On Wed, Jan 29, 2025 at 05:40:29PM +0400, marcandre.lureau(a)redhat.com wrote:
From: Marc-André Lureau <marcandre.lureau(a)redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com>
---
src/qemu/libvirtd_qemu.aug | 7 ++++++
src/qemu/qemu.conf.in | 31 ++++++++++++++++++++++++
src/qemu/qemu_conf.c | 39 ++++++++++++++++++++++++++++++
src/qemu/qemu_conf.h | 6 +++++
src/qemu/test_libvirtd_qemu.aug.in | 5 ++++
tests/testutilsqemu.c | 2 ++
6 files changed, 90 insertions(+)
Reviewed-by: Daniel P. Berrangé <berrange(a)redhat.com>
diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in
index d853136f10..a623b12195 100644
--- a/src/qemu/qemu.conf.in
+++ b/src/qemu/qemu.conf.in
@@ -229,6 +229,31 @@
#
#spice_sasl_dir = "/some/directory/sasl2"
+# RDP is configured to listen on 127.0.0.1 by default.
+# To make it listen on all public interfaces, uncomment
+# this next option.
+#
+#rdp_listen = "0.0.0.0"
+
+# In order to override the default TLS certificate location for
+# RDP certificates, supply a valid path to the certificate directory.
+# If the path is not provided, then the default_tls_x509_cert_dir path
+# will be used.
+#
+#rdp_tls_x509_cert_dir = "/etc/pki/libvirt-rdp"
+
+# The default RDP username. This parameter is only used if the
+# per-domain XML config does not already provide a username.
+#
+#rdp_username = "user"
+
+# The default RDP password. This parameter is only used if the
+# per-domain XML config does not already provide a password.
+# By default, RDP server will not allow password-less connections.
+# Obviously change this example here before you set this.
+#
+#rdp_password = "RDP12345"
I wanted to complain about this. We store the VNC password here
but then VNC password auth is a bad joke so we don't especially
care about security. For RDP we should care more seriously.
Then I see we did the same for SPICE too which is the same
situation as RDP, so we have precedent to justify this for RDP.
So, anyway, not something you need to fix, just me observing that
we really ought to NOT store passwords in plain text in this
file at all. We need encrypted secrets using systemd credentials
to unseal them. Future work.....
With regards,
Daniel
--
|:
https://berrange.com -o-
https://www.flickr.com/photos/dberrange :|
|:
https://libvirt.org -o-
https://fstop138.berrange.com :|
|:
https://entangle-photo.org -o-
https://www.instagram.com/dberrange :|