mattf
742456d3d5
Altered agi-phone_monitor script to not hangup after agent hangs up customer, requires small change to custom dialplan entries Added new Dial Log report Added Disable Auto Dial system setting git-svn-id: svn://192.168.202.10@1999 3d104415-ff17-0410-8863-d5cf3c621b8a
64 lines
2.6 KiB
Plaintext
64 lines
2.6 KiB
Plaintext
ENCRYPTED PASSWORDS DOC Started: 2013-07-09 Updated: 2013-07-09
|
|
|
|
|
|
NOTE: THIS FEATURE IS OPTIONAL, AND SHOULD ONLY BE ACTIVATED AFTER YOUR SYSTEM
|
|
HAS BEEN INSTALLED, CONFIGURED AND TESTED!
|
|
|
|
|
|
|
|
INSTALL:
|
|
|
|
Perl CPAN module required for Password Encryption to function:
|
|
NOTE: this must be installed on all webservers if you have more than one
|
|
|
|
On the Linux command line of your webserver(s), type the following:
|
|
|
|
cpan
|
|
install Crypt::Eksblowfish::Bcrypt
|
|
quit
|
|
|
|
Then, go to the admin web interface Admin -> System Settings page and manually
|
|
confirm that Password Encryption is DISABLED (fifth item from the top)
|
|
|
|
Then, run the following CLI script: (run in test mode first!)
|
|
/usr/share/astguiclient/ADMIN_bcrypt_convert.pl --debugX --test
|
|
|
|
Then if no errors are shown, run the same script above WITHOUT the --test flag.
|
|
NOTE: If you also want to clear the plaintext passwords from the users table,
|
|
you can run the above script with the --clear-plaintext-pass flag
|
|
|
|
Now if you go back to the admin web interface Admin -> System Settings page, you
|
|
should see that Password Encryption is now ENABLED.
|
|
|
|
You should not have to do anything else to use fully encrypted passwords on your
|
|
system.
|
|
|
|
|
|
|
|
DESCRIPTION:
|
|
|
|
This new optional feature is part of the security enhancements that have been
|
|
made to the Vicidial Contact Center System in our 2.8 development branch. After
|
|
consulting with security experts, we added several new security features to the
|
|
web interfaces and closed several security vulnerabilities as well.
|
|
|
|
The first major change was protecting against most SQL injection attacks. The
|
|
second major change was locking a user's account for 15 minutes after 10 failed
|
|
login attempts, which removes the vulnerability of the system to brute force
|
|
password attacks. Password encryption is the third major change, which protects
|
|
user passwords even if the system is compromised and the users database table is
|
|
downloaded.
|
|
|
|
We use the Bcrypt hashing algorithm, which allows for variable rates of
|
|
calculating the hash from a password and a salt. This variable "cost" is
|
|
definable in the system before you activate password encryption, and this is
|
|
what allows bcrypt to increase the complexity of the hash as computer systems
|
|
improve calculation ability, which makes Bcrypt the ideal choice for a system
|
|
that could be installed for many years.
|
|
|
|
All password checking goes through the bp.pl perl script to generate the Bcrypt
|
|
hash that checks against the vicidial_users table password hash if Password
|
|
Encryption is enabled on your system.
|
|
|
|
NOTES: Enabling Password Encryption will force case-sensitive passwords
|