Skip to content

lablink_client_service.agent.kasmvnc

KasmVNC password-file rotation.

Two output formats, picked by the client container's CONNECTIVITY env:

  • allocator_proxied (AWS path; default): KasmVNC's username-based .kasmpasswd written by the bundled kasmvncpasswd CLI. The browser never sees credentials; allocator nginx attaches HTTP Basic Auth server-side via /internal/proxy_auth.

  • lan_direct (manual/BYO path): the browser opens the WebSocket straight to ws://<lan_ip>:6080 with no proxy, and modern browsers refuse to attach an Authorization: Basic header to a WebSocket upgrade. So we drop HTTP-Basic on the client (-DisableBasicAuth) and use RFB-protocol VncAuth instead — KasmVNC's bundled noVNC reads ?password= and feeds it through the in-band VNC auth handshake. That requires the legacy RFB password file format: 8 bytes of single-DES-encrypted output, written here without an external vncpasswd tool (KasmVNC's deb doesn't ship one).

The agent re-derives the file each session; no reload signal is needed (KasmVNC re-reads on each connection attempt, and SIGHUP would in fact terminate Xvnc via its unsupported reset path).

Rewrite the KasmVNC password file for this connectivity mode.

See module docstring for the two formats; the choice is driven by the CONNECTIVITY env var (lan_direct ⇒ RFB VncAuth file; anything else, including unset ⇒ KasmVNC BasicAuth file).

Source code in packages/client/src/lablink_client_service/agent/kasmvnc.py 
138
139
140
141
142
143
144
145
146
147
148
def rotate_kasmvnc_password(*, password: str) -> None:
    """Rewrite the KasmVNC password file for this connectivity mode.

    See module docstring for the two formats; the choice is driven by
    the ``CONNECTIVITY`` env var (``lan_direct`` ⇒ RFB VncAuth file;
    anything else, including unset ⇒ KasmVNC BasicAuth file).
    """
    if os.environ.get("CONNECTIVITY") == "lan_direct":
        _rotate_vncauth(password=password)
    else:
        _rotate_basic_auth(password=password)