Re: ioemu: empty vnc passwd

["Daniel P. Berrange" <berrange@redhat.com>]

On Wed, Jan 23, 2008 at 05:36:07PM +0100, Christoph Egger wrote:
> On Wednesday 23 January 2008 17:28:11 Daniel P. Berrange wrote:
> > On Wed, Jan 23, 2008 at 05:19:33PM +0100, Christoph Egger wrote:
> > > If we do a debug build let us assume we are in a testing environment.
> > > There an empty vnc password is ok.
> > > If we don't make a debug build, let us assume we are in a production
> > > environment where an empty vnc password is a security risk.
> >
> > That logic is flawed. VNC may be configured to use TLS +x509 certificates
> > which provide real security. A VNC passwd is not really very credible
> > security whether its zero or 8 chars in length. It shouldn't try to
> > second guess what an admin wants.
> 
> That's right. vnc-auth is nothing. TLS (vnc security type 18) and
> Tight (vnc security type 16) are much better.

Not really - the TLS auth scheme merely uses anonymous credentials, so while
the data stream is encrypted, it is susceptible to trivial MITM attack at
the time of connection setup.  QEMU implements the VeNCrypt security type
which uses TLS with x509 certificates, and will also optionally mandate that
the client presents their own certificate upon connecting.  This is supported
by virt-manager, vinagre, vencrypt's vncviewer and any client using GTK-VNC

See the QEMU docs for how this is all configured

   http://fabrice.bellard.free.fr/qemu/qemu-doc.html#SEC36

As for the Tight auth type, I've no idea what that does, but its not
implemented in current tightvnc releases - they only support the flawed
DES vnc password auth:

   http://www.tightvnc.com/faq.html#howsecure

  "Although TightVNC encrypts VNC passwords sent over the net, the rest 
   of the traffic is sent as is, unencrypted (for password encryption, 
   VNC uses a DES-encrypted challenge-response scheme, where the password 
   is limited by 8 characters, and the effective DES key length is 56 bits).
   So using TightVNC over the Internet can be a security risk"

Regards,
Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=|