Re: [LANdb] Proposed login system

> Well, here's pseudocode for the system that keystone uses - it's pretty
> similar to the stuff you've outlined here.  it uses the "superuser"
> type username/password for connecting to the db, and depends on having a
> "secret", which should be a unique string kept as secret as any other
> password, defined in the config file.  it also uses cookies to pass the
> auth strings back and forth - a somewhat better option, IMHO, because
> cookies can be set to time out.

Ok, so the config file then has to be stored readable only by
nobody.nogroup, but it's still left vulnerable to attack from anything else
running as nobody.  And I'm assuming "superuser's" password is also stored
in the config file?  Why is the server key necessary if we've got super's
password-- just to add something extra to the hash?

Is using md5 more appropriate than Crypt?

John




-------------------------------------
LANdb - Network Management through SQL
To unsubscribe, send email to landb-request@avenir.dhs.org
	and put 'unsubscribe' in the subject line
Administrative contact: weez@avenir.dhs.org
-------------------------------------