Re: Security hole?

The security hole is in the measures you might not take for protecting
the root account on that machine.  There's no way to encrypt the
password and decrypt it back when time comes to use it, that an attacker
couldn't figure out.  So, we take the simple route: either you save the
password (in clear text), or you don't save it and get prompted each
time.

El lun, 24-01-2005 a las 18:01 -0500, Ryan Golhar escribió:
> The program creates a directory called .directory_administrator which
> contains a file called profiles which contains information on connecting
> to the LDAP server.  It stores the password used for connecting in clear
> text.  
> 
> The file itself has group,world read permissions, however the directory
> does not.  
> 
> Since I use the root acocunt to connect to the ldap directory, I tend to
> consider this a security hole as the password is in plain view should
> anyone gain access to my account...
> 
> Ryan
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> Directoryadmin-list mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/directoryadmin-list
-- 
Manuel Amador (Rudd-O) <[email protected]>


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl