Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, and by sniffing network traffic when connecting, I see VNC password is encrypted but everything else is sent in plain text. It's possible to install Debian remotely over SSH by loading the "network-console" component early in the installation process. After configuring the network, a dialog asks for "Remote installation password"

I can then connect to the installation with ssh installer@x.x.x.x and continue the installation over an encrypted connection. However, the remote installation password has to be typed while connected via VNC, and is therefore sent in plain text. An attacker who sniffs the password can then compromise the installation.

What is the best method in this case to avoid an attacker compromising the installation?

Before typing the remote installation password it's possible to execute a shell. However, the installation environment is very limited so only few commands are availiable. I think the best option is to restrict SSH connections to only my IP address, but this do not seems to be possible.

Another option I have thought about is quickly connecting to the installation after typing the remote installation password, and then remove the "installer" user from /etc/shadow thereby avoiding others from logging in, but not sure if this is safe enough. I hope there are more options I haven't thought of.

share|improve this question
Just log in with ssh as soon as you set the password, and change the password over your ssh connection. For extra bonus paranoia change your sshd port and send a SIGHUP to sshd. For extra fun you could do this all while installing squeeze and when you're done apt-get dist-upgrade to wheezy to get rid of all those pesky rootkits the bad guys installed before yours finished. – quadruplebucky Feb 26 '14 at 7:49

I'd probably switch to noVNC with websockify. Run websockify on the host, and configure it to use a SSL cert. You can then connect fully encrypted to the guest. Make sure to firewall the raw VNC port so it's not accessible from the internet.

Also, you can completely script the debian installs with preseed, so you don't need to log in to type things.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.