From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:43227) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQEHV-0002wy-W2 for qemu-devel@nongnu.org; Fri, 04 May 2012 04:54:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SQEHP-0003Ja-LB for qemu-devel@nongnu.org; Fri, 04 May 2012 04:54:29 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41519) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQEHP-0003Gj-DC for qemu-devel@nongnu.org; Fri, 04 May 2012 04:54:23 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q448sLSc003444 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Fri, 4 May 2012 04:54:21 -0400 Date: Fri, 4 May 2012 09:54:17 +0100 From: "Daniel P. Berrange" Message-ID: <20120504085417.GD9419@redhat.com> References: <20120503210045.30938.71447.stgit@sifl> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20120503210045.30938.71447.stgit@sifl> Subject: Re: [Qemu-devel] [PATCH v3] vnc: disable VNC password authentication (security type 2) when in FIPS mode Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paul Moore Cc: qemu-devel@nongnu.org On Thu, May 03, 2012 at 05:00:45PM -0400, Paul Moore wrote: > FIPS 140-2 requires disabling certain ciphers, including DES, which is used > by VNC to obscure passwords when they are sent over the network. The > solution for FIPS users is to disable the use of VNC password auth when the > host system is operating in FIPS mode. > > This patch causes qemu to emit a syslog entry and a message to stderr when > the host system is running in FIPS mode and a VNC password was specified on > the commend line. If the system is not running in FIPS mode, or is running > in FIPS mode but VNC password authentication was not requested, qemu > operates normally. > > Signed-off-by: Paul Moore Reviewed-by: Dainel P. Berrange Looks good to me now. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|