Re: Using Notes for User Authentication [FIDUCIA virengeprüft - ohne Gewähr, daß alle bekannten Viren und deren Varianten erkannt wurden.]

Hi!


> On Tue, Jul 22, m0s3r wrote:
>
>> used by the app. The pw is encrypted. But if the app knows,
>> how domino encrypts the field, the app. can encrypt the
>> users not encrypted pw and then compare the LDAP-entry with
>> the tipped and encrypted pw. How does domino encrypt the pw?
>> Or is it quite simpler?

There are two different modes possible:
1. Compare what was send with what was stored.
   No matter what was stored.
2. kerberos 5 auth.

At the moment Domino doesn't support the second.

> Then you would allow anonymous uses access to the encrypted
> password and thats not very desirable. Normally you do it
> this way: Try to bind to the LDAP server with the binddn of
> the user and send the tipped password to the server. If the
> bind succeeds, the password has been correct. This is how
> pam_ldap is working in Linux, for instance.
>
> The problem is, that you have to send the unencrypted tipped
> password over the network. So you should consider to secure
> your LDAP connection via TLS or SSL.

This is as if you've been sending the unencripted password over an 
unprotected wire. The encripted password might be usefull for a "playback" 
attack. Thus: passwords, wether encripted or unencripted, should never, 
never (!) go over an unprotected line!

Domino supports LDAP over SSL. Just a configuration option. I've found it 
beeing more practicaly creating my self-signed certs for SSL using 
OpenSSL, not the build in Domino function for these. Maybe I did something 
wrong, but with OpenSSL I was able to create a self signed certificate 
with endless lifetime. Domino did only offer me 60 days expire at longest.

-- 
Thomas