WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] ioemu: empty vnc passwd

On Wed, Jan 23, 2008 at 05:38:20PM +0000, John Levon wrote:
> On Wed, Jan 23, 2008 at 05:33:41PM +0000, Daniel P. Berrange wrote:
> 
> > > I'm confused: if there's no config or xend password at all, then the
> > > domain won't start:
> > > 
> > >             if vncpasswd is None:
> > >                 raise VmError('vncpasswd is not setup in vmconfig or '
> > >                               'xend-config.sxp')
> > 
> > Sorry, my bad description - by no xend password, i meant the default
> > xend-config.sxp which is in fact  ''.  Frankly this check above is
> > a waste of time - it should just treat None as ""
> 
> Except on Solaris we don't have such a default - the user's forced to
> set something (there doesn't seem to be even a vaguely secure default?)

There's no sane default for VNC passwords - whether you have on or not
its still basically insecure due to design of the VNC auth, hence the
config just defaults to '' & 127.0.0.1 which is as good as you'll get 
for VNC over TCP. 

If we wanted a real secure out of the box setup, we'd need to make XenD 
only expose the VNC server as a UNIX domain socket, so that access can
be restricted to root. QEMU has this ability already - we simply don't
use it in Xen. Of course no VNC client knows how to connect to a VNC 
server over a UNIX domain socket directly. You can use netcat + ssh to
tunnel to/from a remote host. I could also extend GTK-VNC & virt-manager
and/or virt-viewer to support it pretty easily.

Regards,
Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel