You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by "pascal.barbedor@laposte.net" <pa...@laposte.net> on 2003/01/22 15:21:51 UTC
[MP2] pb with startup.pl and LibXML
Hi I have
SERVER_SOFTWARE: Apache/2.0.43 (Win32) mod_perl/1.99_08-dev
Perl/v5.8.0 PHP/4.3.0
installed from theoryx5 all-in-one archive
here is the problem I have :
-----------------------------------------
package testxml;
use strict;
use warnings;
use XML::LibXML();
use XML::LibXSLT();
use Data::Dumper;
my $base='c:/apache2/mason';
my $promod=
XML::LibXSLT->new->parse_stylesheet(
XML::LibXML->new->parse_file("$base/stylesheets/test.xsl"));
print Dumper $promod ;
1;
-----------------------------------------------
the above script runs ok when PERL testxml.pm is run. (outside
of any apache environment)
Dumper prints
bless XML::LibXSLT::Stylesheet..
showing
all parsing ok (the stylesheets is simplisssima one tag sheet)
when it is USEed from startup.pl (# removed below in startup)
then
it also prints the line
bless ...
but apache issues a fatal error and refuses to
start "instruction 0X28027104 memory cant be read !"
here is the startup.pl
use Apache2 ();
use lib 'c:/apache2/mason/lib';
use ModPerl::Util ();
use Apache::RequestRec ();
use Apache::RequestIO ();
use Apache::RequestUtil ();
use Apache::Server ();
use Apache::ServerUtil ();
use Apache::Connection ();
use Apache::Log ();
use Apache::Const -compile => ':common';
use APR::Const -compile => ':common';
use APR::Table ();
use Apache::compat ();
use ModPerl::Registry ();
use CGI ();
use XML::LibXML();
use XML::LibXSLT();
#use testxml;
1;
same thing if you omit the xslt step in the testxml script
I pointed out this problem from the early distribution of
modperl2, it's not recent.
thanks
pascal
Accédez au courrier électronique de La Poste : www.laposte.net ;
3615 LAPOSTENET (0,13 /mn) ; tél : 08 92 68 13 50 (0,34/mn)"
Re: mysql password encryption
Posted by Joachim Zobel <nc...@netcologne.de>.
On Wed, 2003-01-22 at 16:29, Martin Moss wrote:
> I wish to let a user use the same password for them to authenticate to a
> multitude of mysql Databases AND to authenticate themselves on my modperl
> site.
> the problem I have is that I store the password in the database as a
> Password field. However when I wish to use DBI to connect to another mysql
> database I cannot use the Password stored in the database as it comes out
> encrypted. I really don't want to store the unencrypted password anywhere
> on the system. Is there a way to let DBI/mysql know that the password I am
> giving them is ALREADY encrypted?
>
> Has anybody else solved a problem like this?
You could use the encrypted password as the password to the remote
database. This however also defeats the purpose of encryption with
respect to the remote mysql.
How do you keep the local mysql password between requests? This is IMHO
essentially the same problem.
Is there a way to replicate the user/passwoerd table?
Hth,
Joachim
Re: mysql password encryption
Posted by Martin Moss <Ma...@btinternet.com>.
Cheers for all your help,
I realised that I didn't need to worry about decrypting the passwords as I
can use the encrypted password with GRANT. so it solved my problem.
I guess I'll have to group my grants by table rather than permission though.
Regards
Marty
----- Original Message -----
From: "Joe Palladino" <jo...@palladinos.org>
To: "Cees Hek" <ce...@sitesuite.com.au>; "Martin Moss"
<ma...@btinternet.com>
Cc: "Modperl" <mo...@perl.apache.org>
Sent: Thursday, January 23, 2003 3:44 PM
Subject: RE: mysql password encryption
> Are the databases under the same database engine instance? If they are
its
> not a problem as the password is the system table users and you can grant
> access for that user to various databases in the system table database.
To
> use the encrypted password field, use the password('password') function
> supplied by the MySQL library. It only encrypts your password string, but
> it will let you do a compare of the strings.
>
> Hope this helps.
> Joe
>
> -----Original Message-----
> From: Cees Hek [mailto:cees@sitesuite.com.au]
> Sent: Wednesday, January 22, 2003 11:29 AM
> To: Martin Moss
> Cc: Modperl
> Subject: Re: mysql password encryption
>
> Quoting Martin Moss <Ma...@btinternet.com>:
>
> > All,
> >
> > I wish to let a user use the same password for them to authenticate to a
> > multitude of mysql Databases AND to authenticate themselves on my
modperl
> > site.
