The problem I had was working out (during the installer) which hash would be supported. <div><br></div><div><a href="http://php.net/manual/en/function.crypt.php">http://php.net/manual/en/function.crypt.php</a> - this has a sort of example / discussion of the problem.</div>
<div><br></div><div>And most people who install XOT wouldn't understand me asking for "a salt", and then a fixed "salt" is probably bad practise? I would guess you could make the salt out of the URL maybe? But then it's a known algorithm attack anyways.</div>
<div><br><div class="gmail_quote">On Fri, Aug 12, 2011 at 12:36 PM, Davies, Dale <span dir="ltr"><<a href="mailto:Dale.Davies@liv-coll.ac.uk">Dale.Davies@liv-coll.ac.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div lang="EN-GB" link="blue" vlink="purple"><div><p class="MsoNormal"><a name="131bdd5c881c4cec__MailEndCompose"><span style="font-size:11.0pt;color:#1F497D">Hi Matt,<u></u><u></u></span></a></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">I’m no security “expert” but I have plenty of experience with this sort of thing in the past, I guess it is something that gets drummed into you if you’re a developer.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">It is good practice to hash passwords using a strong algorithm before storing them in a database, that way if the database is ever compromised and an attacker is able to dump the user table they will not be able to directly read the passwords.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Probably wouldn’t be that difficult to change the management.php script to check the hash of the password entered at login against a hashed password in the database, rather than just comparing the passwords in plain text. I might take a look into it myself next week if I have time.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">It may be worth also considering password protecting the file itself at the server level, so that if you try to access management.php from your browser you will first be presented with an authentication dialogue from the browser. Use a different password for this than you do for the Xerte admin page. See this tutorial for using .htaccess (Apache) to do this... </span><a href="http://johnbokma.com/mexit/2007/01/09/password-protecting-single-file-htaccess.html" target="_blank"><span style="font-size:11.0pt">http://johnbokma.com/mexit/2007/01/09/password-protecting-single-file-htaccess.html</span></a><span style="font-size:11.0pt;color:#1F497D"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">This way, even if an attacker manages to dump the database to a page and read the management password, they will still not be able to log in to the admin section because they won’t be able to get past the browsers authentication dialogue (as this uses a different password not stored in the database at all).<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Another thing you can do to make the process of dumping database tables a little more difficult for a would be attacker is to use a unique table name prefix, this will make it harder for an attacker to guess the correct table names if they find an SQL injection vulnerability anywhere.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10.5pt;color:#1F497D">Let me know if this helps, or if you think I’m wrong, I have been know to be wrong many times in the past!<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.5pt;color:#1F497D"><u></u> <u></u></span></b></p><p class="MsoNormal"><b><span style="font-size:10.5pt;color:#1F497D">Dale Davies - VLE / E-Learning Developer<u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:#1F497D">Liverpool Community College, CIS Dept, Bankfield Road, Liverpool, L13 0BQ.<u></u><u></u></span></p><p class="MsoNormal"><b><span style="font-size:9.0pt;color:#1F497D">Web:</span></b><span style="font-size:9.0pt;color:#1F497D"> </span><a href="http://www.liv-coll.ac.uk" target="_blank"><span style="font-size:9.0pt;color:blue">www.liv-coll.ac.uk</span></a><span style="font-size:9.0pt;color:#1F497D"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:#1F497D">Tel:</span></b><span style="font-size:9.0pt;color:#1F497D"> 0151 252 3238<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"><p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt">From:</span></b><span lang="EN-US" style="font-size:10.0pt"> <a href="mailto:xerte-bounces@lists.nottingham.ac.uk" target="_blank">xerte-bounces@lists.nottingham.ac.uk</a> [mailto:<a href="mailto:xerte-bounces@lists.nottingham.ac.uk" target="_blank">xerte-bounces@lists.nottingham.ac.uk</a>] <b>On Behalf Of </b>Matt Lingard<br>
<b>Sent:</b> 11 August 2011 15:46<br><b>To:</b> Xerte discussion list<br><b>Subject:</b> [Xerte] Security concern<u></u><u></u></span></p></div><div class="im"><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal" style="margin-bottom:12.0pt">
The systems manager at my institution has raised a security concern regarding the password for the admin account for our Xerte Online toolkit.<br><br>I'm told that the password is clear text (ie the characters are visible) in a table in the database called 'sitedetails' (as it is the management.php interface). He suggests that this isn't good practice. Has anyone else had any concerns raised about this? We run other services on the same server.<br>
<br>I'm not particularly technical myself, just trying to ascertain the level of risk.<br><br>thanks,<br>Matt<br clear="all"><br>-- <br>Matt Lingard,<br>Learning Technologist<br>LSE<br><br><br><u></u><u></u></p><p>This message and any attachment are intended solely for the addressee and may contain confidential information. If you have received this message in error, please send it back to me, and immediately delete it. Please do not use, copy or disclose the information contained in this message or in any attachment. Any views or opinions expressed by the author of this email do not necessarily reflect the views of the University of Nottingham. <u></u><u></u></p>
<p>This message has been checked for viruses but the contents of an attachment may still contain software viruses which could damage your computer system: you are advised to perform your own checks. Email communications with the University of Nottingham may be monitored as permitted by UK legislation. <u></u><u></u></p>
</div></div>
<br><p>
</p><hr>
<br>Please consider the environment before printing this email.<br><hr>
<br>This email and any attachments are confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Liverpool Community College or associated companies. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient.
<br>
<br>The message content of in-coming emails is automatically scanned to identify Spam and viruses otherwise Liverpool Community College does not actively monitor content. However, sometimes it will be necessary for Liverpool Community College to access business communications during staff absence.
<br>
<br>Liverpool Community College has taken steps to ensure that this email and any attachments are virus free. However, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by Liverpool Community College for any loss or damage arising in any way from its use.
<br><img alt="" border="0" hspace="" vspace=""><br><hr>
<p></p>
<br></div><br>_______________________________________________<br>
Xerte mailing list<br>
<a href="mailto:Xerte@lists.nottingham.ac.uk">Xerte@lists.nottingham.ac.uk</a><br>
<a href="http://lists.nottingham.ac.uk/mailman/listinfo/xerte" target="_blank">http://lists.nottingham.ac.uk/mailman/listinfo/xerte</a><br>
<br>
This message and any attachment are intended solely for the addressee and may contain confidential information. If you have received this message in error, please send it back to me, and immediately delete it. Please do not use, copy or disclose the information contained in this message or in any attachment. Any views or opinions expressed by the author of this email do not necessarily reflect the views of the University of Nottingham.<br>
<br>
This message has been checked for viruses but the contents of an attachment<br>
may still contain software viruses which could damage your computer system:<br>
you are advised to perform your own checks. Email communications with the<br>
University of Nottingham may be monitored as permitted by UK legislation.<br>
<br>
<br></blockquote></div><br></div>