User Profile

beporter · Mar 12 '07, 05:26 PM

What I'm looking to avoid is having to manually log into the registrar's website and write everything down by hand.

beporter · Dec 1 '06, 06:49 PM

I haven't disappeared: just more sporadic availability.

Thanks for the feedback Al, that's very helpful. I still think the price point might be a sticking point, but it would definitely make it more reasonable with your explanations. It's odd that the default set of purchase options on the website doesn't really work together though.

I'll provide some more feedback as soon as I can!

beporter · Nov 23 '06, 05:44 PM

So to sum up, here's what it looks like we've come up with:

* Standard LAMP setup on a locked down server (only ports 80/443 open for Apache). Once the system is in place, I can have the owner of the company enter a new root password to help protect the console. Further, we can physically lock the machine up if necessary.

* MySQL database (locked down to only localhost access) with 3 tables:

Code:

   passwords{ int:id,

...

beporter · Nov 23 '06, 05:06 PM

Yes, I do need to protect against the employees who are technically less capable, but I also need to protect against an attacker that might be relatively competent. Yes, a garbled password would thwart the average employee, but would give us no extra protection against anyone else. The chances of such an attack are much lower of course, but the consequences are much worse.

However, the important thing to keep in mind is that the overall...

beporter · Nov 23 '06, 04:54 PM

I would prefer to avoid any Microsoft-centric technologies if a homebrew solutions is in order. Anything more "openly" available is fine though. I can handle just about any programming language, but Perl or PHP would probably be my first picks unless I was given a reason to use something else.

I've looked at quite a few open source solutions that already exists, such as KeePass, w3pw, Universal Password Manager, Password...

beporter · Nov 23 '06, 04:05 PM

Wow, that's darn near exactly what I am looking for. The system is RDBMS-based, which abstracts data storage and backup, it's accessible from the web so it's highly cross-platform, it has a high level of self-auditing, the storage of the passwords is done in a highly secure fashion, and it allows multiple concurrent user logins. It has extras that I wouldn't need in this case, such as per-user restrictions, but those can be ignored of course. I think...

beporter · Nov 23 '06, 03:42 PM

I'm not sure this would present a significant stumbling block for an attacker competent enough to obtain a dump of the MySQL database to begin with, but as I said in my previous post, it can't hurt.

That was my thinking as well. PHP, Perl, and a whole range of others are perfectly acceptable.

Again I agree. MySQL is a piece of cake.

Yes, I...

beporter · Nov 23 '06, 02:54 PM

Of course. Though if somebody does obtain a copy of the passwords table, the difference between whether it's encrypted or not will make very little difference-- really it will just be a matter of how much time it takes before they crack it. Computing power is cheap enough now that you might as well have given them an unencrypted copy. Somebody tell me if I'm off base.

Another good point. This will always be...

beporter · Nov 21 '06, 03:59 PM

Thank you very much for all of your feedback!

I'm afraid this is just one of many projects currently on my plate, and I apologize profusely if it takes me a little while to reply. I am anxious to sit down over the long weekend coming up and respond to all of your input, but right now I must attend to more pressing matters. (Clients are clients.)

Again, thank you all for your input, and I hope that this discussion will...

beporter · Nov 16 '06, 03:33 PM

Thanks yet again Killer. I've posted a redirect thread in the Database Lounge. Hopefully that might bring a couple new eyes here and generate some discussion. I won't give up hope yet, and I genuinely appreciate your help.

It's a shame that so many minds have to be so segregated. I mean, it makes sense to have topical boards for certain things, so that people who have very specific questions know the best place to ask them, but what...

beporter · Nov 15 '06, 02:07 PM

Well, 10 days and only one response, which unfortunately wasn't even so helpful. I can't believe nobody has any suggestions at all!

Thanks to Killer for his input.

I doubt I'll come back to thescripts.com for any future discussion.

beporter · Nov 10 '06, 02:09 PM

Please also keep in mind that the client requesting this "solution" is currently storing their passwords in cleartext in an Excel file hosted on an open network share. In other words, they are in critical need of a huge increase in security. The system doesn't have to be perfect, but it has to be a couple orders of magnitude better than what they have currently.

beporter · Nov 10 '06, 02:06 PM

A perfectly acceptable and reasonable point, however it unfortunately neglects the purpose the database. The passwords themselves need to be recoverable. That is, in fact, the whole point of the database: to securely store a number of passwords in a single location so that they can be retrieved and used later. I'm thinking a lot like the Mac OS X Keychain (the description here is better than Apple's if you are unfamiliar with the technology), except...

User Profile

Profile Sidebar

Leave a comment:

Shell Script to Dump all Domain Zone Records?

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Leave a comment:

Multi-user Password Database Solutions?