* [Qemu-devel] [PATCH 0/3] vnc/spice: add monitor command to change password.
@ 2010-10-07 11:15 Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 1/3] vnc: auth reject cleanup Gerd Hoffmann
` (2 more replies)
0 siblings, 3 replies; 14+ messages in thread
From: Gerd Hoffmann @ 2010-10-07 11:15 UTC (permalink / raw)
To: qemu-devel; +Cc: Gerd Hoffmann
Hi,
This patch series adds a new monitor command to set the password with
optional expiry time for spice and vnc remote desktop connections.
The patches are also available in the git repository at:
git://anongit.freedesktop.org/spice/qemu passwd.1
Gerd Hoffmann (3):
vnc: auth reject cleanup
vnc: support password expire
vnc/spice: add set_passwd monitor command.
console.h | 2 +-
hmp-commands.hx | 23 ++++++++++++++++++++
monitor.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
ui/qemu-spice.h | 3 ++
ui/spice-core.c | 7 ++++++
ui/vnc.c | 43 +++++++++++++++++++++++---------------
ui/vnc.h | 1 +
7 files changed, 120 insertions(+), 20 deletions(-)
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Qemu-devel] [PATCH 1/3] vnc: auth reject cleanup
2010-10-07 11:15 [Qemu-devel] [PATCH 0/3] vnc/spice: add monitor command to change password Gerd Hoffmann
@ 2010-10-07 11:15 ` Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 2/3] vnc: support password expire Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 3/3] vnc/spice: add set_passwd monitor command Gerd Hoffmann
2 siblings, 0 replies; 14+ messages in thread
From: Gerd Hoffmann @ 2010-10-07 11:15 UTC (permalink / raw)
To: qemu-devel; +Cc: Gerd Hoffmann
protocol_client_auth_vnc() has two places where the auth can fail,
with identical code sending the reject message to the client.
Move the common code to the end of the function and make both
error paths jump there. No functional change.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
ui/vnc.c | 30 +++++++++++++-----------------
1 files changed, 13 insertions(+), 17 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index c7a1831..1ef0fc5 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2081,15 +2081,7 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
if (!vs->vd->password || !vs->vd->password[0]) {
VNC_DEBUG("No password configured on server");
- vnc_write_u32(vs, 1); /* Reject auth */
- if (vs->minor >= 8) {
- static const char err[] = "Authentication failed";
- vnc_write_u32(vs, sizeof(err));
- vnc_write(vs, err, sizeof(err));
- }
- vnc_flush(vs);
- vnc_client_error(vs);
- return 0;
+ goto reject;
}
memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
@@ -2105,14 +2097,7 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
/* Compare expected vs actual challenge response */
if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
VNC_DEBUG("Client challenge reponse did not match\n");
- vnc_write_u32(vs, 1); /* Reject auth */
- if (vs->minor >= 8) {
- static const char err[] = "Authentication failed";
- vnc_write_u32(vs, sizeof(err));
- vnc_write(vs, err, sizeof(err));
- }
- vnc_flush(vs);
- vnc_client_error(vs);
+ goto reject;
} else {
VNC_DEBUG("Accepting VNC challenge response\n");
vnc_write_u32(vs, 0); /* Accept auth */
@@ -2121,6 +2106,17 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
start_client_init(vs);
}
return 0;
+
+reject:
+ vnc_write_u32(vs, 1); /* Reject auth */
+ if (vs->minor >= 8) {
+ static const char err[] = "Authentication failed";
+ vnc_write_u32(vs, sizeof(err));
+ vnc_write(vs, err, sizeof(err));
+ }
+ vnc_flush(vs);
+ vnc_client_error(vs);
+ return 0;
}
void start_auth_vnc(VncState *vs)
--
1.7.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-10-07 11:15 [Qemu-devel] [PATCH 0/3] vnc/spice: add monitor command to change password Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 1/3] vnc: auth reject cleanup Gerd Hoffmann
@ 2010-10-07 11:15 ` Gerd Hoffmann
2010-10-07 19:53 ` Anthony Liguori
2010-10-07 11:15 ` [Qemu-devel] [PATCH 3/3] vnc/spice: add set_passwd monitor command Gerd Hoffmann
2 siblings, 1 reply; 14+ messages in thread
From: Gerd Hoffmann @ 2010-10-07 11:15 UTC (permalink / raw)
To: qemu-devel; +Cc: Gerd Hoffmann
This patch adds support for expiring passwords to vnc. It adds a new
lifetime parameter to the vnc_display_password() function, which
specifies the number of seconds the new password will be valid. Passing
zero as lifetime maintains current behavior (password never expires).
