mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
1547e58e55
socketiod does not validate the console token, keeps a single global PTY and broadcasts its output to every connected client, so anyone who can reach port 6081 can read and write a serial console that someone opened. It is also broken for legitimate users, since console/views.py now writes signed tokens that socketiod cannot parse. Until it is rewritten, turn the serial console off by default: - Add SERIAL_CONSOLE_ENABLED = False to the settings template; installs whose settings.py lacks it are treated as disabled. - The console view shows an error instead of the xterm page for pty consoles while the setting is off. - socketiod refuses to start unless SERIAL_CONSOLE_ENABLED is True. - Supervisor: autostart=false for socketiod; drop -d (debug) from the supervisor and systemd definitions; fix the systemd unit description; conf/systemd/install.sh no longer suggests enabling socketiod. - README: stop opening port 6081 and document how to enable the serial console on a trusted network.
10 lines
473 B
Bash
Executable file
10 lines
473 B
Bash
Executable file
#!/bin/bash
|
|
FILEPATH=$(readlink -f "$0");
|
|
SCRIPTPATH=$(dirname "$FILEPATH");
|
|
cd "$SCRIPTPATH"
|
|
cp webvirt-* /lib/systemd/system/
|
|
cp webvirt /etc/default/
|
|
# webvirt-socketiod (serial console) is not enabled by default: it does not
|
|
# authenticate connections yet and refuses to start unless
|
|
# SERIAL_CONSOLE_ENABLED = True is set in settings.py.
|
|
echo Run to start services \"systemctl daemon-reload\; systemctl enable --now $(ls webvirt-* | grep -v socketiod | tr "\n" " ")\"
|