mii/qemu
1
0
Fork 0
mirror of https://github.com/mii443/qemu.git synced 2025-08-22 15:15:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: recommend SCRAM-SHA-256 SASL mech instead of SHA-1 variant

Browse Source 
The SHA-256 variant better meats modern security expectations.
Also warn that the password file is storing entries in clear
text.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé
2021-03-04 18:14:26 +00:00
parent 1c45af36e7
commit e2bf32dfab
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
qemu.sasl
View File

@ -19,15 +19,15 @@ mech_list: gssapi
# If using TLS with VNC, or a UNIX socket only, it is possible to
# enable plugins which don't provide session encryption. The
# 'scram-sha-1' plugin allows plain username/password authentication
# 'scram-sha-256' plugin allows plain username/password authentication
# to be performed
#
#mech_list: scram-sha-1
#mech_list: scram-sha-256
# You can also list many mechanisms at once, and the VNC server will
# negotiate which to use by considering the list enabled on the VNC
# client.
#mech_list: scram-sha-1 gssapi
#mech_list: scram-sha-256 gssapi
# Some older builds of MIT kerberos on Linux ignore this option &
# instead need KRB5_KTNAME env var.
@ -38,7 +38,8 @@ mech_list: gssapi
# mechanism this can be commented out.
keytab: /etc/qemu/krb5.tab
# If using scram-sha-1 for username/passwds, then this is the file
# If using scram-sha-256 for username/passwds, then this is the file
# containing the passwds. Use 'saslpasswd2 -a qemu [username]'
# to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it
# to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it.
# Note that this file stores passwords in clear text.
#sasldb_path: /etc/qemu/passwd.db