mirror of
https://github.com/retspen/webvirtmgr.git
synced 2026-04-25 15:45:51 +03:00
[GH-ISSUE #58] VNC is broken when webvirtmgr is hosted on a HTTPS webserver #48
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @tecnobrat on GitHub (May 23, 2013).
Original GitHub issue: https://github.com/retspen/webvirtmgr/issues/58
These lines of code in templates/vnc.html causes VNC to fail to connect if you are using apache over HTTPS.
I replaced it with:
And then VNC showed properly and I have no more issues.
@retspen commented on GitHub (May 27, 2013):
Not tested this issue. This point can be specified on the developer's site: https://github.com/kanaka/noVNC
@normaldotcom commented on GitHub (Nov 7, 2013):
Verified in the latest version
8d9ef511ec, VNC fails when encryption is enabled. Disabling encryption allows VNC to work again. The code snippet shown above is now located in templates/console.html@dewback commented on GitHub (Nov 30, 2013):
It fails on secure websocket when webvirtmgr-novnc is spawning websockify in every new connection is trying to load a file called "self.pem" as ssl cert. Stracing the process it shows also that is trying to search for it in /, so is trying to load /self.pem.
So in order to work, the file /self.pem has to exists, be a valid pem containing a concatenated private key plus the public certificate, and the user running webvirtmgr-novnc should have read rights over the file (yes, sucks that one user other than root should have the ability to read a private key when there is no privilege separation). That or telling websockify to search for another pem file, of course.
This minimal patch did the trick:
And you can generate a self signed pem file if you do not have already a valid one like this:
@retspen commented on GitHub (Dec 15, 2013):
Ok, need add cert to git
@srulikuk commented on GitHub (Feb 15, 2015):
I had webvirtmgr working for a while and decided to use https, i updated templates/console.html as above, I also updated webvirtmgr-novnc cert variable as above.
The webvirtmgr page is working fine but the vnc page chrome shows "the page is trying to load scripts from unauthenticated sources" it gives me a option to "load unsafe scripts" and page displays properly, I am just wondering what this error is and what I can do in webvirtmgr to sort it
@brenard commented on GitHub (Feb 15, 2015):
I mean it's just that your are using an "unsafe" certificate for your webvirt-novnc script. You have to use a certificate that is know as safe by your browser. You could try also to access with your browser to https://[web.virt.mgr.host]:6080 and add permanently a security exception for this couple of host and port.
@srulikuk commented on GitHub (Feb 16, 2015):
the certificate is a comodo certificate, no errors on other pages or in main webvirtmgr page, the error only appears in vnc popup page, it states the certificate is valid (green lock symbol) however for the encryption it states there connection is secure but includes resources that are not.
@brenard commented on GitHub (Feb 16, 2015):
Do you try to set the WS_PUBLIC_HOST in local_settings.py ? This parameter (appear in last version) permit to control the hostname of webservice host. It's important that the hostname of the WS host corresponding with the subject of your certificate.
@srulikuk commented on GitHub (Feb 16, 2015):
i do not have a local_settings.py but I did make the changes shown here
github.com/brenard/webvirtmgr@731bc3304bI still have the same issue, I also looked and did not find documentation how to upgrade to the latest version of webvirtmgr, is there documentation somewhere?@brenard commented on GitHub (Feb 16, 2015):
If you don't have local_settings.py file, you could do this modification in settings.py (like in brenard@731bc33). In any case, the WS_PUBLIC_HOST variable must be set with the value of the CN field of your certificate.
@srulikuk commented on GitHub (Feb 16, 2015):
in settings.py i added the line WS_PUBLIC_HOST = mydomain.com which is same as in certificate (the certificate actually has many domains) and i still have the same issue
@srulikuk commented on GitHub (Feb 18, 2015):
after adding the setting WS_PUBLIC_HOST = mydomain.com i get a timeout error on vnc and cant connect. this si my output when trying to restart / stop novnc
service webvirtmgr-novnc stop
when I try to start it it gives an ok but running service status tells me its not running, my output from /var/www/webvirtmgr/console/webvirtmgr-novnc results in;
Traceback (most recent call last):
File "/var/www/webvirtmgr/console/webvirtmgr-novnc", line 20, in
from webvirtmgr.settings import WS_PORT
File "/var/www/webvirtmgr/webvirtmgr/settings.py", line 149, in
WS_PUBLIC_HOST = mydomain.com
NameError: name 'mydomain' is not defined
@brenard commented on GitHub (Feb 18, 2015):
You have to put mydomain.com in quotes :
@srulikuk commented on GitHub (Feb 18, 2015):
when I do that and webvirtmgr-novnc still does not run, i get the following
/var/www/webvirtmgr/console/webvirtmgr-novnc
WARNING:root:No local_settings file found.
WebSocket server settings:
Traceback (most recent call last):
File "/var/www/webvirtmgr/console/webvirtmgr-novnc", line 161, in
server.start_server()
File "/usr/lib/python2.7/dist-packages/websockify/websocket.py", line 751, in start_server
lsock = self.socket(self.listen_host, self.listen_port, False, self.prefer_ipv6)
File "/usr/lib/python2.7/dist-packages/websockify/websocket.py", line 193, in socket
sock.bind(addrs[0][4])
File "/usr/lib/python2.7/socket.py", line 224, in meth
return getattr(self._sock,name)(*args)
socket.error: [Errno 98] Address already in use
The cert file is in the correct location as the regular pages open properly with https.
