hi, how are Zope passwords transmitted? Secure or UN-secure? j. -- ...................... ..... Jason C. Leach ..
Hi jleach, if you have to ask, the answer might not be so valuable for you ;) zopes acl_user folder, which is the standard, supports HTTP Basic Authentication as of rfc2616. This means the username/password is not encrypted in the HTTP session, rather it is obfuscated using base64 encoding. The storage in the object database is encrypted using SHA hashing. (At least last time I checked this) Does this help you? You can use any other authentication mechanism, if you use a different User-Folder and/or implement it yourself (and hope your clients do as well) Most common practice is using Apache (or Squid 2.5) as ssl-proxy in front of zope. HTH Tino Wildenhain --On Mittwoch, 18. Juli 2001 14:20 -0700 "Jason C. Leach" <jleach@drivingbeat.com> wrote:
hi,
how are Zope passwords transmitted? Secure or UN-secure?
j. -- ...................... ..... Jason C. Leach ..
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
Hi Andy, is it possible if I created the user from inituser? In the inituser-file the password was encrypted using SHA and so it could for sure not be recreated to p(l)ain text. Unfortunately the inituser-trick does only work for the first and only user in the acl_user folder. Anyway, I'm already working with the authentication mechanism to implement true IP filtering for authentication (as opposite to simple wildcards on IP tuples) so implementing SHA hashing there should not be so hard. The support must be already there. Regards Tino --On Mittwoch, 18. Juli 2001 15:12 -0700 Andy McKay <andym@ActiveState.com> wrote:
The storage in the object database is encrypted using SHA hashing. (At least last time I checked this)
Not at the moment it isnt. Theres a proposal in the fishbowl for it.
Cheers. -- Andy McKay.
On Thu, 19 Jul 2001, Tino Wildenhain wrote:
Anyway, I'm already working with the authentication mechanism to implement true IP filtering for authentication (as opposite to simple wildcards on IP tuples) so implementing SHA hashing there should not be so hard. The support must be already there.
There's even a patch somewhere on Zope.org bye, Jerome Alet
Re: [Zope] Sending Zope Passwords. we are currently having problem with GUF auth using mysql. - when we reach a certain number of users like 15,106... user with number 15,107 is not authenticated - but all the user are seen by "userLlist" - in short, the user 15, 107 and above can be seen but not authenticated we also encounter this: ZODB.POSException.ConflictError thanks. Fritz Mesedilla Systems Administrator Summit Interactive, Inc. FHM | Seventeen | Candy | Cosmopolitan | Preview | Good Housekeeping femalenetwork.com | candymag.com | fhm.com.ph | cosmo.com.ph Palm Pilot Software: TVSked - Download from the link below ---------------------------------------------------------------------------- http://mesedilla.tripod.com +Basta Ikaw Lord -----Original Message----- From: Jerome Alet [mailto:alet@unice.fr] Sent: Thursday, July 19, 2001 3:16 PM To: Tino Wildenhain Cc: jleach@mail.ocis.net; zope@zope.org Subject: Re: [Zope] Sending Zope Passwords. On Wed, 18 Jul 2001, Tino Wildenhain wrote:
The storage in the object database is encrypted using SHA hashing. (At least last time I checked this)
No, the storage in the ZODB is in clear text ! unfortunately... bye, Jerome Alet _______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
On 19 Jul 2001 09:16:04 +0200, Jerome Alet wrote:
On Wed, 18 Jul 2001, Tino Wildenhain wrote:
The storage in the object database is encrypted using SHA hashing. (At least last time I checked this)
No, the storage in the ZODB is in clear text !
Unless one is using ZMC on a platform that has the SHA/Crypt modules :)
participants (7)
-
Andy McKay -
Bill Anderson -
Fritz Mesedilla -
Jan-Frode Myklebust -
Jason C. Leach -
Jerome Alet -
Tino Wildenhain