ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes for better consistency in password change process for both vicidial.php and admin.php, Issue #1261

Browse Source 
git-svn-id: svn://192.168.202.10@3387 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-03-17 16:14:27 +00:00
parent 8ca76c85e7
commit 55b74f5035
3 changed files with 114 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ENCRYPTED_PASSWORDS.txt
+9 -6
View File
@@ -1,4 +1,4 @@
ENCRYPTED PASSWORDS DOC Started: 2013-07-09 Updated: 2020-09-01
ENCRYPTED PASSWORDS DOC Started: 2013-07-09 Updated: 2021-03-17
NOTE: THIS FEATURE IS OPTIONAL, AND SHOULD ONLY BE ACTIVATED AFTER YOUR SYSTEM
@@ -40,9 +40,10 @@ system.
DESCRIPTION:
This new optional feature is part of the security enhancements that have been
made to the Vicidial Contact Center System in our 2.8 development branch. After
consulting with security experts, we added several new security features to the
web interfaces and closed several security vulnerabilities as well.
made to the Vicidial Contact Center System in our 2.8 development branch(during
the summer of 2013). After consulting with security experts, we added several
new security features to the web interfaces and closed several security
vulnerabilities as well.
The first major change was protecting against most SQL injection attacks. The
second major change was locking a user's account for 15 minutes after 10 failed
@@ -62,7 +63,9 @@ All password checking goes through the bp.pl perl script to generate the Bcrypt
hash that checks against the vicidial_users table password hash if Password
Encryption is enabled on your system.
NOTES: Enabling Password Encryption will force case-sensitive passwords
NOTES:
1. Enabling Password Encryption will force case-sensitive passwords
2. Passwords only allow letters and numbers, NOT symbols
To test the password encryption, or to generate a pass hash manually, just go to
@@ -81,7 +84,7 @@ ADDITIONAL USER SECURITY TOOLS:
1. Passwords can now be up to 100 characters: According to new NIST password security guidelines, the length of a password is the single most important point in the security of that password.
2. Minimum password lengths: This setting will require that user passwords, phone and server passwords, and system settings default passwords be at least this minimum length of characters when those records settings are modified on the Modify pages. There is also a "PASSWORD LENGTH" indicator on the Modify pages to show you how long a password is as it is being typed.
3. Add an automated process that can deactivate accounts that have not been logged in to in over X number of days(see below)
4. Two-Factor Authentication has been added as an option within the VICIdial admin web screens, allowing Email, Phone-Call and SMS methods with definable session expiration times. See the 2FA_TWO_FACTOR_AUTHENTICATION.txt doc for more info.
NOTE: This is something an Admin will have to set up on your system.