AWS dcv documentation change
Summary
Added macOS-specific instructions for configuring external authentication server and reorganized Windows/macOS sections. Updated Linux PAM reference to include macOS.
Security assessment
The changes document authentication configuration processes which are security-related features, but there's no evidence of addressing a specific vulnerability. The macOS additions expand platform coverage for existing security controls without indicating a prior security gap.
Diff
diff --git a/dcv/latest/adminguide/external-authentication.md b/dcv/latest/adminguide/external-authentication.md index f23a22a84..062da291f 100644 --- a//dcv/latest/adminguide/external-authentication.md +++ b//dcv/latest/adminguide/external-authentication.md @@ -9 +9 @@ Amazon DCV Server ConfigurationUsing the TokenAuthentication service requirement -By default, Amazon DCV client authentication is delegated to the underlying operating system. With Windows Amazon DCV servers, authentication is delegated to WinLogon. With Linux Amazon DCV servers, authentication is delegated to Linux PAM. +By default, Amazon DCV client authentication is delegated to the underlying operating system. With Windows Amazon DCV servers, authentication is delegated to WinLogon. With Linux and macOS Amazon DCV servers, authentication is delegated to Linux PAM. @@ -42,0 +43,26 @@ You must configure the Amazon DCV server to use the external authentication serv +Windows Amazon DCV server + + +###### To specify an external authentication server on Windows + + 1. Open the Windows Registry Editor. + + 2. Navigate to the **HKEY_USERS\S-1-5-18\Software\GSettings\com\nicesoftware\dcv\** key. + + 3. Locate the **auth-token-verifier** parameter in the [security Parameters](./config-param-ref.html#security). + + 4. Do one of the following: + + * For **Value data** , enter the URL of the external authentication server and the port over which to communicate, in the following format: ``url`:`port``. + +For example, if you're using the DcvSimpleExternalAuthenticator, specify the following: ``http://127.0.0.1`:`8444``. + + * If there is no **auth-token-verifier** parameter in the security section, add it in the PowerShell. Refer to [ Modifying Configuration Parameters](https://docs.aws.amazon.com/dcv/latest/adminguide/config-param-ref-modify.html). + + 5. Close the Windows Registry Editor. + + 6. [Stop](./manage-stop.html) and [restart](./manage-start.html) the Amazon DCV server. + + + + @@ -61,6 +87 @@ If there is no `auth-token-verifier` parameter in the `[security]` section, add -Windows Amazon DCV server - - -###### To specify an external authentication server on Windows - - 1. Open the Windows Registry Editor. +macOS Amazon DCV server @@ -68 +88,0 @@ Windows Amazon DCV server - 2. Navigate to the **HKEY_USERS\S-1-5-18\Software\GSettings\com\nicesoftware\dcv\** key. @@ -70 +90 @@ Windows Amazon DCV server - 3. Locate the **auth-token-verifier** parameter in the [security Parameters](./config-param-ref.html#security). +###### To specify an external authentication server on macOS @@ -72,3 +92 @@ Windows Amazon DCV server - 4. Do one of the following: - - * For **Value data** , enter the URL of the external authentication server and the port over which to communicate, in the following format: ``url`:`port``. + 1. Navigate to `/etc/dcv/` and open the `dcv.conf` with your preferred text editor. @@ -76 +94 @@ Windows Amazon DCV server -For example, if you're using the DcvSimpleExternalAuthenticator, specify the following: ``http://127.0.0.1`:`8444``. + 2. Locate the `auth-token-verifier` parameter in the `[security]` section, and replace the existing value with the URL of the external authentication server and the port over which to communicate, in the following format: ``url`:`port``. For example, if you're using the DcvSimpleExternalAuthenticator, specify the following: ``http://127.0.0.1`:`8444``. @@ -78 +96 @@ For example, if you're using the DcvSimpleExternalAuthenticator, specify the fol - * If there is no **auth-token-verifier** parameter in the security section, add it in the PowerShell. Refer to [ Modifying Configuration Parameters](https://docs.aws.amazon.com/dcv/latest/adminguide/config-param-ref-modify.html). +If there is no `auth-token-verifier` parameter in the `[security]` section, add it manually using the following format: @@ -80 +98 @@ For example, if you're using the DcvSimpleExternalAuthenticator, specify the fol - 5. Close the Windows Registry Editor. + [security] auth-token-verifier=url:port @@ -82 +100 @@ For example, if you're using the DcvSimpleExternalAuthenticator, specify the fol - 6. [Stop](./manage-stop.html) and [restart](./manage-start.html) the Amazon DCV server. + 3. Save and close the file.