mattf
6805a2b138
Added new Spanish(es) ALL translation file, v004 Updated encrypted passwords doc git-svn-id: svn://192.168.202.10@2234 3d104415-ff17-0410-8863-d5cf3c621b8a
75 lines
3.0 KiB
Plaintext
75 lines
3.0 KiB
Plaintext
ENCRYPTED PASSWORDS DOC Started: 2013-07-09 Updated: 2014-12-31
|
|
|
|
|
|
NOTE: THIS FEATURE IS OPTIONAL, AND SHOULD ONLY BE ACTIVATED AFTER YOUR SYSTEM
|
|
HAS BEEN INSTALLED, CONFIGURED AND TESTED!
|
|
|
|
|
|
|
|
INSTALL:
|
|
|
|
Perl CPAN module required for Password Encryption to function:
|
|
NOTE: this must be installed on all webservers if you have more than one
|
|
|
|
On the Linux command line of your webserver(s), type the following:
|
|
|
|
cpan
|
|
install Crypt::Eksblowfish::Bcrypt
|
|
quit
|
|
|
|
Then, go to the admin web interface Admin -> System Settings page and manually
|
|
confirm that Password Encryption is DISABLED (fifth item from the top)
|
|
|
|
Then, run the following CLI script: (run in test mode first!)
|
|
/usr/share/astguiclient/ADMIN_bcrypt_convert.pl --debugX --test
|
|
|
|
Then if no errors are shown, run the same script above WITHOUT the --test flag.
|
|
NOTE: If you also want to clear the plaintext passwords from the users table,
|
|
you can run the above script with the --clear-plaintext-pass flag
|
|
|
|
Now if you go back to the admin web interface Admin -> System Settings page, you
|
|
should see that Password Encryption is now ENABLED.
|
|
|
|
You should not have to do anything else to use fully encrypted passwords on your
|
|
system.
|
|
|
|
|
|
|
|
DESCRIPTION:
|
|
|
|
This new optional feature is part of the security enhancements that have been
|
|
made to the Vicidial Contact Center System in our 2.8 development branch. After
|
|
consulting with security experts, we added several new security features to the
|
|
web interfaces and closed several security vulnerabilities as well.
|
|
|
|
The first major change was protecting against most SQL injection attacks. The
|
|
second major change was locking a user's account for 15 minutes after 10 failed
|
|
login attempts, which removes the vulnerability of the system to brute force
|
|
password attacks. Password encryption is the third major change, which protects
|
|
user passwords even if the system is compromised and the users database table is
|
|
downloaded.
|
|
|
|
We use the Bcrypt hashing algorithm, which allows for variable rates of
|
|
calculating the hash from a password and a salt. This variable "cost" is
|
|
definable in the system before you activate password encryption, and this is
|
|
what allows bcrypt to increase the complexity of the hash as computer systems
|
|
improve calculation ability, which makes Bcrypt the ideal choice for a system
|
|
that could be installed for many years.
|
|
|
|
All password checking goes through the bp.pl perl script to generate the Bcrypt
|
|
hash that checks against the vicidial_users table password hash if Password
|
|
Encryption is enabled on your system.
|
|
|
|
NOTES: Enabling Password Encryption will force case-sensitive passwords
|
|
|
|
|
|
To test the password encryption, or to generate a pass hash manually, just go to
|
|
your web server and run this command on the bp.pl script:
|
|
|
|
/srv/www/htdocs/agc/bp.pl --pass=test
|
|
|
|
You can also use the above command to generate a new password hash if you have
|
|
forgotten your password and update the database with the new value manually:
|
|
|
|
UPDATE vicidial_users set pass_hash='kfYvywV959fn09rSZML70wHjjxsaYjm' where user='123';
|