Re: Security hole?

Instead of presenting a text edit with PAssword as the label, the
profile edit box should say:

[x] Remember password when prompted for it

And if the X is marked, then DA should save the password.

 
El mar, 25-01-2005 a las 08:24 -0800, Eric Sandall escribió:
> Quoting Graham Leggett <[email protected]>:
> <snip>
> > If somebody gained access to the root account, they could gain access to
> > the LDAP server database (if stored locally), or they could trojan the
> > directory_administrator binary, or they could sniff the LDAP connection
> > (if clear text) for the password, the password stored is the least of your
> > problems.
> >
> > However software that stores passwords locally should warn the user that
> > this is happening, and allow the user the option to not save the password
> > locally if the user so chooses. Your concern is definitely valid - where
> > an end user is not comfortable with saving passwords to disk, they should
> > be given the option not to.
> >
> > Regards,
> > Graham
> 
> So we'd just need an optional config in DA (perhaps disabled by default?) to
> store the password locally (in ~/.directory_administrator).
> 
> -sandalle
> 
> --
> Eric Sandall                     |  Source Mage GNU/Linux Developer
> [email protected] PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
> http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
> http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
> 
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> Directoryadmin-list mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/directoryadmin-list
-- 
Manuel Amador (Rudd-O) <[email protected]>


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl