aboutsummaryrefslogtreecommitdiff
path: root/qemu.sasl
diff options
context:
space:
mode:
authorDaniel P. Berrangé <berrange@redhat.com>2021-03-04 18:14:26 +0000
committerDaniel P. Berrangé <berrange@redhat.com>2021-06-14 13:28:50 +0100
commite2bf32dfabbfe6aabde4a0400b25b768b4481785 (patch)
treec10497865daf809209291f1d8ce44052b23fa1cd /qemu.sasl
parent1c45af36e77ca315b33f237786f8a9fda512a8d3 (diff)
docs: recommend SCRAM-SHA-256 SASL mech instead of SHA-1 variant
The SHA-256 variant better meats modern security expectations. Also warn that the password file is storing entries in clear text. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'qemu.sasl')
-rw-r--r--qemu.sasl11
1 files changed, 6 insertions, 5 deletions
diff --git a/qemu.sasl b/qemu.sasl
index fb8a92ba58..abdfc686be 100644
--- a/qemu.sasl
+++ b/qemu.sasl
@@ -19,15 +19,15 @@ mech_list: gssapi
# If using TLS with VNC, or a UNIX socket only, it is possible to
# enable plugins which don't provide session encryption. The
-# 'scram-sha-1' plugin allows plain username/password authentication
+# 'scram-sha-256' plugin allows plain username/password authentication
# to be performed
#
-#mech_list: scram-sha-1
+#mech_list: scram-sha-256
# You can also list many mechanisms at once, and the VNC server will
# negotiate which to use by considering the list enabled on the VNC
# client.
-#mech_list: scram-sha-1 gssapi
+#mech_list: scram-sha-256 gssapi
# Some older builds of MIT kerberos on Linux ignore this option &
# instead need KRB5_KTNAME env var.
@@ -38,7 +38,8 @@ mech_list: gssapi
# mechanism this can be commented out.
keytab: /etc/qemu/krb5.tab
-# If using scram-sha-1 for username/passwds, then this is the file
+# If using scram-sha-256 for username/passwds, then this is the file
# containing the passwds. Use 'saslpasswd2 -a qemu [username]'
-# to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it
+# to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it.
+# Note that this file stores passwords in clear text.
#sasldb_path: /etc/qemu/passwd.db