I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, and by sniffing network traffic when connecting, I see VNC password is encrypted but everything else is sent in plain text. It's possible to install Debian remotely over SSH by loading the "network-console" component early in the installation process. After configuring the network, a dialog asks for "Remote installation password"

I can then connect to the installation with ssh installer@x.x.x.x and continue the installation over an encrypted connection. However, the remote installation password has to be typed while connected via VNC, and is therefore sent in plain text. An attacker who sniffs the password can then compromise the installation.

What is the best method in this case to avoid an attacker compromising the installation?

Before typing the remote installation password it's possible to execute a shell. However, the installation environment is very limited so only few commands are availiable. I think the best option is to restrict SSH connections to only my IP address, but this do not seems to be possible.

Another option I have thought about is quickly connecting to the installation after typing the remote installation password, and then remove the "installer" user from /etc/shadow thereby avoiding others from logging in, but not sure if this is safe enough. I hope there are more options I haven't thought of.

  • Just log in with ssh as soon as you set the password, and change the password over your ssh connection. For extra bonus paranoia change your sshd port and send a SIGHUP to sshd. For extra fun you could do this all while installing squeeze and when you're done apt-get dist-upgrade to wheezy to get rid of all those pesky rootkits the bad guys installed before yours finished. – quadruplebucky Feb 26 '14 at 7:49

I'd probably switch to noVNC with websockify. Run websockify on the host, and configure it to use a SSL cert. You can then connect fully encrypted to the guest. Make sure to firewall the raw VNC port so it's not accessible from the internet.

Also, you can completely script the debian installs with preseed, so you don't need to log in to type things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.