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
console.h | 2 +-
monitor.c | 3 +--
ui/vnc.c | 15 ++++++++++++++-
ui/vnc.h | 1 +
4 files changed, 17 insertions(+), 4 deletions(-)
diff --git a/console.h b/console.h
index aafb031..24670e5 100644
--- a/console.h
+++ b/console.h
@@ -368,7 +368,7 @@ void cocoa_display_init(DisplayState *ds, int full_screen);
void vnc_display_init(DisplayState *ds);
void vnc_display_close(DisplayState *ds);
int vnc_display_open(DisplayState *ds, const char *display);
-int vnc_display_password(DisplayState *ds, const char *password);
+int vnc_display_password(DisplayState *ds, const char *password, int lifetime);
void do_info_vnc_print(Monitor *mon, const QObject *data);
void do_info_vnc(Monitor *mon, QObject **ret_data);
char *vnc_display_local_addr(DisplayState *ds);
diff --git a/monitor.c b/monitor.c
index fbb678d..d82eb9e 100644
--- a/monitor.c
+++ b/monitor.c
@@ -966,11 +966,10 @@ static int do_quit(Monitor *mon, const QDict *qdict, QObject **ret_data)
static int change_vnc_password(const char *password)
{
- if (vnc_display_password(NULL, password) < 0) {
+ if (vnc_display_password(NULL, password, 0) < 0) {
qerror_report(QERR_SET_PASSWD_FAILED);
return -1;
}
-
return 0;
}
diff --git a/ui/vnc.c b/ui/vnc.c
index 1ef0fc5..51aa9ca 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2078,11 +2078,19 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
int i, j, pwlen;
unsigned char key[8];
+ time_t now;
if (!vs->vd->password || !vs->vd->password[0]) {
VNC_DEBUG("No password configured on server");
goto reject;
}
+ if (vs->vd->expires) {
+ time(&now);
+ if (vs->vd->expires < now) {
+ VNC_DEBUG("Password is expired");
+ goto reject;
+ }
+ }
memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
@@ -2474,7 +2482,7 @@ void vnc_display_close(DisplayState *ds)
#endif
}
-int vnc_display_password(DisplayState *ds, const char *password)
+int vnc_display_password(DisplayState *ds, const char *password, int lifetime)
{
VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
@@ -2492,6 +2500,11 @@ int vnc_display_password(DisplayState *ds, const char *password)
if (vs->auth == VNC_AUTH_NONE) {
vs->auth = VNC_AUTH_VNC;
}
+ if (lifetime) {
+ vs->expires = time(NULL) + lifetime;
+ } else {
+ vs->expires = 0;
+ }
} else {
vs->auth = VNC_AUTH_NONE;
}
diff --git a/ui/vnc.h b/ui/vnc.h
index 9619b24..4f895be 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -120,6 +120,7 @@ struct VncDisplay
char *display;
char *password;
+ time_t expires;
int auth;
bool lossy;
#ifdef CONFIG_VNC_TLS
--
1.7.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [Qemu-devel] [PATCH 3/3] vnc/spice: add set_passwd monitor command.