> > the problem I have is that I store the password in the database as a
> > Password field. However when I wish to use DBI to connect to another
mysql
> > database I cannot use the Password stored in the database as it comes
out
> > encrypted. I really don't want to store the unencrypted password
anywhere
> > on the system. Is there a way to let DBI/mysql know that the password I
am
> > giving them is ALREADY encrypted?
>
> A feature like that would defeat the purpose of encrypting the password in
> the
> first place. The point of encrypting the password is so that if someone
> gets
> their hands on the password list, they can not use the encrypted password
to
> access the system. They would have to crack the passwords first before
> using
> them to access the system.
>
> By allowing someone to access the system with an already encrypted
password,
> then your passwords might as well not be encrypted at all.
>
> Since you are using MySQL, have you looked at using the
> mysql_read_default_file
> option to store your password in a config file? Using a DSN like the
> following
> allows you to keep the username and password in a config file. Check the
> DBD::mysql perldocs for more info, and the MySQL docs for all the
parameters
> you
> can put in such a file.
>
> DBI:mysql:test;mysql_read_default_file=/etc/mysql/test.my.conf
>
> and in /etc/mysql/test.my.conf
>
> [client]
> user = www
> password = thebigsecretpassword
>
> Then protect the file:
>
> chown www /etc/mysql/test.my.conf
> chmod 400 /etc/mysql/test.my.conf
>
> You still have the password in plain text, but it is readable only by root
> and
> the user that runs the webserver. You can use this to connect to multiple
> MySQL
> servers as long as the access tokens are the same on all servers.
>
> Cees
> ---
> Incoming mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.443 / Virus Database: 248 - Release Date: 1/10/2003
>
>
RE: mysql password encryption
Posted by Joe Palladino <jo...@palladinos.org>.
Are the databases under the same database engine instance? If they are its
not a problem as the password is the system table users and you can grant
access for that user to various databases in the system table database. To
use the encrypted password field, use the password('password') function
supplied by the MySQL library. It only encrypts your password string, but
it will let you do a compare of the strings.
Hope this helps.
Joe
-----Original Message-----
From: Cees Hek [mailto:cees@sitesuite.com.au]
Sent: Wednesday, January 22, 2003 11:29 AM
To: Martin Moss
Cc: Modperl
Subject: Re: mysql password encryption
Quoting Martin Moss <Ma...@btinternet.com>:
> All,
>
> I wish to let a user use the same password for them to authenticate to a
> multitude of mysql Databases AND to authenticate themselves on my modperl
> site.
> the problem I have is that I store the password in the database as a
> Password field. However when I wish to use DBI to connect to another mysql
> database I cannot use the Password stored in the database as it comes out
> encrypted. I really don't want to store the unencrypted password anywhere
> on the system. Is there a way to let DBI/mysql know that the password I am
> giving them is ALREADY encrypted?
A feature like that would defeat the purpose of encrypting the password in
the
first place. The point of encrypting the password is so that if someone
gets
their hands on the password list, they can not use the encrypted password to
access the system. They would have to crack the passwords first before
using
them to access the system.
By allowing someone to access the system with an already encrypted password,
then your passwords might as well not be encrypted at all.
Since you are using MySQL, have you looked at using the
mysql_read_default_file
option to store your password in a config file? Using a DSN like the
following
allows you to keep the username and password in a config file. Check the
DBD::mysql perldocs for more info, and the MySQL docs for all the parameters
you
can put in such a file.
DBI:mysql:test;mysql_read_default_file=/etc/mysql/test.my.conf
and in /etc/mysql/test.my.conf
[client]
user = www
password = thebigsecretpassword
Then protect the file:
chown www /etc/mysql/test.my.conf
chmod 400 /etc/mysql/test.my.conf
You still have the password in plain text, but it is readable only by root
and
the user that runs the webserver. You can use this to connect to multiple
MySQL
servers as long as the access tokens are the same on all servers.
Cees
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.443 / Virus Database: 248 - Release Date: 1/10/2003
Re: mysql password encryption
Posted by Cees Hek <ce...@sitesuite.com.au>.
Quoting Martin Moss <Ma...@btinternet.com>:
> All,
>
> I wish to let a user use the same password for them to authenticate to a
> multitude of mysql Databases AND to authenticate themselves on my modperl
> site.
> the problem I have is that I store the password in the database as a
> Password field. However when I wish to use DBI to connect to another mysql
> database I cannot use the Password stored in the database as it comes out
> encrypted. I really don't want to store the unencrypted password anywhere
> on the system. Is there a way to let DBI/mysql know that the password I am
> giving them is ALREADY encrypted?
A feature like that would defeat the purpose of encrypting the password in the
first place. The point of encrypting the password is so that if someone gets
their hands on the password list, they can not use the encrypted password to
access the system. They would have to crack the passwords first before using
them to access the system.
