From e2612c7873a9bbc79e9c250e700d634792570e59 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Tue, 29 Jul 2008 16:19:53 -0400 Subject: on the security of this plugin.. --- doc/plugins/contrib/unixauth/discussion.mdwn | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 doc/plugins/contrib/unixauth/discussion.mdwn (limited to 'doc/plugins/contrib/unixauth') diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn new file mode 100644 index 000000000..162e5d323 --- /dev/null +++ b/doc/plugins/contrib/unixauth/discussion.mdwn @@ -0,0 +1,17 @@ +The security of this plugin scares me. As noted in the plugin +documentation, you basically have to use it with SSL, since snooping on the +login password doesn't give you an essentially useless account -- it gives +you an actual account on the machine! + +Also, apparently pwauth defers *all* auth attempts if one fails, and it +does this by using a lock file, and sleeping after a failed auth attempt. +Which is needed to avoid brute-forcing, since this is a significant +password.. but how will that interact with ikiwiki? Well, ikiwiki _also_ +uses a lock file. So, at a minimum, someone can not only try to brute-force +the pwauth password, but the ikiwiki processes that stack up due to that +will also keep ikiwiki's lock held. Which basically DOSes the wiki for +everyone else; noone else can try to log in, or log out, or edit a page, +all of which require taking the lock. + +So I don't think I'll be accepting this plugin into ikiwiki itself.. +--[[Joey]] -- cgit v1.2.3 From 6838f9b6e5fb39a307eef3f7eea20497d4398f8b Mon Sep 17 00:00:00 2001 From: "http://schmonz.livejournal.com/" Date: Tue, 29 Jul 2008 21:45:17 -0400 Subject: --- doc/plugins/contrib/unixauth/discussion.mdwn | 2 ++ 1 file changed, 2 insertions(+) (limited to 'doc/plugins/contrib/unixauth') diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn index 162e5d323..5f542745d 100644 --- a/doc/plugins/contrib/unixauth/discussion.mdwn +++ b/doc/plugins/contrib/unixauth/discussion.mdwn @@ -15,3 +15,5 @@ all of which require taking the lock. So I don't think I'll be accepting this plugin into ikiwiki itself.. --[[Joey]] + +Thanks for the comments. That's definitely an undesirable interaction between pwauth and ikiwiki; in my current application it wouldn't be a serious problem, but I'd like this plugin to be general-purpose and safe enough for inclusion in ikiwiki. It's the system-users-are-wiki-users idea I'm married to here, not pwauth itself; can you suggest another approach I might take? -- cgit v1.2.3 From e55c0798441111170d731eb3ec7a4874dadda79b Mon Sep 17 00:00:00 2001 From: "http://schmonz.livejournal.com/" Date: Tue, 29 Jul 2008 21:45:50 -0400 Subject: --- doc/plugins/contrib/unixauth/discussion.mdwn | 1 + 1 file changed, 1 insertion(+) (limited to 'doc/plugins/contrib/unixauth') diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn index 5f542745d..7bfdc9665 100644 --- a/doc/plugins/contrib/unixauth/discussion.mdwn +++ b/doc/plugins/contrib/unixauth/discussion.mdwn @@ -17,3 +17,4 @@ So I don't think I'll be accepting this plugin into ikiwiki itself.. --[[Joey]] Thanks for the comments. That's definitely an undesirable interaction between pwauth and ikiwiki; in my current application it wouldn't be a serious problem, but I'd like this plugin to be general-purpose and safe enough for inclusion in ikiwiki. It's the system-users-are-wiki-users idea I'm married to here, not pwauth itself; can you suggest another approach I might take? +-- [[schmonz]] -- cgit v1.2.3 From 2c1e02aa4574f6c264aee6e498da4d0ed6b2ed4b Mon Sep 17 00:00:00 2001 From: "http://www.cse.unsw.edu.au/~willu/" Date: Tue, 29 Jul 2008 23:39:15 -0400 Subject: alternate suggestion --- doc/plugins/contrib/unixauth/discussion.mdwn | 2 ++ 1 file changed, 2 insertions(+) (limited to 'doc/plugins/contrib/unixauth') diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn index 7bfdc9665..91c59ff1d 100644 --- a/doc/plugins/contrib/unixauth/discussion.mdwn +++ b/doc/plugins/contrib/unixauth/discussion.mdwn @@ -18,3 +18,5 @@ So I don't think I'll be accepting this plugin into ikiwiki itself.. Thanks for the comments. That's definitely an undesirable interaction between