2010-10-07 11:15 [Qemu-devel] [PATCH 0/3] vnc/spice: add monitor command to change password Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 1/3] vnc: auth reject cleanup Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 2/3] vnc: support password expire Gerd Hoffmann
@ 2010-10-07 11:15 ` Gerd Hoffmann
2 siblings, 0 replies; 14+ messages in thread
From: Gerd Hoffmann @ 2010-10-07 11:15 UTC (permalink / raw)
To: qemu-devel; +Cc: Gerd Hoffmann
This patch adds a new set_password monitor command which allows to
change the password for spice and vnc connections. See the doc update
patch chunk for details.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
hmp-commands.hx | 23 +++++++++++++++++++++
monitor.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
ui/qemu-spice.h | 3 ++
ui/spice-core.c | 7 ++++++
4 files changed, 91 insertions(+), 0 deletions(-)
diff --git a/hmp-commands.hx b/hmp-commands.hx
index 81999aa..a972b80 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1116,6 +1116,29 @@ Set the encrypted device @var{device} password to @var{password}
ETEXI
{
+ .name = "set_password",
+ .args_type = "protocol:s,password:s,expiration:i,connected:s?",
+ .params = "protocol password expiration action-if-connected",
+ .help = "set spice/vnc password",
+ .user_print = monitor_user_noop,
+ .mhandler.cmd_new = set_password,
+ },
+
+STEXI
+@item set_password [ vnc | spice ] password expiration [ action-if-connected ]
+@findex set_password
+
+Change spice/vnc password. @var{expiration} specifies the number of
+seconds the password will stay valid. Use zero to make the password
+stay valid forever. @var{action-if-connected} specifies what should
+happen in case a connection is established: @var{fail} makes the
+password change fail. @var{disconnect} changes the password and
+disconnects the client. @var{keep} changes the password and keeps the
+connection up. @var{keep} is the default.
+
+ETEXI
+
+ {
.name = "info",
.args_type = "item:s?",
.params = "[subcommand]",
diff --git a/monitor.c b/monitor.c
index d82eb9e..32a20ba 100644
--- a/monitor.c
+++ b/monitor.c
@@ -34,6 +34,7 @@
#include "net.h"
#include "net/slirp.h"
#include "qemu-char.h"
+#include "ui/qemu-spice.h"
#include "sysemu.h"
#include "monitor.h"
#include "readline.h"
@@ -1021,6 +1022,63 @@ static int do_change(Monitor *mon, const QDict *qdict, QObject **ret_data)
return ret;
}
+static int set_password(Monitor *mon, const QDict *qdict, QObject **ret_data)
+{
+ const char *protocol = qdict_get_str(qdict, "protocol");
+ const char *password = qdict_get_str(qdict, "password");
+ const char *connected = qdict_get_try_str(qdict, "connected");
+ int lifetime = qdict_get_int(qdict, "expiration");
+ int disconnect_if_connected = 0;
+ int fail_if_connected = 0;
+ int rc;
+
+ if (connected) {
+ if (strcmp(connected, "fail") == 0) {
+ fail_if_connected = 1;
+ } else if (strcmp(connected, "disconnect") == 0) {
+ disconnect_if_connected = 1;
+ } else if (strcmp(connected, "keep") == 0) {
+ /* nothing */
+ } else {
+ qerror_report(QERR_INVALID_PARAMETER, "connected");
+ return -1;
+ }
+ }
+
+ if (strcmp(protocol, "spice") == 0) {
+ if (!using_spice) {
+ /* correct one? spice isn't a device ,,, */
+ qerror_report(QERR_DEVICE_NOT_ACTIVE, "spice");
+ return -1;
+ }
+ rc = qemu_spice_set_passwd(password, lifetime,
+ fail_if_connected,
+ disconnect_if_connected);
+ if (rc != 0) {
+ qerror_report(QERR_SET_PASSWD_FAILED);
+ return -1;
+ }
+ return 0;
+ }
+
+ if (strcmp(protocol, "vnc") == 0) {
+ if (fail_if_connected || disconnect_if_connected) {
+ /* vnc supports "connected=keep" only */
+ qerror_report(QERR_INVALID_PARAMETER, "connected");
+ return -1;
+ }
+ rc = vnc_display_password(NULL, password, lifetime);
+ if (rc != 0) {
+ qerror_report(QERR_SET_PASSWD_FAILED);
+ return -1;
+ }
+ return 0;
+ }
+
+ qerror_report(QERR_INVALID_PARAMETER, "protocol");
+ return -1;
+}
+
