Re: scaling issues with security_tokens

On Tue, Jan 24, 2012 at 1:22 PM, Micah Anderson <[email protected]> wrote:
>
> I am having a problem with scaling squirrelmail because of the update
> frequency of the security_tokens. It seems as though a new
> security_token is generated and put into the database (via a REPLACE
> INTO userprefs) everytime a squirrelmail user does anything in
> squirrelmail... perhaps with some exceptions (I did not look that
> closely).
>
> This may not be a big deal when you only have a few users, but when you
> have 39k users, this starts to really hammer the database. It also makes
> replication a major pain because every single one of those userprefs
> updates results in a query written to the binary log that then needs to
> be replayed on the replication slave.
>
> I've set $max_token_age_days = 1; but that only affects how much data
> accumulates in the security_tokens, but it doesn't affect the number of
> updates.
>
> Besides turning these off, which does not seem like a good idea, could
> there be a better way to handle these?

You could turn it off and enable referrer checking.  Referrer checking
is a good alternative safety mechanism as long as you understand that
any users whose browsers do not send referrer information will not
have the benefits of this security check (such users would be
vulnerable to CSRF attacks, although it may be reasonable to argue
that users who know enough to turn off referrer sending in their
browsers are savvy enough to know such attacks when they see them).

Back to the security tokens, I had originally considered a
configuration element to force the use of just a single token but
didn't implement it at the time with the hopes that multiple tokens
could add obscurity or at least confuse an attacker.  But I'm not
convinced that having multiple tokens really adds concrete security,
so I can propose the attached patch which makes SquirrelMail instead
use just one token per user (with the option to revert to previous
behavior by adding "$do_not_use_single_token = TRUE;" (without quotes)
to config/config_local.php).  The single token will still rotate once
per hour for active users, or at worst once every $max_token_age_days
(default 2 days).

See attached patch - if I can get feedback, I will add it for version 1.4.23.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d

-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

Index: functions/strings.php
===================================================================
--- functions/strings.php	(revision 14262)
+++ functions/strings.php	(working copy)
@@ -1325,6 +1325,15 @@
   * the user's preferences with a timestamp for later
   * verification/use.
   *
+  * NOTE: The administrator can force SquirrelMail to generate
+  * a new token every time one is requested (which may increase
+  * obscurity through token randomness at the cost of some
+  * performance) by adding the following to
+  * config/config_local.php:   $do_not_use_single_token = TRUE;
+  * Otherwise, only one token will be generated per user which
+  * will change only after it expires or is used outside of the
+  * validity period specified when calling sm_validate_security_token()
+  *
   * WARNING: If the administrator has turned the token system
   *          off by setting $disable_security_tokens to TRUE in
   *          config/config.php or the configuration tool, this
@@ -1340,11 +1349,14 @@
 function sm_generate_security_token()
 {
 
-   global $data_dir, $username, $disable_security_tokens;
+   global $data_dir, $username, $disable_security_tokens, $do_not_use_single_token;
    $max_generation_tries = 1000;
 
    $tokens = sm_get_user_security_tokens();
 
+   if (!$do_not_use_single_token && !empty($tokens))
+      return key($tokens);
+
    $new_token = GenerateRandomString(12, '', 7);
    $count = 0;
    while (isset($tokens[$new_token]))