Re: NoCat and DES encryption
"Chris Whelan" <[email protected]>
| Newsgroups | gmane.network.nocat |
|---|---|
| Message-ID | <[email protected]> |
Maybe I'm just confusing the technology (I'm definately not a Perl expert) but it appears that the password is submitted plaintext, then it is "encrypted" in the perl script to the MD5_Base64 and compared to the existing already encrypted MD5_Base64 password. If they match, then it is successful. If not, obviously, they fail. Essentially, what I would like to do is just change the DBI.pm script to convert to DES instead of MD5_base64. I have passwords already encrypted in DES and if the module were to encrypt, then compare, my logic tells me they would match, and it would be successful. Am I misunderstanding how this works? Very possible... hehe. >>> jeffe <[email protected]> 11/19/04 04:14PM >>> The password is in plaintext in the html.. That is where the problem lies. If you are trying to put cyphertext in there, you will have nothing but headaches.. I made a rot13 alternative not that long ago, and posted a patch to the list, but someone has since taken that idea a bit further, and implemented a md5 hex solution.. jeff Chris Whelan wrote: >In the HTML form, isn't the password plaintext (encrypted with SSL to the server)? > > > >>>>jeffe <[email protected]> 11/19/04 02:48PM >>> >>>> >>>> >DES is not a suitable solution because of the characters involved in the >cyphertext. >Sometimes you will get odd characters that will mess your html renew >form all up.. > > >jeff > >Chris Whelan wrote: > > > >>I currently have the nocatauth system setup with two boxes. One is the gateway, the other is the authserv. The authserv currently has the Mysql database on it. It is working perfectly after a few hours of confusion (on my part). However, I have a username/password list that I have imported into the database that actually has the passwords encrypted with DES (13 characters). Obviously, NoCat uses MD5_Base64 encryption and isn't working with my list. What I would like to know is the following: >> >>1) Is there a way to make NoCat use DES instead of MD5_Base64? >> >>2) If I cannot do #1, does anyone know if the TACACS option is a viable solution? >> >>3) Has anyone written a PHP script to enter username/password combos into a database like I have? >> >>Any help is appreciated. Thank you all in advance, this is a great product! >> >>_______________________________________________ >>NoCat mailing list >>[email protected] >>http://lists.nocat.net/mailman/listinfo/nocat >> >> >> >> >> > > > >