static int do_screen_dump(Monitor *mon, const QDict *qdict, QObject **ret_data)
{
vga_hw_screen_dump(qdict_get_str(qdict, "filename"));
diff --git a/ui/qemu-spice.h b/ui/qemu-spice.h
index 063c7dc..0e6e748 100644
--- a/ui/qemu-spice.h
+++ b/ui/qemu-spice.h
@@ -31,10 +31,13 @@ void qemu_spice_init(void);
void qemu_spice_input_init(void);
void qemu_spice_display_init(DisplayState *ds);
int qemu_spice_add_interface(SpiceBaseInstance *sin);
+int qemu_spice_set_passwd(const char *passwd, int lifetime,
+ bool fail_if_connected, bool disconnect_if_connected);
#else /* CONFIG_SPICE */
#define using_spice 0
+#define qemu_spice_set_passwd(_p, _l, _f1, _f2) (-1)
#endif /* CONFIG_SPICE */
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 8b5e4a8..6d30755 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -176,6 +176,13 @@ int qemu_spice_add_interface(SpiceBaseInstance *sin)
return spice_server_add_interface(spice_server, sin);
}
+int qemu_spice_set_passwd(const char *passwd, int lifetime,
+ bool fail_if_connected, bool disconnect_if_connected)
+{
+ return spice_server_set_ticket(spice_server, passwd, lifetime,
+ fail_if_connected, disconnect_if_connected);
+}
+
static void spice_register_config(void)
{
qemu_add_opts(&qemu_spice_opts);
--
1.7.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-10-07 11:15 ` [Qemu-devel] [PATCH 2/3] vnc: support password expire Gerd Hoffmann
@ 2010-10-07 19:53 ` Anthony Liguori
2010-10-08 10:08 ` Daniel P. Berrange
0 siblings, 1 reply; 14+ messages in thread
From: Anthony Liguori @ 2010-10-07 19:53 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-devel
On 10/07/2010 06:15 AM, Gerd Hoffmann wrote:
> This patch adds support for expiring passwords to vnc. It adds a new
> lifetime parameter to the vnc_display_password() function, which
> specifies the number of seconds the new password will be valid. Passing
> zero as lifetime maintains current behavior (password never expires).
>
> Signed-off-by: Gerd Hoffmann<kraxel@redhat.com>
>
This has been posted before and I've never understood it. Why can't a
management tool just expire passwords on it's own?
How does password expiration help with security at all?
Regards,
Anthony Liguori
> ---
> console.h | 2 +-
> monitor.c | 3 +--
> ui/vnc.c | 15 ++++++++++++++-
> ui/vnc.h | 1 +
> 4 files changed, 17 insertions(+), 4 deletions(-)
>
> diff --git a/console.h b/console.h
> index aafb031..24670e5 100644
> --- a/console.h
> +++ b/console.h
> @@ -368,7 +368,7 @@ void cocoa_display_init(DisplayState *ds, int full_screen);
> void vnc_display_init(DisplayState *ds);
> void vnc_display_close(DisplayState *ds);
> int vnc_display_open(DisplayState *ds, const char *display);
> -int vnc_display_password(DisplayState *ds, const char *password);
> +int vnc_display_password(DisplayState *ds, const char *password, int lifetime);
> void do_info_vnc_print(Monitor *mon, const QObject *data);
> void do_info_vnc(Monitor *mon, QObject **ret_data);
> char *vnc_display_local_addr(DisplayState *ds);
> diff --git a/monitor.c b/monitor.c
> index fbb678d..d82eb9e 100644
> --- a/monitor.c
> +++ b/monitor.c
> @@ -966,11 +966,10 @@ static int do_quit(Monitor *mon, const QDict *qdict, QObject **ret_data)
>
> static int change_vnc_password(const char *password)
> {
> - if (vnc_display_password(NULL, password)< 0) {
> + if (vnc_display_password(NULL, password, 0)< 0) {
> qerror_report(QERR_SET_PASSWD_FAILED);
> return -1;
> }
> -
> return 0;
> }
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 1ef0fc5..51aa9ca 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -2078,11 +2078,19 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
> unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
> int i, j, pwlen;
> unsigned char key[8];
> + time_t now;
>
> if (!vs->vd->password || !vs->vd->password[0]) {
> VNC_DEBUG("No password configured on server");
> goto reject;
> }
> + if (vs->vd->expires) {
