You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by "Alex Karasulu (JIRA)" <ji...@apache.org> on 2007/10/15 15:29:50 UTC
[jira] Created: (DIRSERVER-1088) Do not cache plain text passwords
in credential cache or in LdapPrincipal
Do not cache plain text passwords in credential cache or in LdapPrincipal
-------------------------------------------------------------------------
Key: DIRSERVER-1088
URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
Project: Directory ApacheDS
Issue Type: Bug
Components: core
Affects Versions: 1.5.0, 1.5.1
Reporter: Alex Karasulu
Fix For: 1.5.2
It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DIRSERVER-1088) Do not cache plain text
passwords in credential cache or in LdapPrincipal
Posted by "Alex Karasulu (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12626247#action_12626247 ]
Alex Karasulu commented on DIRSERVER-1088:
------------------------------------------
Didn't you fix this Em?
> Do not cache plain text passwords in credential cache or in LdapPrincipal
> -------------------------------------------------------------------------
>
> Key: DIRSERVER-1088
> URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
> Project: Directory ApacheDS
> Issue Type: Bug
> Components: core
> Affects Versions: 1.5.1, 1.5.0
> Reporter: Alex Karasulu
> Fix For: 1.5.4
>
>
> It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
> If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (DIRSERVER-1088) Do not cache plain text passwords
in credential cache or in LdapPrincipal
Posted by "Emmanuel Lecharny (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emmanuel Lecharny reassigned DIRSERVER-1088:
--------------------------------------------
Assignee: Emmanuel Lecharny
> Do not cache plain text passwords in credential cache or in LdapPrincipal
> -------------------------------------------------------------------------
>
> Key: DIRSERVER-1088
> URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
> Project: Directory ApacheDS
> Issue Type: Bug
> Components: core
> Affects Versions: 1.5.1, 1.5.0
> Reporter: Alex Karasulu
> Assignee: Emmanuel Lecharny
> Fix For: 1.5.4
>
>
> It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
> If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (DIRSERVER-1088) Do not cache plain text passwords
in credential cache or in LdapPrincipal
Posted by "Emmanuel Lecharny (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emmanuel Lecharny resolved DIRSERVER-1088.
------------------------------------------
Resolution: Fixed
I have removed the LdapPrincipal which was stored into the LdapSession, as soon as the Bind operation is done. This will limit the password visibility to the minimum.
> Do not cache plain text passwords in credential cache or in LdapPrincipal
> -------------------------------------------------------------------------
>
> Key: DIRSERVER-1088
> URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
> Project: Directory ApacheDS
> Issue Type: Bug
> Components: core
> Affects Versions: 1.5.1, 1.5.0
> Reporter: Alex Karasulu
> Assignee: Emmanuel Lecharny
> Fix For: 1.5.4
>
>
> It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
> If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (DIRSERVER-1088) Do not cache plain text passwords
in credential cache or in LdapPrincipal
Posted by "Emmanuel Lecharny (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emmanuel Lecharny closed DIRSERVER-1088.
----------------------------------------
closed
> Do not cache plain text passwords in credential cache or in LdapPrincipal
> -------------------------------------------------------------------------
>
> Key: DIRSERVER-1088
> URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
> Project: Directory ApacheDS
> Issue Type: Bug
> Components: core
> Affects Versions: 1.5.1, 1.5.0
> Reporter: Alex Karasulu
> Assignee: Emmanuel Lecharny
> Fix For: 1.5.4
>
>
> It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
> If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DIRSERVER-1088) Do not cache plain text
passwords in credential cache or in LdapPrincipal
Posted by "Emmanuel Lecharny (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12626256#action_12626256 ]
Emmanuel Lecharny commented on DIRSERVER-1088:
----------------------------------------------
I have fixed a part of it, but we need to review it again, to be sure.
> Do not cache plain text passwords in credential cache or in LdapPrincipal
> -------------------------------------------------------------------------
>
> Key: DIRSERVER-1088
> URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
> Project: Directory ApacheDS
> Issue Type: Bug
> Components: core
> Affects Versions: 1.5.1, 1.5.0
> Reporter: Alex Karasulu
> Fix For: 1.5.4
>
>
> It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
> If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DIRSERVER-1088) Do not cache plain text passwords
in credential cache or in LdapPrincipal
Posted by "Emmanuel Lecharny (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emmanuel Lecharny updated DIRSERVER-1088:
-----------------------------------------
Fix Version/s: (was: 1.5.2)
1.5.3
I agree that it is a security breach, but we don't have time to fic it for this version...
Postponed to 1.5.3
> Do not cache plain text passwords in credential cache or in LdapPrincipal
> -------------------------------------------------------------------------
>
> Key: DIRSERVER-1088
> URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
> Project: Directory ApacheDS
> Issue Type: Bug
> Components: core
> Affects Versions: 1.5.1, 1.5.0
> Reporter: Alex Karasulu
> Fix For: 1.5.3
>
>
> It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
> If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DIRSERVER-1088) Do not cache plain text passwords
in credential cache or in LdapPrincipal
Posted by "Alex Karasulu (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DIRSERVER-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alex Karasulu updated DIRSERVER-1088:
-------------------------------------
Fix Version/s: (was: 1.5.3)
1.5.4
> Do not cache plain text passwords in credential cache or in LdapPrincipal
> -------------------------------------------------------------------------
>
> Key: DIRSERVER-1088
> URL: https://issues.apache.org/jira/browse/DIRSERVER-1088
> Project: Directory ApacheDS
> Issue Type: Bug
> Components: core
> Affects Versions: 1.5.1, 1.5.0
> Reporter: Alex Karasulu
> Fix For: 1.5.4
>
>
> It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.
> If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.