Xen users - Dec 2007 - XEN domUs and X11 (maybe not Xen-related)

Hello,

We''ve been playing with XEN for some weeks now, using
pre-built domU images or making my own. So far, so
good. Except that we utterly fail to understand how to
"use" X11 with the domUs.

The domUs will sometimes be used to test graphical
applications, so we need to be able to do just that.
For example, how do we activate (and then connect to
and use) KDE (or Gnome, or any windowing environment
you like) on a domU ?

Thanks, and a happy new year to everybody,
- FdL


     
_____________________________________________________________________________
Ne gardez plus qu''une seule adresse mail ! Copiez vos mails vers Yahoo!
Mail http://mail.yahoo.fr

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Hello,

You could connect to them using a remote X client. Thus, you''d run an X
server on the domU, and export the display to remote host.

If you are using HVM, you could VNC to the domU courtesy of the VNC 
server run by Xen for the console.

--John

Frédérique Da Luene wrote:
> Hello,
> 
> We''ve been playing with XEN for some weeks now, using
> pre-built domU images or making my own. So far, so
> good. Except that we utterly fail to understand how to
> "use" X11 with the domUs.
> 
> The domUs will sometimes be used to test graphical
> applications, so we need to be able to do just that.
> For example, how do we activate (and then connect to
> and use) KDE (or Gnome, or any windowing environment
> you like) on a domU ?
> 
> Thanks, and a happy new year to everybody,
> - FdL
> 
> 
>      
_____________________________________________________________________________
> Ne gardez plus qu''une seule adresse mail ! Copiez vos mails vers
Yahoo! Mail http://mail.yahoo.fr
> 
> _______________________________________________
> Xen-users mailing list
> Xen-users@lists.xensource.com
> http://lists.xensource.com/xen-users

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Frédérique Da Luene wrote:
> For example, how do we activate (and then connect to
> and use) KDE (or Gnome, or any windowing environment
> you like) on a domU ?
It should just work. Have you got X installed on the prebuilt images? 
what runlevel is the DomU in? Fedora seems to leave  you in runlevel 3 
occasionally, with no X. If that''s happened, fix inittab, or
''telinit 5''
to start X.

After that, start a vncserver or similar on the domU, and connect from 
the Dom0 or another machine. Ask if you need details.

Evan

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Frédérique Da Luene wrote:
> Hello,
>
> We''ve been playing with XEN for some weeks now, using
> pre-built domU images or making my own. So far, so
> good. Except that we utterly fail to understand how to
> "use" X11 with the domUs.
>
> The domUs will sometimes be used to test graphical
> applications, so we need to be able to do just that.
> For example, how do we activate (and then connect to
> and use) KDE (or Gnome, or any windowing environment
> you like) on a domU ?
>
> Thanks, and a happy new year to everybody,
> - FdL
>   
 From an X environment on your own server, you can run "ssh -X 
[domU-hostname]". Or, if you feel the need, you can use the vncviewer 
built into Xen itself, but this presents other management and security 
issues.

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Hi Nico,

--- Nico Kadel-Garcia <nkadel@gmail.com> a écrit :
> Or, if you feel the need, you can use the vncviewer 
> built into Xen itself, but this presents other
> management and security issues.
And what are those security issues (you can point me
to some reference docs on the ''net, of course).

Tia,

FdL


     
______________________________________________________________________________
Yahoo! Mail : un mail innovant avec Messenger compatible Windows Live + stockage
illimité. http://mail.yahoo.fr

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Frédérique Da Luene wrote:
> Hi Nico,
>
> --- Nico Kadel-Garcia <nkadel@gmail.com> a écrit :
>
>   
>> Or, if you feel the need, you can use the vncviewer 
>> built into Xen itself, but this presents other
>> management and security issues.
>>     
>
> And what are those security issues (you can point me
> to some reference docs on the ''net, of course).
>
> Tia,
>
> FdL
>   
No need: I wrote the SunOS port for VNC years ago.

1: VNC sessions do not necessarily close the X session running on the 
VNC server when they disconnect. In fact, configured appropriately, 
multiple people can share the same session, and it''ll stay open and 
active until the last person disconnects, even if it''s set to
auto-logout.
2: Since that session is still open, anyone who gets the VNC access or 
VNC password now potentially has access to any open consoles on the VNC 
server.

This is a serious security issue with lots of VNC based tools, such as 
most remote KVM''s. It mandates that you use a good screenlock on the
VNC
server''s X session, in case you walk away and come back. Xen default 
setups attempt to deal with this somewhat by restricting those VNC 
clients to access from the Dom0 itself. But woe betide the admin who 
opens it up for remote management and fails to protect their X session!


_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

On Thursday 17 January 2008, Nico Kadel-Garcia wrote:
> This is a serious security issue with lots of VNC based tools, such as
> most remote KVM''s. It mandates that you use a good screenlock on
the VNC
> server''s X session, in case you walk away and come back. Xen
default
> setups attempt to deal with this somewhat by restricting those VNC
> clients to access from the Dom0 itself. But woe betide the admin who
> opens it up for remote management and fails to protect their X session!
being a non-encrypted protocol, i guess anyone that uses it remotely without 
some kind of VPN is already exposing too much.

-- 
Javier


_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Javier Guerra Giraldez wrote:
> On Thursday 17 January 2008, Nico Kadel-Garcia wrote:
>   
>> This is a serious security issue with lots of VNC based tools, such as
>> most remote KVM''s. It mandates that you use a good screenlock
on the VNC
>> server''s X session, in case you walk away and come back. Xen
default
>> setups attempt to deal with this somewhat by restricting those VNC
>> clients to access from the Dom0 itself. But woe betide the admin who
>> opens it up for remote management and fails to protect their X session!
>>     
>
> being a non-encrypted protocol, i guess anyone that uses it remotely
without
> some kind of VPN is already exposing too much.
>
>   
Oh, goodness, yes. The VNC password is exchanged encrypted, but 
passwords after that are.... at some small risk.  This is why a 
thoughtful and secure admin will SSH to the Dom0 and run VNC locally in 
an X session, although that imposes some additional computational 
burdens on Dom0

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users