> + time(&now);
> + if (vs->vd->expires< now) {
> + VNC_DEBUG("Password is expired");
> + goto reject;
> + }
> + }
>
> memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
>
> @@ -2474,7 +2482,7 @@ void vnc_display_close(DisplayState *ds)
> #endif
> }
>
> -int vnc_display_password(DisplayState *ds, const char *password)
> +int vnc_display_password(DisplayState *ds, const char *password, int lifetime)
> {
> VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
>
> @@ -2492,6 +2500,11 @@ int vnc_display_password(DisplayState *ds, const char *password)
> if (vs->auth == VNC_AUTH_NONE) {
> vs->auth = VNC_AUTH_VNC;
> }
> + if (lifetime) {
> + vs->expires = time(NULL) + lifetime;
> + } else {
> + vs->expires = 0;
> + }
> } else {
> vs->auth = VNC_AUTH_NONE;
> }
> diff --git a/ui/vnc.h b/ui/vnc.h
> index 9619b24..4f895be 100644
> --- a/ui/vnc.h
> +++ b/ui/vnc.h
> @@ -120,6 +120,7 @@ struct VncDisplay
>
> char *display;
> char *password;
> + time_t expires;
> int auth;
> bool lossy;
> #ifdef CONFIG_VNC_TLS
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-10-07 19:53 ` Anthony Liguori
@ 2010-10-08 10:08 ` Daniel P. Berrange
2010-11-02 11:15 ` Gerd Hoffmann
2010-11-10 15:50 ` Anthony Liguori
0 siblings, 2 replies; 14+ messages in thread
From: Daniel P. Berrange @ 2010-10-08 10:08 UTC (permalink / raw)
To: Anthony Liguori; +Cc: Gerd Hoffmann, qemu-devel
On Thu, Oct 07, 2010 at 02:53:05PM -0500, Anthony Liguori wrote:
> On 10/07/2010 06:15 AM, Gerd Hoffmann wrote:
> >This patch adds support for expiring passwords to vnc. It adds a new
> >lifetime parameter to the vnc_display_password() function, which
> >specifies the number of seconds the new password will be valid. Passing
> >zero as lifetime maintains current behavior (password never expires).
> >
> >Signed-off-by: Gerd Hoffmann<kraxel@redhat.com>
> >
>
> This has been posted before and I've never understood it. Why can't a
> management tool just expire passwords on it's own?
If the management tool crashes or is restarted for some reason
then it may miss the expiry task.
> How does password expiration help with security at all?
VNC passwords are obviously rather weak, so if you can limit
the time the password is valid to the window in which you
are expecting the incoming VNC connection this limits the
time to attack the VNC password. A mgmt tool could do
- Set a VNC password
- Open the VNC connection
- Clear the VNC password
If anything goes wrong in the mgmt tool at step 2 though,
then it may never to step 3, leaving the VNC server accessible.
If it had set a password expiry at step 1, it would have a
safety net that guarentees the password will be invalid after
'n' seconds, even if not explicitly cleared. Given how little
code this is in QEMU, I think it is a worthwhile feature.
Regards,
Daniel
--
|: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-10-08 10:08 ` Daniel P. Berrange
@ 2010-11-02 11:15 ` Gerd Hoffmann
2010-11-09 13:42 ` Gerd Hoffmann
2010-11-10 15:50 ` Anthony Liguori
1 sibling, 1 reply; 14+ messages in thread
From: Gerd Hoffmann @ 2010-11-02 11:15 UTC (permalink / raw)
To: Daniel P. Berrange; +Cc: qemu-devel
Hi,
>> How does password expiration help with security at all?
>
> VNC passwords are obviously rather weak, so if you can limit
> the time the password is valid to the window in which you
> are expecting the incoming VNC connection this limits the
> time to attack the VNC password. A mgmt tool could do
>
> - Set a VNC password
> - Open the VNC connection
> - Clear the VNC password
>
> If anything goes wrong in the mgmt tool at step 2 though,
> then it may never to step 3, leaving the VNC server accessible.
> If it had set a password expiry at step 1, it would have a
> safety net that guarentees the password will be invalid after
> 'n' seconds, even if not explicitly cleared. Given how little
> code this is in QEMU, I think it is a worthwhile feature.
