QEMU does accept empty VNC passwords now and allows anyone
to connect with an empty password.
https://bugzilla.redhat.com/show_bug.cgi?id=969542
---
src/qemu/qemu.conf | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf
index cdf1ec4..49ef75f 100644
--- a/src/qemu/qemu.conf
+++ b/src/qemu/qemu.conf
@@ -62,9 +62,9 @@
# VNC passwords. This parameter is only used if the per-domain
# XML config does not already provide a password. To allow
# access without passwords, leave this commented out. An empty
-# string will still enable passwords, but be rejected by QEMU,
-# effectively preventing any use of VNC. Obviously change this
-# example here before you set this.
+# string might either prevent any use of VNC or allow access
+# with an empty password depending on QEMU version. Obviously
+# change this example here before you set this.
#
#vnc_password = "XYZ12345"
NACK. This is not correct. This is a security flaw and regression
in behaviour that must be fixed, if true.
Daniel
--
|: