Re: ioemu: empty vnc passwd

["Daniel P. Berrange" <berrange@redhat.com>]

On Wed, Jan 23, 2008 at 05:38:20PM +0000, John Levon wrote:
> On Wed, Jan 23, 2008 at 05:33:41PM +0000, Daniel P. Berrange wrote:
> 
> > > I'm confused: if there's no config or xend password at all, then the
> > > domain won't start:
> > > 
> > >             if vncpasswd is None:
> > >                 raise VmError('vncpasswd is not setup in vmconfig or '
> > >                               'xend-config.sxp')
> > 
> > Sorry, my bad description - by no xend password, i meant the default
> > xend-config.sxp which is in fact  ''.  Frankly this check above is
> > a waste of time - it should just treat None as ""
> 
> Except on Solaris we don't have such a default - the user's forced to
> set something (there doesn't seem to be even a vaguely secure default?)

There's no sane default for VNC passwords - whether you have on or not
its still basically insecure due to design of the VNC auth, hence the
config just defaults to '' & 127.0.0.1 which is as good as you'll get 
for VNC over TCP. 

If we wanted a real secure out of the box setup, we'd need to make XenD 
only expose the VNC server as a UNIX domain socket, so that access can
be restricted to root. QEMU has this ability already - we simply don't
use it in Xen. Of course no VNC client knows how to connect to a VNC 
server over a UNIX domain socket directly. You can use netcat + ssh to
tunnel to/from a remote host. I could also extend GTK-VNC & virt-manager
and/or virt-viewer to support it pretty easily.

Regards,
Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=|