNC proxy servers can connect to the Compute"},{"line_number":182,"context_line":"  nodes."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"After changing the file:`qemu.conf` file the libvirtd service must"},{"line_number":185,"context_line":"be restarted."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":".. code:: shell"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_3e339f63","line":184,"range":{"start_line":184,"start_character":19,"end_line":184,"end_character":35},"updated":"2016-11-10 14:35:26.000000000","message":"Broken formatting, should be :file:`qemu.conf`","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":181,"context_line":"  approved VNC proxy servers can connect to the Compute"},{"line_number":182,"context_line":"  nodes."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"After changing the file:`qemu.conf` file the libvirtd service must"},{"line_number":185,"context_line":"be restarted."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":".. code:: shell"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_de1b83c8","line":185,"range":{"start_line":184,"start_character":0,"end_line":185,"end_character":13},"updated":"2016-11-10 14:35:26.000000000","message":"After editing the :file:`qemu.conf` file, restart the libvirtd service:","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":189,"context_line":"  $ systemctl restart libvirtd.service"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Changes will not apply to any existing running guests on"},{"line_number":192,"context_line":"the Compute node, so this configuration should be done before"},{"line_number":193,"context_line":"launching any instances."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"noVNC proxy server configuration"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9e6cab36","line":192,"range":{"start_line":192,"start_character":4,"end_line":192,"end_character":11},"updated":"2016-11-10 14:35:26.000000000","message":"compute","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":195,"context_line":"noVNC proxy server configuration"},{"line_number":196,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"The noVNC proxy server initially only supports the \u0027none\u0027"},{"line_number":199,"context_line":"authentication scheme, which does no checking. Therefore,"},{"line_number":200,"context_line":"it is neccessary to enable the ``vencrypt`` auth scheme by"},{"line_number":201,"context_line":"editing the nova.conf file to set."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_7e8b57c3","line":198,"range":{"start_line":198,"start_character":51,"end_line":198,"end_character":57},"updated":"2016-11-10 14:35:26.000000000","message":"``none``","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":197,"context_line":""},{"line_number":198,"context_line":"The noVNC proxy server initially only supports the \u0027none\u0027"},{"line_number":199,"context_line":"authentication scheme, which does no checking. Therefore,"},{"line_number":200,"context_line":"it is neccessary to enable the ``vencrypt`` auth scheme by"},{"line_number":201,"context_line":"editing the nova.conf file to set."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":".. code::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_c9466f4e","line":200,"range":{"start_line":200,"start_character":44,"end_line":200,"end_character":48},"updated":"2016-11-10 14:35:26.000000000","message":"authentication","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":198,"context_line":"The noVNC proxy server initially only supports the \u0027none\u0027"},{"line_number":199,"context_line":"authentication scheme, which does no checking. Therefore,"},{"line_number":200,"context_line":"it is neccessary to enable the ``vencrypt`` auth scheme by"},{"line_number":201,"context_line":"editing the nova.conf file to set."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":".. code::"},{"line_number":204,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_693c83c8","line":201,"range":{"start_line":201,"start_character":12,"end_line":201,"end_character":21},"updated":"2016-11-10 14:35:26.000000000","message":"formatting required","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":205,"context_line":"  [vnc]"},{"line_number":206,"context_line":"  auth_schemes\u003dvencrypt,none"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":"The auth schemes should be listed in order of preference."},{"line_number":209,"context_line":"If enabling VeNCrypt on an existing deployment which already"},{"line_number":210,"context_line":"has instances running, the noVNC proxy server must initially"},{"line_number":211,"context_line":"be allowed to use ``vencrypt`` or ``none``. Once it is"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_a9bcdb06","line":208,"range":{"start_line":208,"start_character":4,"end_line":208,"end_character":8},"updated":"2016-11-10 14:35:26.000000000","message":"authentication","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":214,"context_line":"list of auth schemes."