From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=48044 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1PoyvF-00027A-Kw
	for qemu-devel@nongnu.org; Mon, 14 Feb 2011 08:57:02 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1PoyvA-0004xF-1x
	for qemu-devel@nongnu.org; Mon, 14 Feb 2011 08:57:01 -0500
Received: from mx1.redhat.com ([209.132.183.28]:1027)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1Poyv9-0004wi-Md
	for qemu-devel@nongnu.org; Mon, 14 Feb 2011 08:56:55 -0500
Message-ID: <4D59349C.5050005@redhat.com>
Date: Mon, 14 Feb 2011 14:56:44 +0100
From: Gerd Hoffmann <kraxel@redhat.com>
MIME-Version: 1.0
References: <1296506599-7126-1-git-send-email-aliguori@us.ibm.com>
	<4D590A93.8080407@redhat.com> <4D591B9C.8060705@linux.vnet.ibm.com>
In-Reply-To: <4D591B9C.8060705@linux.vnet.ibm.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [Qemu-devel] Re: [PATCH] vnc: Fix password expiration through
	'change vnc ""'
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Anthony Liguori <aliguori@linux.vnet.ibm.com>
Cc: Neil Wilson <neil@aldur.co.uk>, qemu-devel@nongnu.org

On 02/14/11 13:10, Anthony Liguori wrote:
> On 02/14/2011 04:57 AM, Gerd Hoffmann wrote:
>> On 01/31/11 21:43, Anthony Liguori wrote:
>>> commit 52c18be9e99dabe295321153fda7fce9f76647ac introduced a
>>> regression in the
>>> change vnc password command that changed the behavior of setting the VNC
>>> password to an empty string from disabling login to disabling
>>> authentication.
>>>
>>> This commit refactors the code to eliminate this overloaded semantics in
>>> vnc_display_password and instead introduces the
>>> vnc_display_disable_login. The
>>> monitor implementation then determines the behavior of an empty or
>>> missing
>>> string.
>>
>> Hmm, now about simply never ever changing vs->auth?
>
> If auth is none and you do a vnc change password "" then if we don't set
> vs->auth to vnc, it won't have the desired effect.

If you want a password-protected vnc session you should better 
explicitly say so using '-vnc :0,password', otherwise you'll have a 
window (between qemu start and setting the password) where vnc clients 
can connect without a password.

Going from "none" to "vnc" automagically when setting a password 
encourages this insecure way to enable password protection.  IMHO we 
should stop doing this.  There are backward compatibility issues though 
as qemu did this for quite some time ...

Going from "vnc" to "none" automagically when setting a empty password 
is a no-go from a security point of view, especially as older qemu 
versions did *not* do that.

I don't think we'll need a monitor command to switch authentication 
methods on the fly.  YMMV.

cheers,
   Gerd