View Only HTTPS Connections about kasmvnc

[clbr]

There was no such separate password supported before? When using python websockify, it had just one http password, just like now?

VNC supports a read-only view. websockify merely facilitated transport to the VNC service, the basic auth enforced by websockify had no bearing on the vnc connection. It was the vnc password used by the user that determined read-only view. We need to support a view-only connection with basic auth, as the vncpassword is no longer used.

"A view-only password must be separated from the normal password by a newline character."
https://tigervnc.org/doc/vncpasswd.html

[clbr]

Yes, but I don't understand what is broken. This sounds like a new functionality?

[clbr]

That is, if you try to connect view-only using the current password, does it not work?

[clbr]

A new, separate username/password for view-only connections is relatively quick.

One moment, let me think about this.

Lets change the format of the .kasmvncpasswd as follows.

username:vjqJJ2QzipFv5qJDa3DOK1HKCVlaNEK6LqY2/Pbon7B:o
username2:vjqJJ2QzipFv5qJDa3DOK1HKCVlaNEK6LqY2/Pbon7B:w
username3:vjqJJ2QzipFv5qJDa3DOK1HKCVlaNEK6LqY2/Pbon7B:

column 1 - username
column 2 - encoded pw
column 3 - permissions of owner "o" and write "w", read is assumed for all users. So in the example, the owner currently has read access, username2 has read/write, and username3 read-only.

Changes to this file should be detected and applied on the fly.

• New users
• Removed users
• Changed passwords
• Changed permissions

Please look into the level of effort required to apply changes to permissions without requiring users to reconnect.

[mmcclaskey]

Testing latest changes. Chrome, Safari, and Firefox never prompts user to input basic auth credentials. Users are able to connect in read-only mode without creds or with wrong creds.

[clbr]

Can't reproduce. I get prompted, and empty creds or wrong creds get rejected.

[clbr]

The "-basicauth foo:" param is still needed, but the user portion of it is ignored. This is so the users can still run without basicauth, or with a simple user:pass setup without the password file.

Confirmed missing -basicauth arg.

When a view only user connects and the resolution is set for server resize, it causes the server side to change resolution to the view only client's connection. While client side changes may be necessary here, the server side should ignore settings like resolution from the a view only client. Please review other settings that can be passed down to the server to see if they should be blocked from a view only user.

[clbr]

Added checks for all the kasm-specific client-settable settings.