X-Git-Url: https://piware.de/gitweb/?p=talk-cockpit-auth-anywhere.git;a=blobdiff_plain;f=cockpit-auth-anywhere.md;h=59b2c152fc8efd94f59893307433c744661071c4;hp=b5a53c27f70e77f33144550773449f7da814dff4;hb=c277c4ac238af5f48c6f43989dbaf427c63bb063;hpb=a32ed785e042fc3b9030f8664f1feb1f582e98b6

diff --git a/cockpit-auth-anywhere.md b/cockpit-auth-anywhere.md
index b5a53c2..59b2c15 100644
--- a/cockpit-auth-anywhere.md
+++ b/cockpit-auth-anywhere.md
@@ -7,7 +7,6 @@ date: DevConv.CZ 2020
 theme: Singapore
 header-includes:
  - \setbeameroption{show notes}
- - \newcommand{\fullsizeimg}[1]{\makebox[\linewidth]{\includegraphics[width=\paperwidth]{#1}}}
 ...
 
 # Cockpit what?
@@ -18,8 +17,7 @@ header-includes:
 
 :::notes
 - Conceptually: Linux session running in a web browser; technically very similar to ssh/VT/GNOME login
-- Aimed at admins who are new to Linux, e. g. coming from the Windows world and familiar with the concepts, but not Linux terminology
-- but also to experienced ones for infrequent tasks; not just setup, but also investigating “what is wrong with this machine”
+- Tool for experimenting, learning, troubleshooting, and doing infrequent tasks
 :::
 
 
@@ -48,12 +46,16 @@ resize2fs /dev/vg0/data1
  - Zero configuration
 
 :::notes
+- being web based makes this server UI available to places that you
+  traditionally don't reach with ssh
 - Switch to Windows virt-viewer, open Edge, show Cockpit
 - Quit virt-viewer
 - Move to local browser, enable mobile mode (Ctrl+Shift+M)
 - Zero configuration so far, other than possibly installing cockpit pkg and enabling cockpit.socket
+- But wait, you say -- want to admin that server over there, but not allowed to
+  open new port and system service?
 - In larger environments it's impractical to install cockpit server on hundreds
-  of machines and using the login web page
+  of machines and using the login web page; better solution: piggyback on ssh
 - Glimpse of how to customize how cockpit runs and how to authenticate to it
 :::
 
@@ -133,34 +135,89 @@ RequireHost=true
 - can run in container
 - no ws on critical machines, don't trust cockpit-session
 - switch to browser; log out, use "connect to" for cockpit.dev:2201
+- finish the demo script, press Enter
 :::
 
 # Other authentication setups
 
 - SSO/Kerberos in Identity Management domains
 - smart card/client certificate authentication
-- OAuth (Kubernetes)
+- OAuth (external embedding)
 - Foreman: included cockpit-ws with dynamic configuration
 
-TODO: foreman screenshot
-
 :::notes
 - Cockpit supports common authentication systems out of the box
 - IdM is very common; if you have a krb ticket, you get a session immediately
   without the login page
 - browsers can ask for TLS client certificates, commonly with smart cards, and
   present them to the web server; latest Cockpit versions supports that
-- Foreman has a "Web Console" button; already has ssh to all maintained
-  machines
+- Foreman has a "Web Console" button; interesting case for seamless transition
+  between Foreman and Cockpit
+- Show video
+- already has ssh to all maintained machines
 - runs a single cockpit-ws process on its server, and dynamically configures it
-  for selected target machine, seamless transition between Foreman and Cockpit
+  for selected target machine
+- custom cockpit session helper to do OAuth between Foreman session and
+  cockpit-ws, and wrap cockpit-ssh session starter
 - not enough time to demo and explain all of this; just keep in mind that it's
   possible
 :::
 
-# Custom authentication example
+# Embedding into existing session
+
+![local-session-unsafe](local-session-unsafe.pdf){height=60%}\ 
+
+\footnotesize \verb!cockpit-ws -p 9999 --no-tls --local-session=/usr/bin/cockpit-bridge!
+
+`firefox http://localhost:9999`
+
+:::notes
+- what I do want to show: opposite direction; "replace cockpit-session" can
+  also mean "by nothing"
+- due to common JSON protocol, we can connect ws directly to a cockpit-bridge
+- take a step back: if I want to admin this very machine, it's in a running
+  Linux session, it knows who I am
+- put the whole auth structure inside out and instead run cockpit-ws as my user
+  inside my session
+- open localhost:9999 in firefox
+- alarm bells: exposes my session to a TCP port without any auth
+:::
+
+
+# Embedding into existing session: once more with safety!
+
+![local-session-unsafe](local-session.pdf){height=60%}\ 
+
+\footnotesize \verb! !
+
+`/usr/libexec/cockpit-desktop [page]`
+
+:::notes
+- need to hide that port; put browser and cockpit-ws into network namespace,
+  then they live in a completely isolated world
+- do some work to hide browser chrome, use webkit if available
+- cockpit-desktop /
+- wants to run priv bridge, can accept or decline
+- decline, R/O view
+- can show an individual iframe, "page"
+- suddenly you end up with a halfway decent desktop app
+- just the storage page, replacement for gnome-disks
+- cockpit-desktop podman
+:::
+
+# Conclusion
+
+- Authentication is very flexible
+- Works with zero configuration
+- Can be arbitrarily embedded
+
+:::notes
+- Cockpit provides a set of standard auth protocols that are being used in
+  today's modern deployments
+- Once you know about the structure, you can combine ssh, web servers, reverse
+  proxies, and custom auth helpers to embed Cockpit anywhere you want
+:::
 
-TODO
 
 # Q & A