Synnefo » snf-vncauthproxy

	* Add the vncauthproxy-passwd tool to manage the users file.

Its main use is to enable VNC clients to connect to firewalled VNC servers.

snf-vncauthproxy is currently packaged only for Debian (stable).

In case you're upgrading from an older snf-vncauthproxy version or it's the

first time you're installing snf-vncauthproxy, you will prompted to configure

a vncauthproxy user (see below for more information on user management).

snf-vncauthproxy listens on a TCP socket for control (JSON) messages from

clients. The format of the control messages is:

If you're using the init script, snf-vncauthproxy reads its options from its

Refer to the vncauthproxy help output for a detailed listing and information

on all available options:

.. code-block:: console

    # vncauthproxy --help

By default snf-vncauthproxy will listen to ``127.0.0.1:24999`` TCP, for

incoming control connections and uses the ``25000-30000`` range for the

listening / data sockets.

Version 1.5 replaced Unix domain control sockets with TCP control sockets. This

change made it necessary to introduce an authentication file to replace the

POSIX file permissions, which protected the domain sockets.

    username:$6$salt$hash

The password part of the line (after the colon) is the output of crypt(), using

a random 16-char salt with SHA-512.

To manage the authentication file, you can use the vncauthproxy-passwd tool,

to easily add, update and delete users:

To add a user:

.. code-block:: console

    # vncauthproxy-passwd /var/lib/vncauthproxy/users user

You will be prompted for a password.

To delete a user:

.. code-block:: console

    # vncauthproxy-passwd -D /var/lib/vncauthproxy/users user

See the help output of the tool for more options:

.. code-block:: console

    # vncauthproxy-passwd -h

.. warning:: The vncauthproxy daemon requires a restart for the changes in the

 authentication file to take effect.

.. warning:: After installing snf-vncauthproxy for the fist time, make sure

 that you create a valid authentication file and define any users needed. The

 vncauthproxy daemon will start but will not be usable if no users are defined

 or if no authentication file is present.

Changelog

^^^^^^^^^

* v1.5 :ref:`Changelog <Changelog-1.5>`

Upgrade notes

^^^^^^^^^^^^^

.. toctree::

   :maxdepth: 1

    v1.4 -> v1.5 <upgrade/upgrade-1.5.rst>

Upgrade notes

^^^^^^^^^^^^^

v1.5

====

Version 1.5 replaced Unix domain control sockets with TCP control sockets. This

change made it necessary to introduce an authentication file to replace the

POSIX file permissions, which protected the domain sockets.

You can configure vncauthproxy daemon by modifying the Debian default file

(``/etc/default/vncauthproxy``) and more specifically the ``DAEMON_OPTS``

variable. This option (along with the modified ``CHUID`` option) has been added

to the v1.5 default file (which you'll need to 'merge' if you're upgrading from

an older version of snf-vncauthproxy).

The ``DAEMON_OPTS`` variable accepts any valid option you can pass to the

vncauthproxy daemon on the command line. For a detailed listing and information

about the avaialble options plese check vncauthproxy help output:

.. code-block:: console

    # vncauthproxy --help

The default path for the auth file is ``/var/lib/vncauthproxy/users``

(configurable by the ``--auth-file`` option). Each line in the file represents

one user which is allowed to use the control socket and should be in the

following format:

.. code-block:: console

    username:$6$salt$hash

The password part of the line (after the colon) is the output of crypt(), using

a random 16-char salt with SHA-512.

To manage the authentication file, you can use the vncauthproxy-passwd tool,

to easily add, update and delete users:

To add a user:

.. code-block:: console

    # vncauthproxy-passwd /var/lib/vncauthproxy/users user

You will be prompted for a password.

To delete a user:

.. code-block:: console

    # vncauthproxy-passwd -D /var/lib/vncauthproxy/users user

See the help output of the tool for more options:

.. code-block:: console

    # vncauthproxy-passwd -h

.. warning:: The vncauthproxy daemon requires a restart for the changes in the

 authentication file to take effect.

.. warning:: After installing snf-vncauthproxy for the fist time, make sure

 that you create a valid authentication file and define any users needed. The

 vncauthproxy daemon will start but will not be usable if no users are defined

 or if no authentication file is present.

Version 1.5 also introduced support for SSL for the control socket. If you

enable SSL support (``--enable-ssl`` parameter, disabled by default) you will

have to provide a certficate and key file (``--cert-file`` and ``--key-file``

parameters). The default values for certificate and key files are

``/var/lib/vncauthrpoxy/{cert,key}.pem`` respectively.

If you're using snf-vncauthproxy with Synnefo, you should make sure to edit the

``CYCLADES_VNCAUTHPROXY_OPTS`` setting in

``/etc/synnefo/20-snf-cyclades-app-api.conf``.  The

``CYCLADES_VNCAUTHPROXY_OPTS`` dict in

``/etc/synnefo/20-snf-cyclades-app-api.conf`` should be edited to match

snf-vncauthproxy configuration (user, password, SSL support, certificate file).

You should also make sure that the node running snf-cyclades-app can connect to

the snf-vncauthproxy's control socket address / port (the suggested deployment to

run snf-vncauthproxy on the same host as snf-cyclades-app should work with

the defaults of snf-vncauthproxy, with the exception of the authentication

file).

Finally, snf-vncauthproxy now adds a user and group (``vncauthproxy``) to be

used by the vncauthproxy daemon. As a result the ``CHUID`` option in the Debian

default file (``/etc/default/vncauthproxy``) has changed accordingly. Although

it is recommended to run vncauhtproxy with the predfined user and group, it's

not mandatory.

            'vncauthproxy = vncauthproxy.proxy:main',

            'vncauthproxy-passwd = vncauthproxy.passwd:main'

                      dest="daddr",

                      type="int",

    """ Connect to vncauthproxy and request a VNC forwarding.

        @type sport: int

        @param sport: Source port for incoming connections

                      (0 for automatic allocation)"

        @type daddr: str

        @param daddr: Destination address for the forwarding

        @type dport: int

        @param dport: Destination port for the forwarding

        @type password: str

        @param password: VNC server auth password

        @type auth_user: str

        @param auth_user: vncauthproxy user

        @type auth_password: str

        @param auth_password: vncauthproxy password

        @type server_address: str

        @param server_address: Listening address for the vncauthproxy daemon

                               (default: 127.0.0.1)

        @type server_port: int

        @param server_port: Listening port for the vncauthproxy daemon

                           (default: 24999)

        @type enable_ssl: bool

        @param enable_ssl: Enable / disable SSL on the control socket

        @type ca_cert: str

        @param ca_cert: Path to the CA cert file

        @type strict: bool

        @param strict: Enable strict cert checking for SSL

        @rtype: dict

        @return: Server response in dict / JSON format

        """

        logger.warning("strict or ca-cert set, but ssl not enabled")

    # Mandatory arguments

    if opts.password is None:

        sys.stderr.write("The password argument is mandatory.\n")

        sys.exit(1)

    if opts.daddr is None:

        sys.stderr.write("The daddr argument is mandatory.\n")

    if opts.dport is None:

        sys.stderr.write("The dport argument is mandatory.\n")

    if opts.auth_user is None:

        sys.stderr.write("The auth_user argument is mandatory.\n")

    if opts.auth_password is None:

        sys.stderr.write("The auth_password argument is mandatory.\n")

#!/usr/bin/env python

"""

vncauthproxy-passwd - vncauthproxy passwd file mgmt tool

"""

#

# Copyright (c) 2010-2013 Greek Research and Technology Network S.A.

#

# This program is free software; you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation; either version 2 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful, but

# WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

# General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

# 02110-1301, USA.

import argparse

import crypt

import getpass

import os

import random

import re

import string

import sys

import tempfile

def parse_arguments():