thanks you so much for helping me with this
@brenard commented on GitHub (Feb 18, 2015):
Your error is :
That mean that another process is currently listening on TCP port 6080. If you install novnc Debian package, it's possible that novnc service is currently running. In this case, you have to stop and disable novnc service :
After that, try to restart supervisord. If you still have this problem after stopping novnc, try to detect witch process is listening on 6080 TCP port by running as root :
@srulikuk commented on GitHub (Feb 18, 2015):
I am using ubuntu, novnc is not installed, i restarted nginx and was able to start webvirtmgr-novnc however i still get the same error for https on novnc dialog, see following links to screenshot, http://pbrd.co/1MwXOrX you will see main page https green lock. once i click on vnc dilaog i get the following http://pbrd.co/1MwXSYH, after i click load unsafe scripts page loads but https gets red with strikeout
@retspen commented on GitHub (Feb 18, 2015):
Can you do this:
and then restart supervisor:
@brenard commented on GitHub (Feb 18, 2015):
Look in the source code of VNC console page : I mean you have JS script load with http://~~~ hard code URL. This URL is normaly defined by using STATIC_URL (in settings.py file) variable but I don't known witch version of webvirtmgr you are using. if you can, you should upgrade your installation.
@srulikuk commented on GitHub (Feb 18, 2015):
Result
fuser -k 6080/tcp
6080/tcp: 13174
Still same result in web page
@retspen commented on GitHub (Feb 18, 2015):
@brenard What js file do you mean?
@srulikuk commented on GitHub (Feb 18, 2015):
i see STATIC_URL = '/static/' in settings.py but cant see http reference in *webvirtmgr-novnc, with regards to upgrading, I have version 4.8.8 I would like to upgrade but i cannot find any documentation on how to upgrade.
many thanks
@retspen commented on GitHub (Feb 18, 2015):
@brenard commented on GitHub (Feb 18, 2015):
@retspen : I mean about novnc/util.js JS file and all others call using Util.load_scripts() method ("webutil.js", "base64.js", "websock.js", "des.js", "input.js", "display.js", "jsunzip.js", "rfb.js").
@srulikuk : Try an upgrade and if you still have problem, send us the HTML code of VNC console page.
@srulikuk commented on GitHub (Feb 18, 2015):
I removed my changed files and made a git pull, now i cant login as its not configured for https and ngix is forcing https.
What are all the steps i need to do to get https working, please correct me if i miss something?
github.com/brenard/webvirtmgr@731bc3304b@brenard commented on GitHub (Feb 18, 2015):
My advice is to create an local_settings.py in webvirtmgr/local/ directory by copying local_settings.py.example. In this file you have to configure :
You don't have to modify console template as explain here : https://github.com/retspen/webvirtmgr/issues/58#issue-14656089 This parameter is automatically use encrypt access to WS.
@srulikuk commented on GitHub (Feb 18, 2015):
@brenard commented on GitHub (Feb 18, 2015):
As explain here https://github.com/retspen/webvirtmgr/wiki/Install-WebVirtMgr , you have to configure supervisord to manage webvirtmgr-console service for you. Concerning the notification about scripts from unauthenticated sources, as explain before, give us the HTML code of your VNC console web page.
@srulikuk commented on GitHub (Feb 18, 2015):
I updated the supervisor script as in guide, now vnc gives error 1006, when I try /var/www/webvirtmgr/console/webvirtmgr-console, i get error
WebSocket server settings:
Traceback (most recent call last):
File "/var/www/webvirtmgr/console/webvirtmgr-console", line 218, in
server.start_server()
File "/usr/lib/python2.7/dist-packages/websockify/websocket.py", line 751, in start_server
lsock = self.socket(self.listen_host, self.listen_port, False, self.prefer_ipv6)
File "/usr/lib/python2.7/dist-packages/websockify/websocket.py", line 193, in socket
sock.bind(addrs[0][4])
File "/usr/lib/python2.7/socket.py", line 224, in meth
return getattr(self._sock,name)(*args)
socket.error: [Errno 98] Address already in use
however when I stop supervisor service this command does not give an error (obviously cant log into to webpage with supervisor stopped)
netstat -lnp|grep 6080
tcp 0 0 0.0.0.0:6080 0.0.0.0:* LISTEN 22221/python
however while supervisor stopped netstat -lnp|grep 608 returns no result
@srulikuk commented on GitHub (Feb 18, 2015):
also when i execute service webvirtmgr-console status, i get
webvirtmgr-console: unrecognized service
@brenard commented on GitHub (Feb 18, 2015):
Restart service using supervisor and check your log files in /var/log/supervisor/ when you access to the VNC console. It's normal that "service webvirtmgr-console status" command return this command because the webvirtmgr-console does not exist. The right service is supervisor.
@srulikuk commented on GitHub (Feb 18, 2015):
this is what i get in webvirtmgr-console log
WebSocket server settings:
Listen on 0.0.0.0:6080
Flash security policy server
No SSL/TLS support (no cert file)
proxying from 0.0.0.0:6080 to ignore:ignore
1: xx.xx.xx.xx: SSL connection but '/etc/nginx/ssl/mydomain.co.uk.pem' not found
2: xx.xx.xx.xx: SSL connection but '/etc/nginx/ssl/mydomain.co.uk.pem' not found
the pem file is there i also changed owner to www-data but does not help
@srulikuk commented on GitHub (Feb 18, 2015):
Since the update I dont have VNC access to my VM's, I am really desperate, what can I do about this error?
@srulikuk commented on GitHub (Feb 18, 2015):
Solved the certificate problem, the certificate has to be in /webvirtmgr dir, in version 4.8.8 it did not, also the regular pages (main webvirtmgr not vnc) did not have a problem that the cert was in /etc/nginx/ssl/
regarding the VNC html, are you referring to templates/console-vnc.html? if yes i pasted it here http://pastebin.com/9dkLp6Ry
@srulikuk commented on GitHub (Feb 21, 2015):
Did you have a chance to look at my html yet?