On Wed, Mar 04, 2009 at 06:38:01AM -0500, Adam Tkac wrote:
On Wed, Mar 04, 2009 at 12:10:13PM +0000, Daniel P. Berrange wrote:
> Do you have any plans to implement the VeNCrypt extension in the
> server side ? This is the TLS/SSL + x509 certificate extension we
> have standardized on for QEMU, Xen, KVM and GTK-VNC (used by
> virt-viewer, virt-manager and vinagre clients). I would also like
> to add it to the GNOME VINO, since VINO's own TLS extension is flawed
> by not using x509 credentials. That leaves TigerVNC without a good
> interoperable TLS extension, so it'd be desriable to implement VeNCrypt
> there so we have a consistent TLS extension that's interoperable
> across all the VNC clients & servers in Fedora.
Yes, we are interested in VeNCrypt extension and we think that this
is the best approach for encrypted sessions. There are some patches
based on gnutls so we can probably use them. Main reason why they are
still not in upstream is that we would like to use libnss instead of
gnutls. But we will use gnutls based patches before libnss based
support will be ready.
Btw could you point me if there is any documentation of VeNCrypt
instead of source code, please? ;)
Stewart Becker (who wrote VeNCrypt) sent a mail to qemu-devel outlining
the spec for it:
http://www.mail-archive.com/qemu-devel@nongnu.org/msg08681.html
The only change since that time is that he allocated two more
sub-auth codes for layering the new SASL auth over VeNCrypt
263: X509SASL
264: TLSSASL
> Following on from that I also recently defined & implemented
another
> VNC auth extension based on SASL. This provides for a good extendable
> authentication capability, most importantly including GSSAPI Kerberos
> for single sign on. I've got it implemented for QEMU, KVM, GTK-VNC and
> VINO already, so again it'd be good to plan for adding it to TigerVNC
> too so we have a widely interoperable strong authentication system.
I know about SASL authentication (I'm subscribed to vnc-list ;)).
But we haven't discussed it, yet.
Ok, i'm happy to help out and/or advise with this when the time comes
Regards,
Daniel
--
|: Red Hat, Engineering, London -o-
http://people.redhat.com/berrange/ :|
|:
http://libvirt.org -o-
http://virt-manager.org -o-
http://ovirt.org :|
|:
http://autobuild.org -o-
http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|