Re: [PATCH][Take 2] VNC authentification

["Daniel P. Berrange" <berrange@redhat.com>]

On Mon, Oct 02, 2006 at 12:24:36PM -0500, Anthony Liguori wrote:
> Daniel P. Berrange wrote:
> >  
> >>--- a/tools/examples/xend-config.sxp	Wed Sep 27 17:49:22 2006 +0100
> >>+++ b/tools/examples/xend-config.sxp	Sun Oct 01 02:13:06 2006 +0900
> >>@@ -130,3 +130,7 @@
> >> 
> >> # The tool used for initiating virtual TPM migration
> >> #(external-migration-tool '')
> >>+
> >>+# The default password for VNC console on HVM domain.
> >>+# Empty string is no authentication.
> >>+(vncpasswd '')
> >>    
> >
> >We should add a note about this needing to be the base-64 encoded, 
> >DES encrypted password, rather than plain text.
> >  
> 
> Why even bother encrypting the password?  We're using a well known DES 
> key so there is no security here.  A user must still take appropriate 
> precautions to protect the config files.  In fact, I think munging the 
> password like this gives a false sense of security.

Yeah, we really need to chmod 700 the /etc/xen directory to protect
the passwords.  Once this is done, there isn't much to be gained 
from encryption in the file itself except for obfuscating it from
the benign casual observer. Using plain text in the config file would
make life easier to tools too, because they won't have to carry about
this VNC-specific DES encryption routine just to create passwds in the
guest config

Dan.
--
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=|