By allowing someone to access the system with an already encrypted password,
then your passwords might as well not be encrypted at all.
Since you are using MySQL, have you looked at using the mysql_read_default_file
option to store your password in a config file? Using a DSN like the following
allows you to keep the username and password in a config file. Check the
DBD::mysql perldocs for more info, and the MySQL docs for all the parameters you
can put in such a file.
DBI:mysql:test;mysql_read_default_file=/etc/mysql/test.my.conf
and in /etc/mysql/test.my.conf
[client]
user = www
password = thebigsecretpassword
Then protect the file:
chown www /etc/mysql/test.my.conf
chmod 400 /etc/mysql/test.my.conf
You still have the password in plain text, but it is readable only by root and
the user that runs the webserver. You can use this to connect to multiple MySQL
servers as long as the access tokens are the same on all servers.
Cees
Re: mysql password encryption
Posted by Perrin Harkins <pe...@elem.com>.
Martin Moss wrote:
> the problem I have is that I store the password in the database as a
> Password field. However when I wish to use DBI to connect to another mysql
> database I cannot use the Password stored in the database as it comes out
> encrypted. I really don't want to store the unencrypted password anywhere
> on the system. Is there a way to let DBI/mysql know that the password I am
> giving them is ALREADY encrypted?
Why don't you just encrypt it yourself and store it in a VARCHAR?
- Perrin
mysql password encryption
Posted by Martin Moss <Ma...@btinternet.com>.
All,
I wish to let a user use the same password for them to authenticate to a
multitude of mysql Databases AND to authenticate themselves on my modperl
site.
the problem I have is that I store the password in the database as a
Password field. However when I wish to use DBI to connect to another mysql
database I cannot use the Password stored in the database as it comes out
encrypted. I really don't want to store the unencrypted password anywhere
on the system. Is there a way to let DBI/mysql know that the password I am
giving them is ALREADY encrypted?
Has anybody else solved a problem like this?
Regards
Marty
Re: [MP2] pb with startup.pl and LibXML
Posted by Randy Kobes <ra...@theoryx5.uwinnipeg.ca>.
On Wed, 22 Jan 2003, [iso-8859-1] pascal.barbedor@laposte.net wrote:
> Hi I have
>
> SERVER_SOFTWARE: Apache/2.0.43 (Win32) mod_perl/1.99_08-dev
> Perl/v5.8.0 PHP/4.3.0
>
> installed from theoryx5 all-in-one archive
>
>
> here is the problem I have :
> -----------------------------------------
> package testxml;
> use strict;
> use warnings;
> use XML::LibXML();
> use XML::LibXSLT();
> use Data::Dumper;
> my $base='c:/apache2/mason';
> my $promod=
> XML::LibXSLT->new->parse_stylesheet(
> XML::LibXML->new->parse_file("$base/stylesheets/test.xsl"));
> print Dumper $promod ;
> 1;
> -----------------------------------------------
>
> the above script runs ok when PERL testxml.pm is run. (outside
> of any apache environment)
> Dumper prints
>
> bless XML::LibXSLT::Stylesheet..
>
> showing
> all parsing ok (the stylesheets is simplisssima one tag sheet)
>
> when it is USEed from startup.pl (# removed below in startup)
> then
> it also prints the line
>
> bless ...
>
> but apache issues a fatal error and refuses to
> start "instruction 0X28027104 memory cant be read !"
>
>
> here is the startup.pl
>
> use Apache2 ();
> use lib 'c:/apache2/mason/lib';
> use ModPerl::Util ();
> use Apache::RequestRec ();
> use Apache::RequestIO ();
> use Apache::RequestUtil ();
> use Apache::Server ();
> use Apache::ServerUtil ();
> use Apache::Connection ();
> use Apache::Log ();
> use Apache::Const -compile => ':common';
> use APR::Const -compile => ':common';
> use APR::Table ();
> use Apache::compat ();
> use ModPerl::Registry ();
> use CGI ();
> use XML::LibXML();
> use XML::LibXSLT();
> #use testxml;
> 1;
>
>
> same thing if you omit the xslt step in the testxml script
>
> I pointed out this problem from the early distribution of
> modperl2, it's not recent.
Is it just when used from the startup file that problems
arise? Does it run OK within Apache as, eg, part of
a registry script? And if not, is it OK within an ordinary
cgi script?
Does adding a
LoadFile "/Path/to/libxml2.dll"
directive, before pulling in the startup script, help?
(in the distribution from our site, libxml2.dll is in
the Perl/bin/ directory).
--
best regards,
randy