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"At that point the noVNC proxy will refuse to connect to"},{"line_number":217,"context_line":"any Compute node that does not offer VeNCrypt."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"As well as enabling the auth scheme it neccessary to"},{"line_number":220,"context_line":"provide certificates to the noVNC proxy."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_c9502fd7","line":217,"range":{"start_line":217,"start_character":4,"end_line":217,"end_character":11},"updated":"2016-11-10 14:35:26.000000000","message":"compute","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"d54b86b2d63802612559d0d33a5eb1552c8b680d","unresolved":false,"context_lines":[{"line_number":241,"context_line":""},{"line_number":242,"context_line":"Once the certificates have been created, the noVNC console"},{"line_number":243,"context_line":"proxy service must be told where to find them. This requires"},{"line_number":244,"context_line":"editting :file:`nova.conf` to set."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":".. code::"},{"line_number":247,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_a99dbb67","line":244,"range":{"start_line":244,"start_character":0,"end_line":244,"end_character":8},"updated":"2016-11-10 14:35:26.000000000","message":"editing","commit_id":"5ea5b935accb19367a5f0c95ae4780f04fe2aeab"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":123,"context_line":"tenant user and proxy server. When using HTTPS, the TLS encryption"},{"line_number":124,"context_line":"only applies to data between the tenant user and proxy server. The"},{"line_number":125,"context_line":"data between the proxy server and Compute node instance will still"},{"line_number":126,"context_line":"be in cleartext. To provide protection for the latter it is neccessary"},{"line_number":127,"context_line":"to enable the VeNCrypt authentication scheme for VNC in both the"},{"line_number":128,"context_line":"Compute nodes and noVNC proxy server hosts."},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_5e38533d","line":126,"range":{"start_line":126,"start_character":6,"end_line":126,"end_character":15},"updated":"2016-11-10 14:34:12.000000000","message":"I\u0027m guessing this is a name, what\u0027s the reference?","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":131,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"Ensure each Compute node running QEMU/KVM with libvirt has a set"},{"line_number":134,"context_line":"of certificates issued to it."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- :file:`/etc/pki/libvirt-vnc/server-cert.pem`"},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_be1ecfb8","line":134,"range":{"start_line":134,"start_character":28,"end_line":134,"end_character":29},"updated":"2016-11-10 14:34:12.000000000","message":"Maybe then have like, \"The following is a list of those certificates:\" or something similar","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":153,"context_line":"The certificates must have v3 basic constraints present to"},{"line_number":154,"context_line":"indicate the permitted key use and purpose data."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"We recommend using a dedicated certificate authority soley"},{"line_number":157,"context_line":"for the VNC service. This authority may be a child of the"},{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_bed96f24","line":156,"range":{"start_line":156,"start_character":53,"end_line":156,"end_character":58},"updated":"2016-11-10 14:34:12.000000000","message":"solely*","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":154,"context_line":"indicate the permitted key use and purpose data."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"We recommend using a dedicated certificate authority soley"},{"line_number":157,"context_line":"for the VNC service. This authority may be a child of the"},{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"},{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_9e53cb6a","line":158,"range":{"start_line":157,"start_character":20,"end_line":158,"end_character":63},"updated":"2016-11-10 14:34:12.000000000","message":"I\u0027m not entirely too sure what this means? Could you elaborate further perhaps?","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3b4f89b0cb6b566c85b66097793f09914e823e41","unresolved":false,"context_lines":[{"line_number":154,"context_line":"indicate the permitted key use and purpose data."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"We recommend using a dedicated certificate authority soley"},{"line_number":157,"context_line":"for the VNC service. This authority may be a child of the"},{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"},{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_2f3feb87","line":158,"range":{"start_line":157,"start_character":20,"end_line":158,"end_character":63},"in_reply_to":"9a629dbe_4f7fbf65","updated":"2016-11-10 15:00:45.000000000","message":"Good point. Okay :) let\u0027s leave it!","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"9d1404f19b315a875dfb4b81135d762d7207e517","unresolved":false,"context_lines":[{"line_number":154,"context_line":"indicate the permitted key use and purpose data."