pwauth and ikiwiki; in my current application it wouldn't be a serious problem, but I'd like this plugin to be general-purpose and safe enough for inclusion in ikiwiki. It's the system-users-are-wiki-users idea I'm married to here, not pwauth itself; can you suggest another approach I might take? -- [[schmonz]] + +> Have you considered using [[plugins/httpauth]] and then the appropriate apache module? There are apache modules like [mod_authnz_external](http://unixpapa.com/mod_auth_external.html) that might help. The advantage of these solutions is that they usually make the security implications explicit. -- Will -- cgit v1.2.3 From dd25c7c4afa8f57e909fed63fb6bcf1648de531b Mon Sep 17 00:00:00 2001 From: "http://schmonz.livejournal.com/" Date: Wed, 30 Jul 2008 01:25:05 -0400 Subject: --- doc/plugins/contrib/unixauth/discussion.mdwn | 3 +++ 1 file changed, 3 insertions(+) (limited to 'doc/plugins/contrib/unixauth') diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn index 91c59ff1d..863e3c91a 100644 --- a/doc/plugins/contrib/unixauth/discussion.mdwn +++ b/doc/plugins/contrib/unixauth/discussion.mdwn @@ -20,3 +20,6 @@ Thanks for the comments. That's definitely an undesirable interaction between pw -- [[schmonz]] > Have you considered using [[plugins/httpauth]] and then the appropriate apache module? There are apache modules like [mod_authnz_external](http://unixpapa.com/mod_auth_external.html) that might help. The advantage of these solutions is that they usually make the security implications explicit. -- Will + +Actually, yes. That's how I made sure I had pwauth working to begin with. I'm partial to the form-based approach because I'm not aware of any way to reliably "log out" browsers from HTTP authentication. If that *is* reliably possible, then I worked way too hard for no reason. ;-) +-- [[schmonz]] -- cgit v1.2.3 From 3b9fe3a1b64b011a72b6c54cb172a27922250d8b Mon Sep 17 00:00:00 2001 From: "http://schmonz.livejournal.com/" Date: Wed, 30 Jul 2008 12:21:55 -0400 Subject: update --- doc/plugins/contrib/unixauth/discussion.mdwn | 3 +++ 1 file changed, 3 insertions(+) (limited to 'doc/plugins/contrib/unixauth') diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn index 863e3c91a..a209b9030 100644 --- a/doc/plugins/contrib/unixauth/discussion.mdwn +++ b/doc/plugins/contrib/unixauth/discussion.mdwn @@ -23,3 +23,6 @@ Thanks for the comments. That's definitely an undesirable interaction between pw Actually, yes. That's how I made sure I had pwauth working to begin with. I'm partial to the form-based approach because I'm not aware of any way to reliably "log out" browsers from HTTP authentication. If that *is* reliably possible, then I worked way too hard for no reason. ;-) -- [[schmonz]] + +I've added support for [checkpassword](http://cr.yp.to/checkpwd/interface.html), since those generally don't have any rate-limiting cleverness to interfere with ikiwiki's, and made a few other changes. Please check out the plugin docs again and let me know if this is closer to being acceptable. +-- [[schmonz]] -- cgit v1.2.3 From 5e85039dc3a329a064a0d3053bbca2ed066f5292 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Wed, 30 Jul 2008 15:47:28 -0400 Subject: response --- doc/plugins/contrib/unixauth/discussion.mdwn | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'doc/plugins/contrib/unixauth') diff --git a/doc/plugins/contrib/unixauth/discussion.mdwn b/doc/plugins/contrib/unixauth/discussion.mdwn index a209b9030..c4f5ff269 100644 --- a/doc/plugins/contrib/unixauth/discussion.mdwn +++ b/doc/plugins/contrib/unixauth/discussion.mdwn @@ -26,3 +26,7 @@ Actually, yes. That's how I made sure I had pwauth working to begin with. I'm pa I've added support for [checkpassword](http://cr.yp.to/checkpwd/interface.html), since those generally don't have any rate-limiting cleverness to interfere with ikiwiki's, and made a few other changes. Please check out the plugin docs again and let me know if this is closer to being acceptable. -- [[schmonz]] + +> I actually think that the rate limiting is a good thing. After all, +> ikiwiki doesn't do its own login rate limiting. Just need to find a way +> to disentangle the two locks. --[[Joey]] -- cgit v1.2.3