Virtual Machines VNC consoles are accessible from any network

[Javier Diaz Jr]

Detailed bug description:

VNC consoles of running OpenStack VMs are accessible through the hostname/IP of a compute node and a specified port. Authentication is still required for the VM, but the VM is susceptible to a brute-force attack.

Steps to reproduce:

Using a VNC viewer use the IP of a compute node along with a VM port and you will gain access to the VNC console.

Expected results:

Console access should not work.

Actual result:

VNC connects successfully.

Reproducibility:
100%

Workaround:
ip tables

Impact:
Unauthorized access to VNC consoles of running VMs is possible. Such access may be used to
brute-force passwords, to reset or reboot a VM, or to gain an immediate access if a VM guest
operating systems are configured for the automatic login in console.

Description of the environment:
MOS 9.1 and MOS 9.2

[Vladimir Khlyunev (vkhlyunev)]

Hi Javier,

can you tell us - from which network VNC console are accessible? MOS reference architecture uses compute nodes isolated from external networks. Only private and management networks should be attached to this nodes. VNC consoles are available via VNCProxy through controller nodes (this way is protected with auth). So it means that open VNC ports should not be an issue (moreover for VNCProxy this ports should be open for management network)

[Javier Diaz Jr (javierdiazcharles)]

Issue was with floating IP and not compute mgmt network. Marking issue as invalid.