Re: [Qemu-devel] [PATCH] Bind VNC to localhost unless otherwise specified to increase security

2016-06-21 Thread Attila-Mihaly Balazs
the importance of this and similar changes. Kind regards! Attila Balazs (Grey Panther) On Tue, Jun 7, 2016 at 11:42 PM, Gerd Hoffmann wrote: > On Di, 2016-06-07 at 20:51 +0300, Attila-Mihaly Balazs wrote: >> > >> > I understand the reason you want to do this change, but I don&#

Re: [Qemu-devel] [PATCH] Make password based authentication the default for VNC

2016-06-07 Thread Attila-Mihaly Balazs
On Tue, Jun 7, 2016 at 12:24 PM, Daniel P. Berrange wrote: > On Tue, Jun 07, 2016 at 12:13:06PM +0300, Attila-Mihaly Balazs wrote: >> To improve the security of the embedded VNC server make password >> based authentication the default when no authentication mechanism >>

[Qemu-devel] [PATCH] Make password based authentication the default for VNC

2016-06-07 Thread Attila-Mihaly Balazs
tly specified. Note: because password authentication is not availble in FIPS mode, you must explicitly set an authentication method when using VNC with QEMU compiled in FIPS mode or it won't start. Signed-off-by: Attila-Mihaly Balazs --- qemu-doc.texi | 10 ++ qemu-options.

Re: [Qemu-devel] [PATCH] Bind VNC to localhost unless otherwise specified to increase security

2016-06-06 Thread Attila-Mihaly Balazs
Sorry, forgot to CC Gerd in my previous email. On Mon, Jun 6, 2016 at 6:39 PM, Attila-Mihaly Balazs wrote: > Signed-off-by: Attila-Mihaly Balazs > --- > qemu-options.hx | 7 ++- > ui/vnc.c| 2 ++ > 2 files changed, 8 insertions(+), 1 deletion(-) > > diff --gi

[Qemu-devel] [PATCH] Bind VNC to localhost unless otherwise specified to increase security

2016-06-06 Thread Attila-Mihaly Balazs
Signed-off-by: Attila-Mihaly Balazs --- qemu-options.hx | 7 ++- ui/vnc.c| 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/qemu-options.hx b/qemu-options.hx index 9f33361..80ade0d 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -1245,7 +1245,12 @@ syntax for

[Qemu-devel] Suggested improvement to the wiki

2016-06-06 Thread Attila-Mihaly Balazs
Hello, I don't have an account on the wiki (and new account creation is disabled [1]), hence I'm posting the suggestion here in the hope that somebody with an account can do it: On the "Hosts/Linux" page in the "Simple build and test" section [2] I would do the following changes: - change config

[Qemu-devel] Possible security enhancement for QEMU

2014-12-29 Thread Attila-Mihaly Balazs
Dear all, Some enterprising people scanned the whole range of IPv4 addresses for open VNC servers [1] and my casual browsing seems to indicate that a lot of them are QEMU VMs. I suspect that this is because just doing "-vnc :1" will listen on/bind to "0.0.0.0" (ie. on all the interfaces). My sugg