Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Small fixes as per Shane's comments to my PR #3921 + other improvements #3936

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions docs/conf.py
Original file line number Diff line number Diff line change
Expand Up @@ -133,10 +133,6 @@
# NOTE: If set, links for viewing the documentation source files
# and creating GitHub issues are added at the bottom of each page.
"github_url": "https://github.com/canonical/multipass",
# NOTE TO GIULIA: This line was suggested by Shane to enable the feedback button,
# but it doesn't work at the moment.
# 'github_issues': 'enabled',

# Docs branch in the repo; used in links for viewing the source files
#
# TODO: To customise the branch, uncomment and update as needed.
Expand All @@ -150,6 +146,8 @@
# "sequential_nav": "both",
# TODO: To enable listing contributors on individual pages, set to True
"display_contributors": False,
# The following line enables the "Give feedback" button.
"github_issues": "enabled",
}

# Project slug; see https://meta.discourse.org/t/what-is-category-slug/87897
Expand Down Expand Up @@ -269,6 +267,7 @@
.. include:: /reuse/links.txt
"""


# Feedback button at the top; enabled by default
#
# TODO: To disable the button, uncomment this.
Expand Down
8 changes: 4 additions & 4 deletions docs/explanation/authentication.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,21 @@
Before executing any commands, Multipass requires clients to authenticate with the service. Multipass employs an authentication process based on x509 certificates signed by elliptic curve (EC) keys, powered by OpenSSL, to authenticate clients. When a client connects, Multipass verifies the client's certificate, ensuring only authenticated clients can communicate with the service.

`````{tab-set}
`````{tabs}
````{tab-item} Linux
````{group-tab} Linux
Linux and macOS hosts currently use a Unix domain socket for client and daemon communication. Upon first use, this socket only allows a client to connect via a user belonging to the group that owns the socket. For example, this group could be `sudo`, `admin`, or `wheel` and the user needs to belong to this group or else permission will be denied when connecting.
After the first client connects with a user belonging to the socket's admin group, the client's OpenSSL certificate will be accepted by the daemon and the socket will be then be open for all users to connect. Any other user trying to connect to the Multipass service will need to authenticate with the service using the previously set [`local.passphrase`](/reference/settings/local-passphrase).
````
````{tab-item} macOS
````{group-tab} macOS
Linux and macOS hosts currently use a Unix domain socket for client and daemon communication. Upon first use, this socket only allows a client to connect via a user belonging to the group that owns the socket. For example, this group could be `sudo`, `admin`, or `wheel` and the user needs to belong to this group or else permission will be denied when connecting.
After the first client connects with a user belonging to the socket's admin group, the client's OpenSSL certificate will be accepted by the daemon and the socket will be then be open for all users to connect. Any other user trying to connect to the Multipass service will need to authenticate with the service using the previously set [`local.passphrase`](/reference/settings/local-passphrase).
````
````{tab-item} Windows
````{group-tab} Windows
The Windows host uses a TCP socket listening on port 50051 for client connections. This socket is open for all to use since there is no concept of file ownership for TCP sockets. This is not very secure in that any Multipass client can connect to the service and issue any commands.
To close this gap, the client will now need to be authenticated with the Multipass service. To ease the burden of having to authenticate the client, the user who installs the updated version of Multipass will automatically have their clients authenticated with the service. Any other users connecting to the service will have to use authenticate using the previously set [`local.passphrase`](/reference/settings/local-passphrase).
Expand Down
8 changes: 4 additions & 4 deletions docs/explanation/mount.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,19 +30,19 @@ Native mounts use driver-dependent technologies to achieve the high performance.
(security-considerations-mount)=
## Security considerations

`````{tab-set}
`````{tabs}

````{tab-item} Linux
````{group-tab} Linux
Because mounts are performed as `root` -- unless installed via snap, see below -- they allow write access to the whole host operating system. But since only privileged users (members of `sudo`, `wheel`, `admin` groups) can use Multipass, this isn't a concern on Linux.

If Multipass is installed via snap package, [snap confinement](https://snapcraft.io/docs/snap-confinement) prevents mounts outside of the `/home` directory (and to hidden files/folders in the `/home` directory) and possibly, removable media (depending on the connected interfaces). Still, a user (A) with access to Multipass could access mounts that a different user (B) established to B's home directory (that is, outside of A's home).
````

````{tab-item} macOS
````{group-tab} macOS
Because mounts are performed as `root`, they allow write access to the whole host operating system. But since only privileged users (members of `sudo`, `wheel`, `admin` groups) can use Multipass, this isn't a concern on macOS.
````

````{tab-item} Windows
````{group-tab} Windows
Because mounts are performed as privileged users (`SYSTEM` on Windows), they allow write access to the whole host operating system.

For historical reasons, mounts are disabled by default on Windows, even though in the current version of Multipass users need to authenticate with the daemon before it will service their requests. See [`local.privileged-mounts`](/reference/settings/local-privileged-mounts) for information on how to enable them if needed.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
(how-to-guides-customise-multipass-configure-multipasss-default-logging-level)=
(how-to-guides-customise-multipass-configure-multipass-default-logging-level)=
# Configure Multipass’s default logging level

> See also: [Logging levels](/reference/logging-levels)
Expand All @@ -7,9 +7,9 @@ This document demonstrates how to configure the default logging level of the Mul

