[6.10.0] [SECURITY] VNC does not allow secure passwords

Just an FYI, the 8 character password limitation in VNC is actually a protocol limitation with VNC. Most implementations of VNC are inherently insecure. You'll find that your VNC password is also effectively transmitted in clear text.  It's more common to encapsulate (tunnel) VNC through SSH, but in this application it's not practical. KVM/QEMU/LibVirt is actually the VNC host.

 

Other "more secure" VNC applications (such as RealVNC) break protocol spec to implement their security and additional features. Most other common flavors of VNC (Tiger, Tight, NoVNC, Turbo,Ultra) all pretty much adhere to spec, and thusly are also insecure (outside of encryption plugins). We must rely upon what KVM/QEMU/LibVirt support.

 

If security is a concern, I recommend disabling the VNC VM console across your VMs altogether until UNRAID makes it easy to operate with x.590/TLS that libvirt also supports.

 

See: https://wiki.libvirt.org/page/VNCTLSSetup  A step in the right direction, but cumbersome to use.

Edited May 20, 2022 by bitcore
correction

In my opinion, the KVM hosted VNC should not be used for anything but operations that require local console on the VM. RDP, nomachine, pretty much any remote access hosted in the VM itself is going to give you a much better experience.