From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:60786)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pmoore@redhat.com>) id 1SQ338-00048v-7L
	for qemu-devel@nongnu.org; Thu, 03 May 2012 16:54:57 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <pmoore@redhat.com>) id 1SQ336-0005Z5-JG
	for qemu-devel@nongnu.org; Thu, 03 May 2012 16:54:53 -0400
Received: from mx1.redhat.com ([209.132.183.28]:48698)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pmoore@redhat.com>) id 1SQ336-0005Yt-AW
	for qemu-devel@nongnu.org; Thu, 03 May 2012 16:54:52 -0400
From: Paul Moore <pmoore@redhat.com>
Date: Thu, 03 May 2012 16:54:48 -0400
Message-ID: <4548305.DtX99stsJu@sifl>
In-Reply-To: <07DE940E-13C2-47D9-86C7-AA5FD8346C86@suse.de>
References: <20120502193256.6508.86360.stgit@sifl>
	<07DE940E-13C2-47D9-86C7-AA5FD8346C86@suse.de>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Subject: Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password
	authentication (security type 2) when in FIPS mode
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Alexander Graf <agraf@suse.de>
Cc: qemu-devel Developers <qemu-devel@nongnu.org>, Roman Drahtmueller <draht@suse.de>

On Thursday, May 03, 2012 04:54:42 PM Alexander Graf wrote:
> On 02.05.2012, at 21:32, Paul Moore wrote:
> > FIPS 140-2 requires disabling certain ciphers, including DES, which is
> > used
> > by VNC to obscure passwords when they are sent over the network.  The
> > solution for FIPS users is to disable the use of VNC password auth when
> > the
> > host system is operating in FIPS mode.
> > 
> > This patch causes qemu to emit a syslog entry indicating that VNC password
> > auth is disabled when it detects the host is running in FIPS mode, and
> > unless a VNC password was specified on the command line it continues
> > normally.  However, if a VNC password was given on the command line, qemu
> > fails with an error message to stderr explaining that VNC password auth is
> > not allowed in FIPS mode.
> 
> I just talked to Roman about this one and he had some comments :)

I'm sure he did :)

-- 
paul moore
security and virtualization @ redhat