On Tue, Mar 31, 2020 at 6:52 PM Katerina Koukiou <kkoukiou(a)redhat.com> wrote:
Hi Gal,
We took the 15 min timeout from GDM and this is based on Common
Criteria.
I urge you to reconsider.
I am not a security expert, but was a sysadmin for 15 years before
joining Red Hat 7 years ago (as a developer).
I think that the gdm case is different. There, you lock the session,
not logout. Right? If so, after re-entering the password, the admin
has everything back there.
No idea what timeout applies to logging out a session. I do not believe
it's 15 minutes. I think I never used a web application that required
to login again after 15 minutes.
Also: Does Red Hat now by default configures sshd to logout sessions
after 15 minutes? If not, what's the difference?
The suggested 2h is just too much. The engine-setup process
should not depend on cockpit session being around. It needs to run
even when you log out of Cockpit and the user should be able to see
the running process output when they log back in again.
OK, how? Do you have an example for a cockpit module/plugin/whatever
that does that? That runs a long-running command, saves its output
somewhere, and if being logged out in the middle, allows the user
to reconnect, showing everything since the last part already seen by
the user? Does cockpit have means to help plugin authors do that,
without reinventing the wheel every time?
We want to do that for a long time now:
https://bugzilla.redhat.com/show_bug.cgi?id=1422544
But neglected it so far, because it seems like a lot of work, with
no urgent need. Imposing 15 minutes timeouts is now actually such
an urgent need... :-)
Actually, when we opened it, things were more complex - our long-
running command could require interaction with the user (via
stdin), and our cockpit plugin provided means to do that. Now we
do not need this anymore, so can probably do this ourselves. But I
think it would be useful if cockpit provides means to reconnect
also to an interactive command. Basically, screen/tmux -style.
Thanks and best regards,
Regards,
Katerina
On Mon, Mar 30, 2020 at 12:12 PM Gal Zaidman <gzaidman(a)redhat.com> wrote:
>
> Hi Cockpit developers,
>
> I saw that on cockpit-209 Session timeouts were added with the default to 15 minutes
of inactivity (
https://cockpit-project.org/blog/cockpit-209.html).
> I think that this change is problematic because:
> 1. The timeout is very short and it can cause unexpected behavior to users and
cockpit packages.
> 2. The timeout can only be configured in the /etc/cockpit.conf file, so it is hard
for packages to configure it to fit to their behavior.
>
> For example,
> we created a package for installing ovirt with cockpit UI, that installation can
take a lot of time, it has different phases and logging out in the middle can cause
problems.
> We prefer to avoid editing /etc/cockpit.conf because we don't want to run over
user configuration (what to do when there is already cockpit.conf present?)
>
> I want to suggest:
> 1. Raising the timeout to 2 hours of inactivity, this seems reasonable.
> 2. Provide a more flexible way of configuring the timeout, with an option to the
manifest.json package file and/or with a cockpit API call.
>
> Thanks
> _______________________________________________
> cockpit-devel mailing list -- cockpit-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to cockpit-devel-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/cockpit-devel@lists.fedoraho...
--
Didi