    """ Parse cli args. """

    parser = argparse.ArgumentParser()

    parser.add_argument("-n", "--dry-run", action="store_true", dest="dry_run",

                        help="Display the results on stdout without updating "

                        "the passwd file")

    parser.add_argument("-D", "--delete", action="store_true",

                        dest="delete_user", help="Delete user from file")

    parser.add_argument("passwdfile", metavar="file", type=str, nargs=1,

                        help="Path to the passwd file")

    parser.add_argument("user", metavar="user", type=str, nargs=1,

                        help="User to edit")

    args = parser.parse_args()

    return args

def gen_salt():

    """ Generate 16-char salt string. """

    chars = list(string.ascii_letters + string.digits + "./")

    random.shuffle(chars)

    return "".join(random.choice(chars) for x in range(16))

def gen_hash(username, password):

    """ Generate SHA-512 hash in crypt() format. """

    salt = "$6$%s$" % gen_salt()

    return "%s:%s\n" % (username, crypt.crypt(password, salt))

def fail(reason):

    """ Print reason for failure and exit. """

    sys.stderr.write("%s\n" % reason)

    sys.exit(1)

def find_user(lines, user):

    """ Return user info from passwd file, if the users exists. """

    for (idx, line) in enumerate(lines):

        (username, _) = line.split(":", 1)

        if user == username:

            return (idx, line)

    return None

def write_wrapper(passwdfile, lines, dry_run):

    """ Dry-run wrapper for write. """

    if not dry_run:

        (fd, name) = tempfile.mkstemp()

        with os.fdopen(fd, "w+") as f:

            f.write("".join(lines))

        os.rename(name, passwdfile)

    else:

        sys.stderr.write("".join(lines))

def delete_user(user, passwdfile):

    """ Delete user from passwdfile. """

    if not os.path.isfile(passwdfile):

        fail("Cannot delete user from non-existent file")

    lines = open(passwdfile).readlines()

    user_line = find_user(lines, user)

    if not user_line:

        fail("User not found!")

    (idx, line) = user_line

    lines.remove(line)

    return lines

def add_or_update_user(user, passwdfile):

    """ Add or update user from passwdfile. """

    password = getpass.getpass()

    if password == "":

        fail("Password cannot be empty")

    if password != getpass.getpass("Retype password: "):

        fail("Passwords don't match")

    newline = gen_hash(user, password)

    lines = [newline]

    if os.path.isfile(passwdfile):

        lines = open(passwdfile).readlines()

        user_line = find_user(lines, user)

        if not user_line:

            lines.append(newline)

        else:

            (idx, _) = user_line

            lines[idx] = newline

    return lines

def main():

    """ Run the tool from the command line. """

    try:

        args = parse_arguments()

        user = args.user[0]

        passwdfile = args.passwdfile[0]

        user_re = r'^[a-z_][a-z0-9_]{0,30}$'

        if re.match(user_re, user) is None:

            fail("Username must match the following regexp: %s" % user_re)

        if args.delete_user:

            lines = delete_user(user, passwdfile)

        else:

            lines = add_or_update_user(user, passwdfile)

        write_wrapper(passwdfile, lines, args.dry_run)

    except KeyboardInterrupt:

        pass

    sys.exit(0)

import crypt

                msg = "vncauthproxy authentication failure: user not found"

            (cipher, salt, authdb_hash) = VncAuthProxy.authdb[auth_user]

            crypt_result = crypt.crypt(auth_password, '$%s$%s$' %

                                                      (cipher, salt))

            passhash = crypt_result.lstrip('$').split('$', 2)[-1]

            if passhash != authdb_hash:

                msg = "vncauthproxy authentication failure: wrong password"

            lines = [l.strip().split(':', 1) for l in f.readlines()]

            for (user, passhash) in lines:

                users[user] = passhash.lstrip('$').split('$', 2)

    except ValueError as err:

        raise InternalError("Malformed auth file")