[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (se
From: |
Paul Moore |
Subject: |
Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode |
Date: |
Fri, 04 May 2012 08:39:04 -0400 |
User-agent: |
KMail/4.8.2 (Linux/3.3.4-gentoo; KDE/4.8.2; x86_64; ; ) |
On Friday, May 04, 2012 04:01:09 AM Roman Drahtmueller wrote:
> > > > FIPS 140-2 requires disabling certain ciphers, including DES, which is
> > > > used
> > > > by VNC to obscure passwords when they are sent over the network. The
> > > > solution for FIPS users is to disable the use of VNC password auth
> > > > when
> > > > the
> > > > host system is operating in FIPS mode.
> > > >
> > > > This patch causes qemu to emit a syslog entry indicating that VNC
> > > > password
> > > > auth is disabled when it detects the host is running in FIPS mode, and
> > > > unless a VNC password was specified on the command line it continues
> > > > normally. However, if a VNC password was given on the command line,
> > > > qemu
> > > > fails with an error message to stderr explaining that VNC password
> > > > auth is
> > > > not allowed in FIPS mode.
> > >
> > > I just talked to Roman about this one and he had some comments :)
> >
> > I'm sure he did :)
>
> *g* Thanks, Alex! :)
>
> The purpose makes perfect sense, I think.
>
> Some small glitch, though:
>
> fips=1 on the kernel commandline turns on fips mode in the kernel crypto,
> and leaves "1" in /proc/sys/crypto/fips_enabled for userland to consume.
> openssl starts up, reads the file and runs its fips initialization with
> "1" in the file. Typically...
>
> Two problems:
> 1) openssl may not come with FIPS support. proc file is ignored.
> 2) openssl may run in FIPS mode for reasons other than fips=1 on the
> kernel cmdline (environment, ...).
>
> Suggested way to handle this:
>
> 1) compile-time check if <openssl/fips.h> exists.
> Ignore fips specifics if not, otherwise:
> 2) use int FIPS_mode(void) for what it's there:
>
> #ifdef _QEMU_FIPS /* or whatever */
> #include <openssl/fips.h>
> vs->fips = FIPS_mode();
> #endif
>
> and skip fips_enabled(void).
>
> Much easier!
If QEMU's VNC implementation used OpenSSL's DES cipher for the password
encryption I would agree with you, but QEMU uses its own implementation
(ui/d3des.*) and because of this I think it makes the most sense to check the
kernel setting directly.
--
paul moore
security and virtualization @ redhat
- Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, (continued)
- Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Daniel P. Berrange, 2012/05/03
- Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Alexander Graf, 2012/05/03
- Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Daniel P. Berrange, 2012/05/03
- Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Alexander Graf, 2012/05/03
- Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Paul Moore, 2012/05/03
- Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Alexander Graf, 2012/05/03
Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Paul Moore, 2012/05/03
Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode, Alexander Graf, 2012/05/03