Anthony? Do you agree? If so I have a updated tree to pull from for
you (rebased to latest master, added sign-offs, otherwise unmodified).
thanks,
Gerd
The following changes since commit 7d72e76228351d18a856f1e4f5365b59d3205dc3:
intel-hda: documentation update (2010-11-02 00:41:04 +0300)
are available in the git repository at:
git://anongit.freedesktop.org/spice/qemu passwd.2
Gerd Hoffmann (3):
vnc: auth reject cleanup
vnc: support password expire
vnc/spice: add set_passwd monitor command.
console.h | 2 +-
hmp-commands.hx | 23 ++++++++++++++++++++
monitor.c | 61
+++++++++++++++++++++++++++++++++++++++++++++++++++++-
ui/qemu-spice.h | 3 ++
ui/spice-core.c | 7 ++++++
ui/vnc.c | 43 +++++++++++++++++++++++---------------
ui/vnc.h | 1 +
7 files changed, 120 insertions(+), 20 deletions(-)
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-11-02 11:15 ` Gerd Hoffmann
@ 2010-11-09 13:42 ` Gerd Hoffmann
2010-11-10 15:52 ` Anthony Liguori
0 siblings, 1 reply; 14+ messages in thread
From: Gerd Hoffmann @ 2010-11-09 13:42 UTC (permalink / raw)
To: Daniel P. Berrange; +Cc: qemu-devel
On 11/02/10 12:15, Gerd Hoffmann wrote:
> Hi,
>
>>> How does password expiration help with security at all?
>>
>> VNC passwords are obviously rather weak, so if you can limit
>> the time the password is valid to the window in which you
>> are expecting the incoming VNC connection this limits the
>> time to attack the VNC password. A mgmt tool could do
>>
>> - Set a VNC password
>> - Open the VNC connection
>> - Clear the VNC password
>>
>> If anything goes wrong in the mgmt tool at step 2 though,
>> then it may never to step 3, leaving the VNC server accessible.
>> If it had set a password expiry at step 1, it would have a
>> safety net that guarentees the password will be invalid after
>> 'n' seconds, even if not explicitly cleared. Given how little
>> code this is in QEMU, I think it is a worthwhile feature.
>
> Anthony? Do you agree? If so I have a updated tree to pull from for you
> (rebased to latest master, added sign-offs, otherwise unmodified).
[ ... ]
> are available in the git repository at:
> git://anongit.freedesktop.org/spice/qemu passwd.2
Ping? What is the status here?
cheers,
Gerd
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-10-08 10:08 ` Daniel P. Berrange
2010-11-02 11:15 ` Gerd Hoffmann
@ 2010-11-10 15:50 ` Anthony Liguori
2010-11-11 11:39 ` Gerd Hoffmann
1 sibling, 1 reply; 14+ messages in thread
From: Anthony Liguori @ 2010-11-10 15:50 UTC (permalink / raw)
To: Daniel P. Berrange; +Cc: Gerd Hoffmann, qemu-devel
On 10/08/2010 05:08 AM, Daniel P. Berrange wrote:
> On Thu, Oct 07, 2010 at 02:53:05PM -0500, Anthony Liguori wrote:
>
>> On 10/07/2010 06:15 AM, Gerd Hoffmann wrote:
>>
>>> This patch adds support for expiring passwords to vnc. It adds a new
>>> lifetime parameter to the vnc_display_password() function, which
>>> specifies the number of seconds the new password will be valid. Passing
>>> zero as lifetime maintains current behavior (password never expires).
>>>
>>> Signed-off-by: Gerd Hoffmann<kraxel@redhat.com>
>>>
>>>
>> This has been posted before and I've never understood it. Why can't a
>> management tool just expire passwords on it's own?
>>
> If the management tool crashes or is restarted for some reason
> then it may miss the expiry task.
>
>
>> How does password expiration help with security at all?
>>
> VNC passwords are obviously rather weak, so if you can limit
> the time the password is valid to the window in which you
> are expecting the incoming VNC connection this limits the
> time to attack the VNC password. A mgmt tool could do
>
> - Set a VNC password
> - Open the VNC connection
> - Clear the VNC password
>
> If anything goes wrong in the mgmt tool at step 2 though,
> then it may never to step 3, leaving the VNC server accessible.
