<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Pat,<o:p></o:p></span></a></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Well md5 seems to be the traditional hash algorithm used by most, although sha1 if you want to make it harder for an attacker using something like rainbow tables to check for hash collisions. I gather these would be available on most up to date PHP installations.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Perhaps it would be worth researching methods implemented by other open source developments, Wordpress being the one I am most familiar with employs hashing and salts.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I also found this article on NetTuts+ quite useful, which explains it all much better than I can!<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><a href="http://net.tutsplus.com/tutorials/php/understanding-hash-functions-and-keeping-passwords-safe/"><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>http://net.tutsplus.com/tutorials/php/understanding-hash-functions-and-keeping-passwords-safe/</span></a><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'>Dale Davies - VLE / E-Learning Developer<o:p></o:p></span></b></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Liverpool Community College, CIS Dept, Bankfield Road, Liverpool, L13 0BQ.<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Web:</span></b><span style='font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><a href="http://www.liv-coll.ac.uk"><span style='font-size:9.0pt;font-family:"Calibri","sans-serif"'>www.liv-coll.ac.uk</span></a><span style='font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Tel:</span></b><span style='font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> 0151 252 3238<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> xerte-bounces@lists.nottingham.ac.uk [mailto:xerte-bounces@lists.nottingham.ac.uk] <b>On Behalf Of </b>Pat Lockley<br><b>Sent:</b> 12 August 2011 13:03<br><b>To:</b> Xerte discussion list<br><b>Subject:</b> [Xerte] Re: Security concern<o:p></o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The problem I had was working out (during the installer) which hash would be supported. <o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><a href="http://php.net/manual/en/function.crypt.php">http://php.net/manual/en/function.crypt.php</a> - this has a sort of example / discussion of the problem.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>And most people who install XOT wouldn't understand me asking for "a salt", and then a fixed "salt" is probably bad practise? I would guess you could make the salt out of the URL maybe? But then it's a known algorithm attack anyways.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Fri, Aug 12, 2011 at 12:36 PM, Davies, Dale <<a href="mailto:Dale.Davies@liv-coll.ac.uk">Dale.Davies@liv-coll.ac.uk</a>> wrote:<o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a name="131bdd5c881c4cec__MailEndCompose"><span style='font-size:11.0pt;color:#1F497D'>Hi Matt,</span></a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'>I’m no security “expert” but I have plenty of experience with this sort of thing in the past, I guess it is something that gets drummed into you if you’re a developer.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'>It is good practice to hash passwords using a strong algorithm before storing them in a database, that way if the database is ever compromised and an attacker is able to dump the user table they will not be able to directly read the passwords.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'>Probably wouldn’t be that difficult to change the management.php script to check the hash of the password entered at login against a hashed password in the database, rather than just comparing the passwords in plain text. I might take a look into it myself next week if I have time.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'>It may be worth also considering password protecting the file itself at the server level, so that if you try to access management.php from your browser you will first be presented with an authentication dialogue from the browser. Use a different password for this than you do for the Xerte admin page. See this tutorial for using .htaccess (Apache) to do this... </span><a href="http://johnbokma.com/mexit/2007/01/09/password-protecting-single-file-htaccess.html" target="_blank"><span style='font-size:11.0pt'>http://johnbokma.com/mexit/2007/01/09/password-protecting-single-file-htaccess.html</span></a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'>This way, even if an attacker manages to dump the database to a page and read the management password, they will still not be able to log in to the admin section because they won’t be able to get past the browsers authentication dialogue (as this uses a different password not stored in the database at all).</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'>Another thing you can do to make the process of dumping database tables a little more difficult for a would be attacker is to use a unique table name prefix, this will make it harder for an attacker to guess the correct table names if they find an SQL injection vulnerability anywhere.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.5pt;color:#1F497D'>Let me know if this helps, or if you think I’m wrong, I have been know to be wrong many times in the past!</span></b><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.5pt;color:#1F497D'> </span></b><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.5pt;color:#1F497D'>Dale Davies - VLE / E-Learning Developer</span></b><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;color:#1F497D'>Liverpool Community College, CIS Dept, Bankfield Road, Liverpool, L13 0BQ.