From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:34511) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQHn1-0001p2-Mr for qemu-devel@nongnu.org; Fri, 04 May 2012 08:39:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SQHmz-0005Jx-K7 for qemu-devel@nongnu.org; Fri, 04 May 2012 08:39:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:2099) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQHmz-0005GQ-2b for qemu-devel@nongnu.org; Fri, 04 May 2012 08:39:13 -0400 From: Paul Moore Date: Fri, 04 May 2012 08:39:04 -0400 Message-ID: <4659908.x6KEQUt2IX@sifl> In-Reply-To: References: <20120502193256.6508.86360.stgit@sifl> <4548305.DtX99stsJu@sifl> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Subject: Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Roman Drahtmueller Cc: Alexander Graf , qemu-devel Developers On Friday, May 04, 2012 04:01:09 AM Roman Drahtmueller wrote: > > > > FIPS 140-2 requires disabling certain ciphers, including DES, which is > > > > used > > > > by VNC to obscure passwords when they are sent over the network. The > > > > solution for FIPS users is to disable the use of VNC password auth > > > > when > > > > the > > > > host system is operating in FIPS mode. > > > > > > > > This patch causes qemu to emit a syslog entry indicating that VNC > > > > password > > > > auth is disabled when it detects the host is running in FIPS mode, and > > > > unless a VNC password was specified on the command line it continues > > > > normally. However, if a VNC password was given on the command line, > > > > qemu > > > > fails with an error message to stderr explaining that VNC password > > > > auth is > > > > not allowed in FIPS mode. > > > > > > I just talked to Roman about this one and he had some comments :) > > > > I'm sure he did :) > > *g* Thanks, Alex! :) > > The purpose makes perfect sense, I think. > > Some small glitch, though: > > fips=1 on the kernel commandline turns on fips mode in the kernel crypto, > and leaves "1" in /proc/sys/crypto/fips_enabled for userland to consume. > openssl starts up, reads the file and runs its fips initialization with > "1" in the file. Typically... > > Two problems: > 1) openssl may not come with FIPS support. proc file is ignored. > 2) openssl may run in FIPS mode for reasons other than fips=1 on the > kernel cmdline (environment, ...). > > Suggested way to handle this: > > 1) compile-time check if exists. > Ignore fips specifics if not, otherwise: > 2) use int FIPS_mode(void) for what it's there: > > #ifdef _QEMU_FIPS /* or whatever */ > #include > vs->fips = FIPS_mode(); > #endif > > and skip fips_enabled(void). > > Much easier! If QEMU's VNC implementation used OpenSSL's DES cipher for the password encryption I would agree with you, but QEMU uses its own implementation (ui/d3des.*) and because of this I think it makes the most sense to check the kernel setting directly. -- paul moore security and virtualization @ redhat