## Changing the default logging level

`````{tab-set}
`````{tabs}
````{tab-item} Linux
````{group-tab} Linux
First, stop the Multipass daemon:
Expand Down Expand Up @@ -37,7 +37,7 @@ sudo snap start multipass
````
````{tab-item} macOS
````{group-tab} macOS
First, become `root`:
Expand All @@ -61,7 +61,7 @@ launchctl load /Library/LaunchDaemons/com.canonical.multipassd.plist
````
````{tab-item} Windows
````{group-tab} Windows
First, open an administrator privileged PowerShell prompt.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ This document demonstrates how to configure the location where Multipass stores
- When uninstalling Multipass, the uninstaller will not remove data stored in custom locations, so you'll have to deleted it manually.
```

`````{tab-set}
`````{tabs}

````{tab-item} Linux
````{group-tab} Linux

First, stop the Multipass daemon:

Expand Down Expand Up @@ -86,7 +86,7 @@ sudo rm -rf /var/snap/multipass/common/cache/multipassd

````

````{tab-item} macOS
````{group-tab} macOS

First, become `root`:

Expand Down Expand Up @@ -124,7 +124,7 @@ launchctl load /Library/LaunchDaemons/com.canonical.multipassd.plist

````

````{tab-item} Windows
````{group-tab} Windows

First, open a PowerShell prompt with administration privileges.

Expand Down Expand Up @@ -169,9 +169,9 @@ Remove-Item -Path "C:\ProgramData\Multipass\*" -Recurse

## Reverting back to the default location

`````{tab-set}
`````{tabs}

````{tab-item} Linux
````{group-tab} Linux

Stop the Multipass daemon:

Expand Down Expand Up @@ -214,7 +214,7 @@ sudo rm -rf <path>

````

````{tab-item} macOS
````{group-tab} macOS

First, become `root`:

Expand Down Expand Up @@ -248,7 +248,7 @@ launchctl load /Library/LaunchDaemons/com.canonical.multipassd.plist

````

````{tab-item} Windows
````{group-tab} Windows

First, open a PowerShell prompt with administrator privileges.

Expand Down
14 changes: 11 additions & 3 deletions docs/how-to-guides/customise-multipass/index.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
(how-to-guides-customise-multipass-index)=
# Customise-Multipass
# Customise Multipass

The following guides provide step-by-step instructions on how to customise Multipass to address specific needs, from managing Multipass drivers to configuring a graphical user interface.

Expand All @@ -11,7 +11,7 @@ The following guides provide step-by-step instructions on how to customise Multi
- [Use a different terminal from the system icon](use-a-different-terminal-from-the-system-icon)
- [Integrate with Windows Terminal](integrate-with-windows-terminal)
- [Configure where Multipass stores external data](configure-where-multipass-stores-external-data)
- [Configure Multipass’s default logging level](configure-multipasss-default-logging-level)
- [Configure Multipass’s default logging level](configure-multipass-default-logging-level)

<!-- REMOVED FROM DOCS AND MOVED TO COMMUNITY KNOWLEDGE
- [Use Multipass remotely](/)
Expand All @@ -28,4 +28,12 @@ The following guides provide step-by-step instructions on how to customise Multi
:maxdepth: 2
:glob:

*
set-up-the-driver
migrate-from-hyperkit-to-qemu-on-macos
authenticate-clients-with-the-multipass-service
build-multipass-images-with-packer
set-up-a-graphical-interface
use-a-different-terminal-from-the-system-icon
integrate-with-windows-terminal
configure-where-multipass-stores-external-data
configure-multipass-default-logging-level
Original file line number Diff line number Diff line change
Expand Up @@ -80,9 +80,9 @@ In this example, we will use the IP address `10.49.93.209` to connect to the RDP
If the IP address of the instance is not displayed in the output of `multipass list`, you can obtain it directly from the instance, with the command `ip addr`.
```

`````{tab-set}
`````{tabs}

````{tab-item} Linux
````{group-tab} Linux

On Linux, there are applications such as Remmina to visualise the desktop (make sure the package `remmina-plugin-rdp` is installed in your host along with `remmina`).

Expand All @@ -98,13 +98,13 @@ The system will ask for a username (`ubuntu`) and the password set above, and th

````

````{tab-item} macOS
````{group-tab} macOS

To connect on macOS, we can use the “Microsoft Remote Desktop” application, from the Mac App Store.

````

````{tab-item} Windows
````{group-tab} Windows

On Windows, we can connect to the RDP server with the “Remote Desktop Connection” application. There, we enter the virtual machine’s IP address, set the session to XOrg and enter the username and password we created on the previous step.

Expand All @@ -118,9 +118,9 @@ And we are done... a graphical desktop!

It might be the case that we only want Multipass to launch one application and to see only that window, without having the need for a complete desktop. It turns out that this setup is simpler than the RDP approach, because we do not need the Multipass instance to deploy a full desktop. Instead, we can use X11 to connect the applications in the instance with the graphical capabilities of the host.

`````{tab-set}
`````{tabs}

````{tab-item} Linux
````{group-tab} Linux

Linux runs X by default, so no extra software in the host is needed.

Expand Down Expand Up @@ -155,7 +155,7 @@ A small window containing the X logo will show up. Done!

````

````{tab-item} macOS
````{group-tab} macOS

The first step in Mac is to make sure a X server is running. The easiest way is to install [XQuartz](https://www.xquartz.org).

Expand All @@ -167,7 +167,7 @@ Note to Apple Silicon users: some applications requiring OpenGL will not work th

````

````{tab-item} Windows
````{group-tab} Windows

Windows knows nothing about X, therefore we need to install an X server. Here we will use [VcXsrv](https://sourceforge.net/projects/vcxsrv/). Other options would be [Xming](http://www.straightrunning.com/XmingNotes/) (the newest versions are paid, but older versions can still be downloaded for free from their [SourceForge site](https://sourceforge.net/projects/xming/)) or installing an X server in [Cygwin](https://cygwin.com/).

Expand Down
Loading
Loading