Re: [Qemu-devel] [PATCH] vnc: disable VNC password authentication (security type 2) when in FIPS mode

[Anthony Liguori <anthony@codemonkey.ws>]

On 05/01/2012 06:43 PM, George Wilson wrote:
>
> Anthony Liguori<anthony@codemonkey.ws>  wrote on 05/01/2012 06:26:05 PM:
>
>> Anthony Liguori<anthony@codemonkey.ws>
>> 05/01/2012 06:26 PM
>>
>> To
>>
>> Paul Moore<pmoore@redhat.com>
>>
>> cc
>>
>> qemu-devel@nongnu.org, George Wilson/Austin/IBM@IBMUS
>>
>> Subject
>>
>> Re: [Qemu-devel] [PATCH] vnc: disable VNC password authentication
>> (security type 2) when in FIPS mode
>>
>> On 05/01/2012 04:20 PM, Paul Moore wrote:
>>> FIPS 140-2 requires disabling certain ciphers, including DES, which is
> used
>>> by VNC to obscure passwords when they are sent over the network.  The
>>> solution for FIPS users is to disable the use of VNC password auth when
> the
>>> host system is operating in FIPS mode.
>>
>> Sorry, what?
>>
>> Does FIPS really require software to detect when FIPS is enabled
> andactively
>> disable features???  That's absurd.
>>
>> Can you point to another software package that does something like this?
>
> Yes, it's true that only FIPS-approved algorithms are permitted for use in
> FIPS
> mode.  The kernel and all other FIPS 140-2 validated crypto modules like
> OpenSSL
> and NSS are required to restrict algorithms to the approved set.  The
> kernel
> sets /proc/sys/crypto/fips_enabled so that programs can detect FIPS mode
> and
> behave in accordance with the standard.

But this is nonsensical. It would allow no-password to be configured for the VNC 
server but not DES?  Why is that okay?  It's not like we enable DES passwords by 
default.  A user has to explicitly configure it.

Is there an open source app that actually keys off of fips_enabled?

Regards,

Anthony Liguori

>
>>
>> Regards,
>>
>> Anthony Liguori
>>
>>>
>>> This patch causes qemu to emits a syslog entry indicating that VNC
> password
>>> auth is disabled when it detects the host is running in FIPS mode, and
>>> unless a VNC password was specified on the command line it continues
>>> normally.  However, if a VNC password was given on the command line,
> qemu
>>> fails with an error message to stderr explaining that that VNC password
>>> auth is not allowed in FIPS mode.
>>>
>>> Signed-off-by: Paul Moore<pmoore@redhat.com>
>>> ---
>>>    qemu-doc.texi |    8 +++++---
>>>    ui/vnc.c      |   32 ++++++++++++++++++++++++++++++++
>>>    ui/vnc.h      |    1 +
>>>    3 files changed, 38 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/qemu-doc.texi b/qemu-doc.texi
>>> index e5d7ac4..f9b113e 100644
>>> --- a/qemu-doc.texi
>>> +++ b/qemu-doc.texi
>>> @@ -1124,9 +1124,11 @@ the protocol limits passwords to 8
>> characters it should not be considered
>>>    to provide high security. The password can be fairly easily
>> brute-forced by
>>>    a client making repeat connections. For this reason, a VNC
>> server using password
>>>    authentication should be restricted to only listen on the
>> loopback interface
>>> -or UNIX domain sockets. Password authentication is requested with
>> the @code{password}
>>> -option, and then once QEMU is running the password is set with
>> the monitor. Until
>>> -the monitor is used to set the password all clients will be rejected.
>>> +or UNIX domain sockets. Password authentication is not supported
>> when operating
>>> +in FIPS 140-2 compliance mode as it requires the use of the DES
>> cipher. Password
>>> +authentication is requested with the @code{password} option, and
>> then once QEMU
>>> +is running the password is set with the monitor. Until the
>> monitor is used to
>>> +set the password all clients will be rejected.
>>>
>>>    @example
>>>    qemu [...OPTIONS...] -vnc :1,password -monitor stdio
>>> diff --git a/ui/vnc.c b/ui/vnc.c
>>> index deb9ecd..620791e 100644
>>> --- a/ui/vnc.c
>>> +++ b/ui/vnc.c
>>> @@ -32,6 +32,7 @@
>>>    #include "acl.h"
>>>    #include "qemu-objects.h"
>>>    #include "qmp-commands.h"
>>> +#include<syslog.h>
>>>
>>>    #define VNC_REFRESH_INTERVAL_BASE 30
>>>    #define VNC_REFRESH_INTERVAL_INC  50
>>> @@ -48,6 +49,24 @@ static DisplayChangeListener *dcl;
>>>    static int vnc_cursor_define(VncState *vs);
>>>    static void vnc_release_modifiers(VncState *vs);
>>>
>>> +static int fips_enabled(void)
>>> +{
>>> +    int enabled = 0;
>>> +    char value;
>>> +    FILE *fds;
>>> +
>>> +    fds = fopen("/proc/sys/crypto/fips_enabled", "r");
>>> +    if (fds == NULL) {
>>> +        return 0;
>>> +    }
>>> +    if (fread(&value, sizeof(value), 1, fds) == 1&&   value == '1') {
>>> +        enabled = 1;
>>> +    }
>>> +    fclose(fds);
>>> +
>>> +    return enabled;
>>> +}
>>> +
>>>    static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
>>>    {
>>>    #ifdef _VNC_DEBUG
>>> @@ -2748,6 +2767,12 @@ void vnc_display_init(DisplayState *ds)
>>>        dcl->idle = 1;
>>>        vnc_display = vs;
>>>
>>> +    vs->fips = fips_enabled();
>>> +    VNC_DEBUG("FIPS mode %s\n", (vs->fips ? "enabled" : "disabled"));
>>> +    if (vs->fips) {
>>> +        syslog(LOG_NOTICE, "Disabling VNC password auth due to
>> FIPS mode\n");
>>> +    }
>>> +
>>>        vs->lsock = -1;
>>>
>>>        vs->ds = ds;
>>> @@ -2892,6 +2917,13 @@ int vnc_display_open(DisplayState *ds,
>> const char *display)
>>>        while ((options = strchr(options, ','))) {
>>>            options++;
>>>            if (strncmp(options, "password", 8) == 0) {
>>> +            if (vs->fips) {
>>> +                fprintf(stderr,
>>> +                        "VNC password auth disabled due to FIPS mode
> \n");
>>> +                g_free(vs->display);
>>> +                vs->display = NULL;
>>> +                return -1;
>>> +            }
>>>                password = 1; /* Require password auth */
>>>            } else if (strncmp(options, "reverse", 7) == 0) {
>>>                reverse = 1;
>>> diff --git a/ui/vnc.h b/ui/vnc.h
>>> index a851ebd..8746a98 100644
>>> --- a/ui/vnc.h
>>> +++ b/ui/vnc.h
>>> @@ -160,6 +160,7 @@ struct VncDisplay
>>>        char *display;
>>>        char *password;
>>>        time_t expires;
>>> +    int fips;
>>>        int auth;
>>>        bool lossy;
>>>        bool non_adaptive;
>>>
>>>
>>>
>>
>
> Regards,
> George Wilson