Re: ioemu: empty vnc passwd

["Daniel P. Berrange" <berrange@redhat.com>]

On Wed, Jan 23, 2008 at 05:19:33PM +0100, Christoph Egger wrote:
> 
> If we do a debug build let us assume we are in a testing environment.
> There an empty vnc password is ok.
> If we don't make a debug build, let us assume we are in a production 
> environment where an empty vnc password is a security risk.

That logic is flawed. VNC may be configured to use TLS +x509 certificates
which provide real security. A VNC passwd is not really very credible 
security whether its zero or 8 chars in length. It shouldn't try to
second guess what an admin wants. 

VNC password authentication is turned on / off via the ',passwd' flag on
the -vnc command line to QEMU. If password auth is on, and a zero length 
string is found as a password, then all logins are completely disabled - 
the VNC password auth code will fail all logins. If passwd auth is off on 
the  command line, then any password stored in xenstore is irrelevant, no
matter what length it is.

Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=|