diff options
| author | Paul Moore <pmoore@redhat.com> | 2012-08-03 14:39:21 -0400 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2012-08-03 14:28:40 -0500 |
| commit | 0f66998ff6d5d2133b9b08471a44e13b11119e50 (patch) | |
| tree | 498ceec7d881257c2564998762cd635014c51e8d /qemu-doc.texi | |
| parent | 2ad728bd4bf26d8144190ca87d5d36d5f33cfae9 (diff) | |
| download | qemu-0f66998ff6d5d2133b9b08471a44e13b11119e50.tar.gz qemu-0f66998ff6d5d2133b9b08471a44e13b11119e50.tar.bz2 qemu-0f66998ff6d5d2133b9b08471a44e13b11119e50.zip | |
vnc: disable VNC password authentication (security type 2) when in FIPS mode
FIPS 140-2 requires disabling certain ciphers, including DES, which is used
by VNC to obscure passwords when they are sent over the network. The
solution for FIPS users is to disable the use of VNC password auth when the
host system is operating in FIPS compliance mode and the user has specified
'-enable-fips' on the QEMU command line.
This patch causes QEMU to emit a message to stderr when the host system is
running in FIPS mode and a VNC password was specified on the commend line.
If the system is not running in FIPS mode, or is running in FIPS mode but
VNC password authentication was not requested, QEMU operates normally.
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'qemu-doc.texi')
| -rw-r--r-- | qemu-doc.texi | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/qemu-doc.texi b/qemu-doc.texi index a41448a7a7..f32e9e2fb9 100644 --- a/qemu-doc.texi +++ b/qemu-doc.texi @@ -1124,9 +1124,11 @@ the protocol limits passwords to 8 characters it should not be considered to provide high security. The password can be fairly easily brute-forced by a client making repeat connections. For this reason, a VNC server using password authentication should be restricted to only listen on the loopback interface -or UNIX domain sockets. Password authentication is requested with the @code{password} -option, and then once QEMU is running the password is set with the monitor. Until -the monitor is used to set the password all clients will be rejected. +or UNIX domain sockets. Password authentication is not supported when operating +in FIPS 140-2 compliance mode as it requires the use of the DES cipher. Password +authentication is requested with the @code{password} option, and then once QEMU +is running the password is set with the monitor. Until the monitor is used to +set the password all clients will be rejected. @example qemu-system-i386 [...OPTIONS...] -vnc :1,password -monitor stdio |