From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:33370) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQ375-0005Bw-1r for qemu-devel@nongnu.org; Thu, 03 May 2012 16:59:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SQ373-0006q9-8C for qemu-devel@nongnu.org; Thu, 03 May 2012 16:58:58 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40972) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQ372-0006nd-Uv for qemu-devel@nongnu.org; Thu, 03 May 2012 16:58:57 -0400 From: Paul Moore Date: Thu, 03 May 2012 16:58:52 -0400 Message-ID: <1680205.S7OzsbRalt@sifl> In-Reply-To: References: <20120502193256.6508.86360.stgit@sifl> <20120503090937.GI24747@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Subject: Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Alexander Graf Cc: qemu-devel@nongnu.org On Thursday, May 03, 2012 11:11:16 AM Alexander Graf wrote: > On 03.05.2012, at 11:09, Daniel P. Berrange wrote: > > On Thu, May 03, 2012 at 11:06:18AM +0200, Alexander Graf wrote: > >> On 03.05.2012, at 11:03, Daniel P. Berrange wrote: > >>> On Thu, May 03, 2012 at 11:01:29AM +0200, Alexander Graf wrote: > >>>> On 03.05.2012, at 10:57, Daniel P. Berrange wrote: > >>>>> On Thu, May 03, 2012 at 10:51:15AM +0200, Alexander Graf wrote: > >>>>>> On 03.05.2012, at 10:29, Daniel P. Berrange wrote: > >>>>>>> On Wed, May 02, 2012 at 03:32:56PM -0400, Paul Moore wrote: > >>>>>>>> FIPS 140-2 requires disabling certain ciphers, including DES, which > >>>>>>>> is used > >>>>>>>> by VNC to obscure passwords when they are sent over the network. > >>>>>>>> The > >>>>>>>> solution for FIPS users is to disable the use of VNC password auth > >>>>>>>> when the > >>>>>>>> host system is operating in FIPS mode. > >>>>>> > >>>>>> So that means "no password" is more secure according to FIPS than > >>>>>> "DES encrypted password"? > >>>>> > >>>>> No, FIPS is not making statements about the choice of auth methods. > >>>>> FIPS is concerned with what encryption algorithms an application uses. > >>>>> The requirements about whether authentication is required & what sort, > >>>>> is upto other specifications (eg Common Criteria) to decide. > >>>> > >>>> Hrm, so short-term this fixes things. But long-term, I think the > >>>> better solution would be to implement the tight security model and > >>> > >>>> use a real cipher: > >>> That is certainly possible, but shouldn't have any bearing on whether > >>> this patch is accepted. Note that QEMU already implements VeNCrypt > >>> and SASL extensions both of which provide strong security > >> > >> Hmm. Isn't the syslog message misleading then? Also, why would the > >> whole password parameter be blocked then? > > > > The password parameter is irrelevant for VeNCrypt & SASL authentication > > types. They are configured via other parameters. > > Ah, an error message hinting to the alternatives would be nice then :). Fair enough. I'll make the stderr notice suggest both VeNCrypt and SASL. -- paul moore security and virtualization @ redhat