From: Daniel Berrange <1828207@bugs.launchpad.net>
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] [Bug 1828207] Re: Request to add something like "Auth failed from IP" log report for built-in VNC server
Date: Wed, 08 May 2019 13:42:42 -0000 [thread overview]
Message-ID: <155732296246.31028.1681732372989671843.malone@soybean.canonical.com> (raw)
In-Reply-To: 155731026034.22594.3160504765111033354.malonedeb@chaenomeles.canonical.com
The challenge is that this is the only auth scheme defined by the VNC protocol, aside from no-auth.
If we removed it, we'd no longer be compatible with the standard VNC protocol. We'd be making use of the TLS/SASL extensions mandatory if users want auth. This could ultimately push people to turn off auth altogether which is even worse.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1828207
Title:
Request to add something like "Auth failed from IP" log report for
built-in VNC server
Status in QEMU:
New
Bug description:
In environment with needs of public accessible VNC ports there is no logs or other registered events about authentication failures to analyze and/or integrate it to automated services like fail2ban ans so on.
Thus the built-in VNC service is vulnerable to brutforce attacks and in combination with weak built-in VNC-auth scheme can be a security vulnerability.
Adding a simple log record like "QEMU VNC Authentication failed
192.168.0.5:5902 - 123.45.67.89:7898" will permit to quickly integrate
it to fail2ban system.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1828207/+subscriptions
next prev parent reply other threads:[~2019-05-08 13:51 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-08 10:11 [Qemu-devel] [Bug 1828207] [NEW] Request to add something like "Auth failed from IP" log report for built-in VNC server Druta Pavel via Qemu-devel
2019-05-08 13:08 ` [Qemu-devel] [Bug 1828207] " Daniel Berrange
2019-05-08 13:33 ` Peter Maydell
2019-05-08 13:33 ` Peter Maydell
2019-05-08 13:42 ` Daniel Berrange [this message]
2021-05-05 11:28 ` Thomas Huth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=155732296246.31028.1681732372989671843.malone@soybean.canonical.com \
--to=1828207@bugs.launchpad.net \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).