mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
1547e58e55
socketiod does not validate the console token, keeps a single global PTY and broadcasts its output to every connected client, so anyone who can reach port 6081 can read and write a serial console that someone opened. It is also broken for legitimate users, since console/views.py now writes signed tokens that socketiod cannot parse. Until it is rewritten, turn the serial console off by default: - Add SERIAL_CONSOLE_ENABLED = False to the settings template; installs whose settings.py lacks it are treated as disabled. - The console view shows an error instead of the xterm page for pty consoles while the setting is off. - socketiod refuses to start unless SERIAL_CONSOLE_ENABLED is True. - Supervisor: autostart=false for socketiod; drop -d (debug) from the supervisor and systemd definitions; fix the systemd unit description; conf/systemd/install.sh no longer suggests enabling socketiod. - README: stop opening port 6081 and document how to enable the serial console on a trusted network.
23 lines
595 B
Desktop File
23 lines
595 B
Desktop File
[Unit]
|
|
Description=Webvirt Cloud serial console (socketiod; requires SERIAL_CONSOLE_ENABLED = True)
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
User=www-data
|
|
Group=www-data
|
|
LimitNOFILE=64000
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
EnvironmentFile=/etc/default/webvirt
|
|
|
|
ExecStart=/bin/bash -c "cd ${WEBVIRT_PATH};${WEBVIRT_PATH}/venv/bin/python3 ${WEBVIRT_PATH}/console/socketiod"
|
|
|
|
# Make sure stderr/stdout is captured in the systemd journal.
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|