too many Error 401: No ticket" no result

[haiwan]

Hi
we found Forums have many Error 401: No ticket" about api novnc.
so have solution share ?
tks

 

[t.lamprecht]

The general issue is, as the reply indicates, that there needs to be a valid ticket cookie (in the near future a plain "Authorization" header also works, as some context limit setting cookies (even if it's just a header)).

 

[t.lamprecht]

The questions is, what exactly do you want to do? Is it including the noVBNC somewhere or is it just accessing it normally through PVE webinterface?

 

[haiwan]

The questions is, what exactly do you want to do? Is it including the noVBNC somewhere or is it just accessing it normally through PVE webinterface?

we Developed a panel . so need this.
just now , we have test ok.
this panel forexample whmcs same. sale panel and user center.

 

[haiwan]

we Developed a panel . so need this.
just now , we have test ok.
this panel forexample whmcs same. sale panel and user center.

we Developed a panel wish let more idc company know promox and use promox

 

[t.lamprecht]

As said, you need to have a valid ticket and use that to set the "PVEAuthCookie" when requesting the noVNC console.
The ticket can be requested from /access/ticket path, the user requesting the ticket needs to have permissions to see the console for the respective VMs.

If you use a WHCMS module you probably should ask them for help, as they are not made by Proxmox but ModulesGarden/WHCMS (IIRC).

 

[haiwan]

As said, you need to have a valid ticket and use that to set the "PVEAuthCookie" when requesting the noVNC console.
The ticket can be requested from /access/ticket path, the user requesting the ticket needs to have permissions to see the console for the respective VMs.

If you use a WHCMS module you probably should ask them for help, as they are not made by Proxmox but ModulesGarden/WHCMS (IIRC).

whmcs no good. haha
this myself company Developed a new panel .

 

[haiwan]

we have test novnc ok.
but have a new safe trouble.
if use token login in novnc see vm. guest have get promox login power.

 

[t.lamprecht]

but have a new safe trouble.
if use token login in novnc see vm. guest have get promox login power.

Yeah sure, that by design. The noVNC console you're using is part of Proxmox VE, if one is logged in in the console they have the same (not more not less) privileges as you assigned them in PVE - so it'd be a bad idea to use an "Administrator" Role for that user

Just give the user which need to access the noVNC console only the VM.Console priviledge on the VM/CTs they own, or may use. See https://pve.proxmox.com/pve-docs/chapter-pveum.html#_privileges

 

[haiwan]

Yeah sure, that by design. The noVNC console you're using is part of Proxmox VE, if one is logged in in the console they have the same (not more not less) privileges as you assigned them in PVE - so it'd be a bad idea to use an "Administrator" Role for that user

Just give the user which need to access the noVNC console only the VM.Console priviledge on the VM/CTs they own, or may use. See https://pve.proxmox.com/pve-docs/chapter-pveum.html#_privileges

so have a question.
set group name vncuser or every VM set a user?
i worry another safe trouble.
if set a group user novnc, maybe have happen this safe trouble.
forexample a b c customer have himself vm.
customer A use novnc group user login vnc see A vm same happen login customer b c vm.
you think understand?

 

[haiwan]

There is a security issue that I am concerned about.For example, If client A,B,C, each of them have one VM, client A login to the group's NOVNC to access A's VM, at the same time Client A can login to B and C's VMs. So what is the prevention?

 

[t.lamprecht]

There is a security issue that I am concerned about.For example, If client A,B,C, each of them have one VM, client A login to the group's NOVNC to access A's VM, at the same time Client A can login to B and C's VMs. So what is the prevention?

What? No, client can only check the VMs were you (or your management tooling) gave them access to.
Why would you use a group permission if you want VM granularity privileges??

Either:
* define user permissions on the VMs they are allowed to access, not more not less
* if you want to manage users with multiple VMs in a nicer slightly more efficient way, add a "resource pool" per user, give the user (not a group!) the VM.Console privilege on that pool and add the VMs the users owns to that pool, then they can view all of those in the pool.

 

[t.lamprecht]

A ticket which you give the user must always be privilege restricted, I mean, how else could you restrict the user?

You'd need to have a self-written proxy which translates from your PVE management application access database to PVE itself, but I guess that's more work to get right.

 

[haiwan]

A ticket which you give the user must always be privilege restricted, I mean, how else could you restrict the user?

You'd need to have a self-written proxy which translates from your PVE management application access database to PVE itself, but I guess that's more work to get right.

ok . tks.
let me first creat vnc group test.
we just worry this
my website connect promox api .
website show running member cloud.
we worry member A login website open member A cloud use vnc . if him have curious try other member cloud id test try login use novnc.
maybe we worry is no live.
let me test .
about your reply proxy we have no history . we have one write one study .
tks

 

[haiwan]

A ticket which you give the user must always be privilege restricted, I mean, how else could you restrict the user?

You'd need to have a self-written proxy which translates from your PVE management application access database to PVE itself, but I guess that's more work to get right.

Hi.
thanks reply me.
we have a question.
api nodes-qemu api vncproxy vncwebsocket this 2 api how to use.
now we have no understand this 2 api