Re: Security hole?

what, they don't have the choice of not saving the password now?

I recall being able to save a profile without a password, and being
prompted upon login.

El mar, 25-01-2005 a las 09:51 +0200, Graham Leggett escribió:
> Ryan Golhar said:
> 
> > The program creates a directory called .directory_administrator which
> > contains a file called profiles which contains information on connecting
> > to the LDAP server.  It stores the password used for connecting in clear
> > text.
> >
> > The file itself has group,world read permissions, however the directory
> > does not.
> >
> > Since I use the root acocunt to connect to the ldap directory, I tend to
> > consider this a security hole as the password is in plain view should
> > anyone gain access to my account...
> 
> If somebody gained access to the root account, they could gain access to
> the LDAP server database (if stored locally), or they could trojan the
> directory_administrator binary, or they could sniff the LDAP connection
> (if clear text) for the password, the password stored is the least of your
> problems.
> 
> However software that stores passwords locally should warn the user that
> this is happening, and allow the user the option to not save the password
> locally if the user so chooses. Your concern is definitely valid - where
> an end user is not comfortable with saving passwords to disk, they should
> be given the option not to.
> 
> Regards,
> Graham
> --
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> Directoryadmin-list mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/directoryadmin-list
-- 
Manuel Amador <[email protected]>
Amauta


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl