Re: [Qemu-devel] [PATCH] vnc: disable VNC password authentication (security type 2) when in FIPS mode

[Anthony Liguori]

On 05/01/2012 06:43 PM, George Wilson wrote:
> Anthony Liguori<address@hidden>  wrote on 05/01/2012 06:26:05 PM:
>
> > Anthony Liguori<address@hidden>
> > 05/01/2012 06:26 PM
> >
> > To
> >
> > Paul Moore<address@hidden>
> >
> > cc
> >
> > address@hidden, George Wilson/Austin/address@hidden
> >
> > Subject
> >
> > Re: [Qemu-devel] [PATCH] vnc: disable VNC password authentication
> > (security type 2) when in FIPS mode
> >
> > On 05/01/2012 04:20 PM, Paul Moore wrote:
> > > FIPS 140-2 requires disabling certain ciphers, including DES, which is
> used
> > > by VNC to obscure passwords when they are sent over the network.  The
> > > solution for FIPS users is to disable the use of VNC password auth when
> the
> > > host system is operating in FIPS mode.
> >
> > Sorry, what?
> >
> > Does FIPS really require software to detect when FIPS is enabled
> andactively
> > disable features???  That's absurd.
> >
> > Can you point to another software package that does something like this?
>
> Yes, it's true that only FIPS-approved algorithms are permitted for use in
> FIPS
> mode.  The kernel and all other FIPS 140-2 validated crypto modules like
> OpenSSL
> and NSS are required to restrict algorithms to the approved set.  The
> kernel
> sets /proc/sys/crypto/fips_enabled so that programs can detect FIPS mode
> and
> behave in accordance with the standard.

But this is nonsensical. It would allow no-password to be configured for the VNC 
server but not DES?  Why is that okay?  It's not like we enable DES passwords by 
default.  A user has to explicitly configure it.

Is there an open source app that actually keys off of fips_enabled?

Regards,

Anthony Liguori

> > Regards,
> >
> > Anthony Liguori
> >
> > > This patch causes qemu to emits a syslog entry indicating that VNC
> password
> > > auth is disabled when it detects the host is running in FIPS mode, and
> > > unless a VNC password was specified on the command line it continues
> > > normally.  However, if a VNC password was given on the command line,
> qemu
> > > fails with an error message to stderr explaining that that VNC password
> > > auth is not allowed in FIPS mode.
> > >
> > > Signed-off-by: Paul Moore<address@hidden>
> > > ---
> > >    qemu-doc.texi |    8 +++++---
> > >    ui/vnc.c      |   32 ++++++++++++++++++++++++++++++++
> > >    ui/vnc.h      |    1 +
> > >    3 files changed, 38 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/qemu-doc.texi b/qemu-doc.texi
> > > index e5d7ac4..f9b113e 100644
> > > --- a/qemu-doc.texi
> > > +++ b/qemu-doc.texi
> > > @@ -1124,9 +1124,11 @@ the protocol limits passwords to 8
> > characters it should not be considered
> > >    to provide high security. The password can be fairly easily
> > brute-forced by
> > >    a client making repeat connections. For this reason, a VNC
> > server using password
> > >    authentication should be restricted to only listen on the
> > loopback interface
> > > -or UNIX domain sockets. Password authentication is requested with
> > the @code{password}
> > > -option, and then once QEMU is running the password is set with
> > the monitor. Until
> > > -the monitor is used to set the password all clients will be rejected.
> > > +or UNIX domain sockets. Password authentication is not supported
> > when operating
> > > +in FIPS 140-2 compliance mode as it requires the use of the DES
> > cipher. Password
> > > +authentication is requested with the @code{password} option, and
> > then once QEMU
> > > +is running the password is set with the monitor. Until the
> > monitor is used to
> > > +set the password all clients will be rejected.
> > >
> > >    @example
> > >    qemu [...OPTIONS...] -vnc :1,password -monitor stdio
> > > diff --git a/ui/vnc.c b/ui/vnc.c
> > > index deb9ecd..620791e 100644
> > > --- a/ui/vnc.c
> > > +++ b/ui/vnc.c
> > > @@ -32,6 +32,7 @@
> > >    #include "acl.h"
> > >    #include "qemu-objects.h"
> > >    #include "qmp-commands.h"
> > > +#include<syslog.h>
> > >
> > >    #define VNC_REFRESH_INTERVAL_BASE 30
> > >    #define VNC_REFRESH_INTERVAL_INC  50
> > > @@ -48,6 +49,24 @@ static DisplayChangeListener *dcl;
> > >    static int vnc_cursor_define(VncState *vs);
> > >    static void vnc_release_modifiers(VncState *vs);
> > >
> > > +static int fips_enabled(void)
> > > +{
> > > +    int enabled = 0;
> > > +    char value;
> > > +    FILE *fds;
> > > +
> > > +    fds = fopen("/proc/sys/crypto/fips_enabled", "r");
> > > +    if (fds == NULL) {
> > > +        return 0;
> > > +    }
> > > +    if (fread(&value, sizeof(value), 1, fds) == 1&&   value == '1') {
> > > +        enabled = 1;
> > > +    }
> > > +    fclose(fds);
> > > +
> > > +    return enabled;
> > > +}
> > > +
> > >    static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
> > >    {
> > >    #ifdef _VNC_DEBUG
> > > @@ -2748,6 +2767,12 @@ void vnc_display_init(DisplayState *ds)
> > >        dcl->idle = 1;
> > >        vnc_display = vs;
> > >
> > > +    vs->fips = fips_enabled();
> > > +    VNC_DEBUG("FIPS mode %s\n", (vs->fips ? "enabled" : "disabled"));
> > > +    if (vs->fips) {
> > > +        syslog(LOG_NOTICE, "Disabling VNC password auth due to
> > FIPS mode\n");
> > > +    }
> > > +
> > >        vs->lsock = -1;
> > >
> > >        vs->ds = ds;
> > > @@ -2892,6 +2917,13 @@ int vnc_display_open(DisplayState *ds,
> > const char *display)
> > >        while ((options = strchr(options, ','))) {
> > >            options++;
> > >            if (strncmp(options, "password", 8) == 0) {
> > > +            if (vs->fips) {
> > > +                fprintf(stderr,
> > > +                        "VNC password auth disabled due to FIPS mode
> \n");
> > > +                g_free(vs->display);
> > > +                vs->display = NULL;
> > > +                return -1;
> > > +            }
> > >                password = 1; /* Require password auth */
> > >            } else if (strncmp(options, "reverse", 7) == 0) {
> > >                reverse = 1;
> > > diff --git a/ui/vnc.h b/ui/vnc.h
> > > index a851ebd..8746a98 100644
> > > --- a/ui/vnc.h
> > > +++ b/ui/vnc.h
> > > @@ -160,6 +160,7 @@ struct VncDisplay
> > >        char *display;
> > >        char *password;
> > >        time_t expires;
> > > +    int fips;
> > >        int auth;
> > >        bool lossy;
> > >        bool non_adaptive;
>
> Regards,
> George Wilson