On Wed, Jan 23, 2008 at 05:36:07PM +0100, Christoph Egger wrote:
> On Wednesday 23 January 2008 17:28:11 Daniel P. Berrange wrote:
> > On Wed, Jan 23, 2008 at 05:19:33PM +0100, Christoph Egger wrote:
> > > If we do a debug build let us assume we are in a testing environment.
> > > There an empty vnc password is ok.
> > > If we don't make a debug build, let us assume we are in a production
> > > environment where an empty vnc password is a security risk.
> >
> > That logic is flawed. VNC may be configured to use TLS +x509 certificates
> > which provide real security. A VNC passwd is not really very credible
> > security whether its zero or 8 chars in length. It shouldn't try to
> > second guess what an admin wants.
>
> That's right. vnc-auth is nothing. TLS (vnc security type 18) and
> Tight (vnc security type 16) are much better.
Not really - the TLS auth scheme merely uses anonymous credentials, so while
the data stream is encrypted, it is susceptible to trivial MITM attack at
the time of connection setup. QEMU implements the VeNCrypt security type
which uses TLS with x509 certificates, and will also optionally mandate that
the client presents their own certificate upon connecting. This is supported
by virt-manager, vinagre, vencrypt's vncviewer and any client using GTK-VNC
See the QEMU docs for how this is all configured
http://fabrice.bellard.free.fr/qemu/qemu-doc.html#SEC36
As for the Tight auth type, I've no idea what that does, but its not
implemented in current tightvnc releases - they only support the flawed
DES vnc password auth:
http://www.tightvnc.com/faq.html#howsecure
"Although TightVNC encrypts VNC passwords sent over the net, the rest
of the traffic is sent as is, unencrypted (for password encryption,
VNC uses a DES-encrypted challenge-response scheme, where the password
is limited by 8 characters, and the effective DES key length is 56 bits).
So using TightVNC over the Internet can be a security risk"
Regards,
Dan.
--
|=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=|
|=- Perl modules: http://search.cpan.org/~danberr/ -=|
|=- Projects: http://freshmeat.net/~danielpb/ -=|
|=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
|
Home