>
I think the point is that you can expire the password by just changing
it through the monitor. Having an expiration policy builtin to QEMU (as
opposed to libvirt) seems like the wrong place.
> If it had set a password expiry at step 1, it would have a
> safety net that guarentees the password will be invalid after
> 'n' seconds, even if not explicitly cleared. Given how little
> code this is in QEMU, I think it is a worthwhile feature.\
>
It's a policy not a mechanism and I don't see a good reason to have the
code in QEMU because it honestly is a policy for a specific product. I
don't think it's a strong enough policy that it's going to be seen as
widely useful.
Regards,
Anthony Liguori
> Regards,
> Daniel
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-11-09 13:42 ` Gerd Hoffmann
@ 2010-11-10 15:52 ` Anthony Liguori
0 siblings, 0 replies; 14+ messages in thread
From: Anthony Liguori @ 2010-11-10 15:52 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-devel
On 11/09/2010 07:42 AM, Gerd Hoffmann wrote:
>> are available in the git repository at:
>> git://anongit.freedesktop.org/spice/qemu passwd.2
>
> Ping? What is the status here?
My view is that it's wrong for QEMU because it's a specific management
policy that isn't generally useful. It can be easily implemented
outside of QEMU.
Of course, if both you and Dan disagree strongly, since this is so
little code, I'll leave the final decision up to you.
Regards,
Anthony Liguori
> cheers,
> Gerd
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-11-10 15:50 ` Anthony Liguori
@ 2010-11-11 11:39 ` Gerd Hoffmann
2010-11-16 20:26 ` Anthony Liguori
0 siblings, 1 reply; 14+ messages in thread
From: Gerd Hoffmann @ 2010-11-11 11:39 UTC (permalink / raw)
To: Anthony Liguori; +Cc: qemu-devel
Hi,
>> If anything goes wrong in the mgmt tool at step 2 though,
>> then it may never to step 3, leaving the VNC server accessible.
>
> I think the point is that you can expire the password by just changing
> it through the monitor.
Well, you can't really expire it, you can only set it to $randomvalue.
Unsetting the vnc password also disables authentication (in unstable),
which is *not* what you want here ...
> Having an expiration policy builtin to QEMU (as
> opposed to libvirt) seems like the wrong place.
IMHO it doesn't build policy into qemu. It is still up to libvirt (or
the management app building on top of libvirt) to decide if and when the
password will expire. qemu will just do what libvirt asks for.
Instead of passing a expire time as implemented by the patches:
set-password $protocol $secret $time
we could add a expire-password command, then ask management to do
set-password $protocol $secret
[ let $time pass ]
expire-password $protocol
I fail to see why this is better though. The former is more robust and
easier to implement in the management. The amount of code needed in
qemu is probably quite similar ...
cheers,
Gerd
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-11-11 11:39 ` Gerd Hoffmann
@ 2010-11-16 20:26 ` Anthony Liguori
2010-11-17 10:23 ` Gerd Hoffmann
0 siblings, 1 reply; 14+ messages in thread
From: Anthony Liguori @ 2010-11-16 20:26 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-devel
On 11/11/2010 05:39 AM, Gerd Hoffmann wrote:
> Hi,
>
>>> If anything goes wrong in the mgmt tool at step 2 though,
>>> then it may never to step 3, leaving the VNC server accessible.
>>
>> I think the point is that you can expire the password by just changing
>> it through the monitor.
>
> Well, you can't really expire it, you can only set it to $randomvalue.
> Unsetting the vnc password also disables authentication (in unstable),
> which is *not* what you want here ...
>
>> Having an expiration policy builtin to QEMU (as
>> opposed to libvirt) seems like the wrong place.
>
> IMHO it doesn't build policy into qemu. It is still up to libvirt (or
> the management app building on top of libvirt) to decide if and when
> the password will expire.
Except if you want to cancel the expiration because the expiration
policy changes. You'd have to set the password without an expiration
time and you may not have ready access to the password.
> qemu will just do what libvirt asks for.
>
> Instead of passing a expire time as implemented by the patches:
>
> set-password $protocol $secret $time
>
> we could add a expire-password command, then ask management to do
>
> set-password $protocol $secret
> [ let $time pass ]
> expire-password $protocol
>
> I fail to see why this is better though. The former is more robust
> and easier to implement in the management. The amount of code needed
> in qemu is probably quite similar ...
But the later let's a management tool implement arbitrarily complex
expiration policies. It can also be used to generically disable any
login which is effectively expiration but it may not be directly because
of a timeout but rather because of some other operation. For instance,
a management tool might want to implement a login policy whereas you're
only allowed to log into a VM during business hours (9-5). Setting an
expiration time for 8 hours is quite a bit less straight forward than
just unsetting the password during the off hours.
Regards,
Anthony Liguori
> cheers,
> Gerd
>
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-11-16 20:26 ` Anthony Liguori
@ 2010-11-17 10:23 ` Gerd Hoffmann
2010-11-20 2:14 ` Anthony Liguori
0 siblings, 1 reply; 14+ messages in thread
From: Gerd Hoffmann @ 2010-11-17 10:23 UTC (permalink / raw)
To: Anthony Liguori; +Cc: qemu-devel
Hi,
>>> Having an expiration policy builtin to QEMU (as
>>> opposed to libvirt) seems like the wrong place.
>>
>> IMHO it doesn't build policy into qemu. It is still up to libvirt (or
>> the management app building on top of libvirt) to decide if and when
>> the password will expire.
>
> Except if you want to cancel the expiration because the expiration
> policy changes. You'd have to set the password without an expiration
> time and you may not have ready access to the password.
Point.
>> set-password $protocol $secret
>> [ let $time pass ]
>> expire-password $protocol
>>
>> I fail to see why this is better though. The former is more robust and
>> easier to implement in the management. The amount of code needed in
>> qemu is probably quite similar ...
>
> But the later let's a management tool implement arbitrarily complex
> expiration policies.
Hmm, we could do this:
set-password $protocol $secret
expire-password $protocol [ now | never | $seconds ]
Comments?
cheers,
Gerd
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Qemu-devel] [PATCH 2/3] vnc: support password expire
2010-11-17 10:23 ` Gerd Hoffmann
@ 2010-11-20 2:14 ` Anthony Liguori
0 siblings, 0 replies; 14+ messages in thread
From: Anthony Liguori @ 2010-11-20 2:14 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-devel
On 11/17/2010 04:23 AM, Gerd Hoffmann wrote:
>> But the later let's a management tool implement arbitrarily complex
>> expiration policies.
>
>
> Hmm, we could do this:
>
> set-password $protocol $secret
> expire-password $protocol [ now | never | $seconds ]
>
> Comments?
I would be happy with this. I don't mind a bit of policy creeping into
qemu as long as we're exposing the underlying mechanisms.
If it were me, I'd do:
set-password $protocol $secret
unset-password $protocol
expire-password [never | $seconds]
And I would implement expire-password in terms of unset-password.
Regards,
Anthony Liguori
> cheers,
> Gerd
>
>
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2010-11-20 16:35 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-10-07 11:15 [Qemu-devel] [PATCH 0/3] vnc/spice: add monitor command to change password Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 1/3] vnc: auth reject cleanup Gerd Hoffmann
2010-10-07 11:15 ` [Qemu-devel] [PATCH 2/3] vnc: support password expire Gerd Hoffmann
2010-10-07 19:53 ` Anthony Liguori
2010-10-08 10:08 ` Daniel P. Berrange
2010-11-02 11:15 ` Gerd Hoffmann
2010-11-09 13:42 ` Gerd Hoffmann
2010-11-10 15:52 ` Anthony Liguori
2010-11-10 15:50 ` Anthony Liguori
2010-11-11 11:39 ` Gerd Hoffmann
2010-11-16 20:26 ` Anthony Liguori
2010-11-17 10:23 ` Gerd Hoffmann
2010-11-20 2:14 ` Anthony Liguori
2010-10-07 11:15 ` [Qemu-devel] [PATCH 3/3] vnc/spice: add set_passwd monitor command Gerd Hoffmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).