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"We recommend using a dedicated certificate authority soley"},{"line_number":157,"context_line":"for the VNC service. This authority may be a child of the"},{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"},{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_4f7fbf65","line":158,"range":{"start_line":157,"start_character":20,"end_line":158,"end_character":63},"in_reply_to":"9a629dbe_6422ea53","updated":"2016-11-10 14:59:51.000000000","message":"I think that anyone who\u0027s dealing with setting up x509 certs will understand this aspect, and we\u0027re not trying to document the entire process of x509 cert setup - that\u0027s left to OpenSSSL docs to cover.","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"8cebc708fb543f4a7f8476aa8757db19f4718f87","unresolved":false,"context_lines":[{"line_number":154,"context_line":"indicate the permitted key use and purpose data."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"We recommend using a dedicated certificate authority soley"},{"line_number":157,"context_line":"for the VNC service. This authority may be a child of the"},{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"},{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_6422ea53","line":158,"range":{"start_line":157,"start_character":20,"end_line":158,"end_character":63},"in_reply_to":"9a629dbe_690e433c","updated":"2016-11-10 14:45:20.000000000","message":"Makes sense. Anyway this can be made clearer or is this just obviously my lack of understanding that makes this difficult?","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"c1f176a35039e63546283256a504a88eb6671e9e","unresolved":false,"context_lines":[{"line_number":154,"context_line":"indicate the permitted key use and purpose data."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"We recommend using a dedicated certificate authority soley"},{"line_number":157,"context_line":"for the VNC service. This authority may be a child of the"},{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"},{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_690e433c","line":158,"range":{"start_line":157,"start_character":20,"end_line":158,"end_character":63},"in_reply_to":"9a629dbe_9e53cb6a","updated":"2016-11-10 14:44:25.000000000","message":"x509 certificate authorities have a parent/child relationship, eg authority A, can issue a cert to create authority B, which in turns issues the certs for the compute nodes.","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":158,"context_line":"master certificate authority used for the OpenStack deployment."},{"line_number":159,"context_line":"This is because libvirt does not currently have a mechanism to"},{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"For further details on certificate creation, consult the QEMU"},{"line_number":164,"context_line":"manual page documentation on VNC server certificate setup."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_7edd17df","line":161,"range":{"start_line":161,"start_character":0,"end_line":161,"end_character":35},"updated":"2016-11-10 14:34:12.000000000","message":"You can probably remove this.","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"For further details on certificate creation, consult the QEMU"},{"line_number":164,"context_line":"manual page documentation on VNC server certificate setup."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Configure libvirt to enable the VeNCrypt authentication"},{"line_number":167,"context_line":"scheme for the VNC server. In the :file:`/etc/libvirt/qemu.conf`"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_e99c13c2","line":164,"range":{"start_line":163,"start_character":57,"end_line":164,"end_character":58},"updated":"2016-11-10 14:34:12.000000000","message":"no linky? :)","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"8cebc708fb543f4a7f8476aa8757db19f4718f87","unresolved":false,"context_lines":[{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"For further details on certificate creation, consult the QEMU"},{"line_number":164,"context_line":"manual page documentation on VNC server certificate setup."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Configure libvirt to enable the VeNCrypt authentication"},{"line_number":167,"context_line":"scheme for the VNC server. In the :file:`/etc/libvirt/qemu.conf`"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_64e90ae6","line":164,"range":{"start_line":163,"start_character":57,"end_line":164,"end_character":58},"in_reply_to":"9a629dbe_c9f74f57","updated":"2016-11-10 14:45:20.000000000","message":"Good point, okay :) thanks Daniel!","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"c1f176a35039e63546283256a504a88eb6671e9e","unresolved":false,"context_lines":[{"line_number":160,"context_line":"restrict what certificates can be presented by the proxy server"},{"line_number":161,"context_line":"when connecting to the VNC servers."