[request] Add a posibility to set an optional password for virtual machine VNC/SPICE connections.

[JMarcosHP]

It could be a good idea to implement this feature for better security.

Maybe a checkbox in case you enable spice or vnc in advanced mode for vm creation, and a possibility to change it later or remove the password.

[ryecoaaron]

This would be a large change since virsh define (what the plugin uses to create the vm) strips the passwords out of the VM's xml. The only ways to add a password are after the VM is start or enabling SASL auth. After the VM start, it would be difficult to define the password since the plugin does not store anything in the OMV database for the VM. Enabling SASL would require creating an entire SASL plugin pretty much.

[JMarcosHP]

The only ways to add a password are after the VM is start or enabling SASL auth. After the VM start, it would be difficult to define the password since the plugin does not store anything in the OMV database for the VM.

Maybe we can save it in an encrypted file to use it later after the first VM start. Or we can use the OMV database for that.

When the user request for a password for connection in the VM creation step, display a note for users that they can set the password later on the first start.

Then when they click the button to start the VM display a modal window asking for a password to set -> save in a file -> apply the password -> start VM using that password.

Of course we need to add a status variable to validate later if the password is already set and stored in a file.

[ryecoaaron]

Those ideas are significant changes for something that really should only be used for OS install. I wasn't saying they can't be done but it is a lot of work.

[JMarcosHP]

Those ideas are significant changes for something that really should only be used for OS install. I wasn't saying they can't be done but it is a lot of work.

Ok, no problem with that.
I don't need that much this feature currently, but it could be useful to have a bit more of security.

As far I know, TrueNas has support for spice password, but honestly I don't want to being forced to only use ZFS for my nas.

I can help you with testing if you want to implement this.

[ryecoaaron]

I don't need that much this feature currently, but it could be useful to have a bit more of security.

The best security is disabling vnc and spice which the plugin can do. For the short time you would have vnc/spice enabled to install the OS, I don't think it is that much of a security issue. Once the OS is installed, you can use the guest's remote connection service (rdp, vnc, whatever).

As far I know, TrueNas has support for spice password,

If you start the VM from the command line, you could set a password as well with the kvm plugin. So, it just isn't a feature in the web interface. As I mentioned above, you should switch to a remote service provided by the guest instead of the kvm level. TrueNAS (ix systems) also has hundreds of paid employees to implement stuff like that.

[JMarcosHP]

Can I ask for another feature in the webui?

Like CPU core pin to specify the logical cores that the VM is allowed to use for better cache locality and number of threads.

[ryecoaaron]

To add a feature like that, it would require dynamic fields in the web interface and I can't do that in the OMV framework. You can edit the VM's xml in the plugin and add it to your vm though. You could also use virt-manager (there is an example docker compose file in the compose plugin to allow virt-manager in the browser) to make the changes. virsh from the command line would allow it as well.

[JMarcosHP]

Aight, thank you so much for your help and hard work in the plugins.