chapmanb/cloudbiolinux — pull request #61 by jmchilton (2013-02-09 06:41:50+00:00)
Title: noVNC Integration (Access In-Browser VNC Client from CloudMan)

Initial implementation of novnc integration.

If enabled, http://cloud-instance:6080/ will pop up an in-browser VNC client (no extra client software needed).

Security Implications:

Under this current configuration, port 6080 is automatically connects to the vnc session. Instances are protected by security rules by default, opening port 6080 is dangerous and we should probably address that.

The most obvious way to simplify everything would be to have nginx proxy traffic to 6080, this turns out to be quite difficult because nginx does not play well with websockets.

Some more information here:
http://www.letseehere.com/reverse-proxy-web-sockets
If you want to try to go down that rabbit hole, here is a CloudBioLinux patch to enable nginx_tcp_proxy_module.
https://gist.github.com/jmchilton/4743960

More realistically, there are a few ways forward on this, one would be to move more of the configuration to CloudMan and disable auto startup of init scripts, that way vnc password could be set at runtime to be the same as CloudMan's password. novnc has support for requiring this password.

My preference would be a second option. It would be to patch novnc to require a cookie with some special random key generated when novnc boots up. CloudMan could then set that key when the user logs in with their CloudMan password.

Other options include for instance setting up say Apache on another port and proxing to 6080 but only after authentication.

I don't care so much about the details of how this is all laid out, so feel free to make or request changes or move some of this functionality to CloudMan obviously.

Thanks,
-John