diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2021-03-04 18:14:26 +0000 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2021-06-14 13:28:50 +0100 |
| commit | e2bf32dfabbfe6aabde4a0400b25b768b4481785 (patch) | |
| tree | c10497865daf809209291f1d8ce44052b23fa1cd /qemu.sasl | |
| parent | 1c45af36e77ca315b33f237786f8a9fda512a8d3 (diff) | |
docs: recommend SCRAM-SHA-256 SASL mech instead of SHA-1 variant
The SHA-256 variant better meats modern security expectations.
Also warn that the password file is storing entries in clear
text.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'qemu.sasl')
| -rw-r--r-- | qemu.sasl | 11 |
1 files changed, 6 insertions, 5 deletions
@@ -19,15 +19,15 @@ mech_list: gssapi # If using TLS with VNC, or a UNIX socket only, it is possible to # enable plugins which don't provide session encryption. The -# 'scram-sha-1' plugin allows plain username/password authentication +# 'scram-sha-256' plugin allows plain username/password authentication # to be performed # -#mech_list: scram-sha-1 +#mech_list: scram-sha-256 # You can also list many mechanisms at once, and the VNC server will # negotiate which to use by considering the list enabled on the VNC # client. -#mech_list: scram-sha-1 gssapi +#mech_list: scram-sha-256 gssapi # Some older builds of MIT kerberos on Linux ignore this option & # instead need KRB5_KTNAME env var. @@ -38,7 +38,8 @@ mech_list: gssapi # mechanism this can be commented out. keytab: /etc/qemu/krb5.tab -# If using scram-sha-1 for username/passwds, then this is the file +# If using scram-sha-256 for username/passwds, then this is the file # containing the passwds. Use 'saslpasswd2 -a qemu [username]' -# to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it +# to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it. +# Note that this file stores passwords in clear text. #sasldb_path: /etc/qemu/passwd.db |