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:9.0pt;color:#1F497D'>Web:</span></b><span style='font-size:9.0pt;color:#1F497D'> </span><a href="http://www.liv-coll.ac.uk" target="_blank"><span style='font-size:9.0pt'>www.liv-coll.ac.uk</span></a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:9.0pt;color:#1F497D'>Tel:</span></b><span style='font-size:9.0pt;color:#1F497D'> 0151 252 3238</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span lang=EN-US style='font-size:10.0pt'>From:</span></b><span lang=EN-US style='font-size:10.0pt'> <a href="mailto:xerte-bounces@lists.nottingham.ac.uk" target="_blank">xerte-bounces@lists.nottingham.ac.uk</a> [mailto:<a href="mailto:xerte-bounces@lists.nottingham.ac.uk" target="_blank">xerte-bounces@lists.nottingham.ac.uk</a>] <b>On Behalf Of </b>Matt Lingard<br><b>Sent:</b> 11 August 2011 15:46<br><b>To:</b> Xerte discussion list<br><b>Subject:</b> [Xerte] Security concern</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>The systems manager at my institution has raised a security concern regarding the password for the admin account for our Xerte Online toolkit.<br><br>I'm told that the password is clear text (ie the characters are visible) in a table in the database called 'sitedetails' (as it is the management.php interface). He suggests that this isn't good practice. Has anyone else had any concerns raised about this? We run other services on the same server.<br><br>I'm not particularly technical myself, just trying to ascertain the level of risk.<br><br>thanks,<br>Matt<br clear=all><br>-- <br>Matt Lingard,<br>Learning Technologist<br>LSE<br><br><o:p></o:p></p><p>This message and any attachment are intended solely for the addressee and may contain confidential information. If you have received this message in error, please send it back to me, and immediately delete it. Please do not use, copy or disclose the information contained in this message or in any attachment. Any views or opinions expressed by the author of this email do not necessarily reflect the views of the University of Nottingham. <o:p></o:p></p><p>This message has been checked for viruses but the contents of an attachment may still contain software viruses which could damage your computer system: you are advised to perform your own checks. Email communications with the University of Nottingham may be monitored as permitted by UK legislation. <o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p class=MsoNormal><br>Please consider the environment before printing this email.<o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p class=MsoNormal><br>This email and any attachments are confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Liverpool Community College or associated companies. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. <br><br>The message content of in-coming emails is automatically scanned to identify Spam and viruses otherwise Liverpool Community College does not actively monitor content. However, sometimes it will be necessary for Liverpool Community College to access business communications during staff absence. <br><br>Liverpool Community College has taken steps to ensure that this email and any attachments are virus free. However, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by Liverpool Community College for any loss or damage arising in any way from its use. <br><b><span lang=EN-US>Error! Filename not specified.</span></b><o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>Xerte mailing list<br><a href="mailto:Xerte@lists.nottingham.ac.uk">Xerte@lists.nottingham.ac.uk</a><br><a href="http://lists.nottingham.ac.uk/mailman/listinfo/xerte" target="_blank">http://lists.nottingham.ac.uk/mailman/listinfo/xerte</a><br><br>This message and any attachment are intended solely for the addressee and may contain confidential information. If you have received this message in error, please send it back to me, and immediately delete it. Please do not use, copy or disclose the information contained in this message or in any attachment. Any views or opinions expressed by the author of this email do not necessarily reflect the views of the University of Nottingham.<br><br>This message has been checked for viruses but the contents of an attachment<br>may still contain software viruses which could damage your computer system:<br>you are advised to perform your own checks. Email communications with the<br>University of Nottingham may be monitored as permitted by UK legislation.<br><br><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div>
<br><p>
</p><hr>
<br>Please consider the environment before printing this email.<br><hr>
<br>This email and any attachments are confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Liverpool Community College or associated companies. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient.
<br>
<br>The message content of in-coming emails is automatically scanned to identify Spam and viruses otherwise Liverpool Community College does not actively monitor content. However, sometimes it will be necessary for Liverpool Community College to access business communications during staff absence.
<br>
<br>Liverpool Community College has taken steps to ensure that this email and any attachments are virus free. However, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by Liverpool Community College for any loss or damage arising in any way from its use.
<br><img alt="" src="http://www.liv-coll.ac.uk/images/Ofsted1.jpg" border="0" hspace="" vspace=""><br><hr>
<p></p>
<br></body></html>