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"For further details on certificate creation, consult the QEMU"},{"line_number":164,"context_line":"manual page documentation on VNC server certificate setup."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Configure libvirt to enable the VeNCrypt authentication"},{"line_number":167,"context_line":"scheme for the VNC server. In the :file:`/etc/libvirt/qemu.conf`"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_c9f74f57","line":164,"range":{"start_line":163,"start_character":57,"end_line":164,"end_character":58},"in_reply_to":"9a629dbe_e99c13c2","updated":"2016-11-10 14:44:25.000000000","message":"It is referring to a man page you\u0027ll have installed locally on your machine. While it is also visible on qemu.org, their website is in process of being rewritten and so if we link to it we\u0027ll likely get a broken link very shortly.","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":182,"context_line":"  to the Compute nodes."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"After changing the :file:`qemu.conf` file the libvirtd service must"},{"line_number":185,"context_line":"be restarted."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":".. code:: shell"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_090ce7eb","line":185,"range":{"start_line":185,"start_character":3,"end_line":185,"end_character":13},"updated":"2016-11-10 14:34:12.000000000","message":"restarted: *","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":188,"context_line":""},{"line_number":189,"context_line":"  $ systemctl restart libvirtd.service"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Changes will not apply to any existing running guests on"},{"line_number":192,"context_line":"the Compute node, so this configuration should be done before"},{"line_number":193,"context_line":"launching any instances."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"noVNC proxy server configuration"},{"line_number":196,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_89f8f7c4","line":193,"range":{"start_line":191,"start_character":0,"end_line":193,"end_character":24},"updated":"2016-11-10 14:34:12.000000000","message":"This looks like it should be called out in a note","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":195,"context_line":"noVNC proxy server configuration"},{"line_number":196,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"The noVNC proxy server initially only supports the \u0027none\u0027"},{"line_number":199,"context_line":"authentication scheme, which does no checking. Therefore,"},{"line_number":200,"context_line":"it is neccessary to enable the ``vencrypt`` auth scheme by"},{"line_number":201,"context_line":"editing the :file:``nova.conf`` file to set."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_29244b5e","line":198,"range":{"start_line":198,"start_character":51,"end_line":198,"end_character":57},"updated":"2016-11-10 14:34:12.000000000","message":"``none``","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"ff87433883210a99a1f9cd45fa2fdd34188cf2a8","unresolved":false,"context_lines":[{"line_number":229,"context_line":""},{"line_number":230,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-key.pem`"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"  The private key used to generate the ``client-cert.pem`` file"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"- :file:`/etc/pki/nova-novncproxy/ca-cert.pem`"},{"line_number":235,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a629dbe_49e09ffa","line":232,"range":{"start_line":232,"start_character":59,"end_line":232,"end_character":63},"updated":"2016-11-10 14:34:12.000000000","message":"file. *","commit_id":"fecd510a1651af26d5a68ff7386e7f3b27b61014"},{"author":{"_account_id":14643,"name":"Olga Gusarenko","email":"ogusarenko@mirantis.com","username":"Olga"},"change_message_id":"ba32a8aed69a5b8ddf74bb5488f83f55b8c9e52f","unresolved":false,"context_lines":[{"line_number":198,"context_line":"The noVNC proxy server initially only supports the ``none``"},{"line_number":199,"context_line":"authentication scheme, which does no checking. Therefore,"},{"line_number":200,"context_line":"it is neccessary to enable the ``vencrypt`` authentication"},{"line_number":201,"context_line":"scheme by editing the :file:``nova.conf`` file to set."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":".. code::"},{"line_number":204,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a629dbe_1ecfb629","line":201,"range":{"start_line":201,"start_character":22,"end_line":201,"end_character":41},"updated":"2016-11-10 15:38:30.000000000","message":"single backticks, please","commit_id":"88e08740e189475d6b10d00374a35969ad070b7c"}]}