passwords | 易学教程

PHP/PAM to change user password?

阅读更多关于 PHP/PAM to change user password?

Are there any working packages to change a linux user passwords using PHP? I've tried using PECL:PAM but theres an error when it tries to change the password. Edit: PHP code: echo pam_chpass($username, $password, $new_pass, &$error) ? 'good' : $error; PHP (echo) output: Permission denied (in pam_authenticate) From /var/log/auth (these are actually from before, the log doesn't seem to be working ATM for some reason yet to be determined): Jun 11 15:30:20 veda php: pam_unix(php:chauthtok): conversation failed Jun 11 15:30:20 veda php: pam_unix(php:chauthtok): password - (old) token not obtained

generate a secure password in javascript

阅读更多关于 generate a secure password in javascript

问题 What's the quickest way to generate a secure password in javascript? I want it to contain at least 1 special character, and 2 mixed case. Must be at least 6 characters long. 回答1: Here are some useful String functions: String.prototype.pick = function(min, max) { var n, chars = ''; if (typeof max === 'undefined') { n = min; } else { n = min + Math.floor(Math.random() * (max - min + 1)); } for (var i = 0; i < n; i++) { chars += this.charAt(Math.floor(Math.random() * this.length)); } return

What is the proper way of handling configurations (database login and passwords, etc.) in a dynamic web project?

阅读更多关于 What is the proper way of handling configurations (database login and passwords, etc.) in a dynamic web project?

I just got my hands on doing dynamic web programming using JSP. What is the proper way to handle the configurations? For example, database name, host, login, and password, and indexing directory in the server, etc. My concern is mostly about the security of the passwords. Currently I hard code the data into the .java files, I don't think this is the right way to do so I would like to learn from your experiences. BalusC Configuration is usually stored in a properties or XML file which is been placed in the application's runtime classpath or at a fixed location which is specified as a VM

Best way of doing code for “Forgotten Password”

阅读更多关于 Best way of doing code for “Forgotten Password”

问题 net website, i would like to implement forget password. I am using following steps Form having input box for login Id and email Id and CAPTCHA when user enter details and submit, at backend after validation new password is generated and replaced old password at database. New passowrd is send to user at email. Please help me whether i am doing right or not? Is there any other secure mechanism for the same? [EDIT] Thanks, i got your reply. Really this is a secure mechanism. But here i have few

Ruby on Rails, Devise gem. How to remove current password when password is blank?

阅读更多关于 Ruby on Rails, Devise gem. How to remove current password when password is blank?

Now I realise this topic has been covered many times before. However there did not appear to be a solution that wanted to make the current password field exempt only when the password in the database was blank. I currently have the password required in my user model like: def password_required? (authentications.empty? || !password.blank?) && super end Then I copied the update function across into my registrations controller: def update if resource.update_with_password(params[resource_name]) set_flash_message :notice, :updated sign_in resource_name, resource, :bypass => true redirect_to after

Email address as password salt?

阅读更多关于 Email address as password salt?

问题 Is it a bad idea to use an email address as the salt for a password? 回答1: EDIT: Let me refer you to this answer on Security StackExchange which explains a lot of details about password hashing and key derivation. Bottom line: Use a secure established password hashing scheme that is somehow resource-intensive to protect against brute-force attacks, but limit the number of permitted invocations to prevent denial-of-service (DoS) attacks. If your language library has a function for it, verify on

Web Application - Storing a Password

阅读更多关于 Web Application - Storing a Password

问题 Have I missed anything? Are there any additional steps storing passwords to the DB? Storing the Password: After as much research on the subject as possible I've come to the conclusion that the best way to store user passwords in a web application DB (in my case MySQL+PHP) is as follows: Assign a sitewide static salt. (16 rand chars incl 0-9,a-z,A-Z,[]/*-') Assign a per user random salt (stored in the DB). Store the result hash_function($userPassword + $sitewideSalt + $randomSalt) Store the

Migrate passwords from Drupal 7 to Django

阅读更多关于 Migrate passwords from Drupal 7 to Django

I am migrating a site from Drupal 7 to Django 1.4, including the current users. How can I work with the passwords that were hashed by Drupal? According to this , Drupal 7 hashes passwords using SHA-512 (they are stored in the form of a string starting with "$S$"). Django 1.4 now contains a number of options for storing passwords, with a default of SHA-256, but I can't find an option for SHA-512. While this app appears to allow the use of SHA2 algorithms, I'm not sure it's compatible with Django 1.4 (as 1.4 has a flexible password hasher). What is the simplest way to do this? ETA: I've built a

How secure is storing salts along with hashed password

阅读更多关于 How secure is storing salts along with hashed password

If you had looked at table schema of asp.net membership system they store the hash of raw password along with salt used to produce it. see the schema below, dbo.aspnet_Membership ApplicationId UserId Password PasswordFormat PasswordSalt MobilePIN Email . . . If a attacker gets hold of the datbase isn't it easier for him to crack open the raw password from the salt and hashed password? After looking into some records it seems a new salt is generated for each password. What is significance of this? Would you recommend such a approach, or hard-code constant salt in the code Related Are salts

Are passwords on modern Unix/Linux systems still limited to 8 characters?

阅读更多关于 Are passwords on modern Unix/Linux systems still limited to 8 characters?

问题 Years ago it used to be the case that Unix passwords were limited to 8 characters, or that if you made the password longer than 8 characters the extra wouldn't make any difference. Is that still the case on most modern Unix/Linux systems? If so, around when did longer passwords become possible on most systems? Is there an easy way to tell if a given system supports longer passwords and if so, what the effective maximum (if any) would be? I've done some web searching on this topic and couldn't