Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-5039

Encrypt by default user passwords stored in an SQL database

    XMLWordPrintable

    Details

    • Type: New Feature
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 5.3.2
    • Component/s: None
    • Impact type:
      Configuration format change
    • Upgrade notes:
      Hide

      To activate password encryption, add to your configuration file (default-sql-directories-bundle.xml by default):
      <passwordHashAlgorithm>SSHA</passwordHashAlgorithm>
      after <passwordField>...</passwordField>

      The other algorithm available is SMD5.

      This is fully backward-compatible as old cleartext passwords will still be recognized and used. Whenever a user entry is modified the password will be encrypted if it's not already.

      Show
      To activate password encryption, add to your configuration file (default-sql-directories-bundle.xml by default): <passwordHashAlgorithm>SSHA</passwordHashAlgorithm> after <passwordField>...</passwordField> The other algorithm available is SMD5. This is fully backward-compatible as old cleartext passwords will still be recognized and used. Whenever a user entry is modified the password will be encrypted if it's not already.

      Description

      In order to avoid password leaks if a server's database is compromised, the user passwords stored in the SQL database should be encrypted and salted by default.

        Attachments

          Issue Links

          is required by

          Improvement - An improvement or enhancement to an existing feature or task. NXP-5147 Make it possible to use encrypted passwords for virtual users defined in xml contribution files

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

            Activity

              People

              • Assignee:
                fguillaume Florent Guillaume
                Reporter:
                fguillaume Florent Guillaume
                Participants:
              • Votes:
                1 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: