Re: [libvirt] [PATCH] Switch to GSSAPI (kerberos) instead of the insecure DIGEST-MD5

2017-03-13 Thread Ján Tomko
On Mon, Mar 13, 2017 at 12:51:40PM +, Daniel P. Berrange wrote: RFC 6331 documents a number of serious security weaknesses in the SASL DIGEST-MD5 mechanism. As such, libvirtd should not by using it as a default mechanism. GSSAPI is the only other viable SASL mechanism that can provide secure

Re: [libvirt] [PATCH] Switch to GSSAPI (kerberos) instead of the insecure DIGEST-MD5

2017-03-13 Thread Michal Privoznik
On 03/13/2017 01:51 PM, Daniel P. Berrange wrote: > RFC 6331 documents a number of serious security weaknesses in > the SASL DIGEST-MD5 mechanism. As such, libvirtd should not > by using it as a default mechanism. GSSAPI is the only other > viable SASL mechanism that can provide secure session

[libvirt] [PATCH] Switch to GSSAPI (kerberos) instead of the insecure DIGEST-MD5

2017-03-13 Thread Daniel P. Berrange
RFC 6331 documents a number of serious security weaknesses in the SASL DIGEST-MD5 mechanism. As such, libvirtd should not by using it as a default mechanism. GSSAPI is the only other viable SASL mechanism that can provide secure session encryption so enable that by defalt as the replacement.