The DMZ

« first day (2258 days earlier) ← previous day next day → last day (2920 days later) »

Stack Exchange

06:21

Good point--making no decision is itself a decision. So that's a THIRD option I have to research!

6 hours later…

RoraΖ

12:46

Can someone link me to the slack chat?

nvm

7 hours later…

EBrown

19:37

@AviD Are you about at the moment?

Or @Gilles?

At any rate, if either of you return, was wondering if a question would be on-topic here.

I'm building a client/server login system, was wondering if it could be secured further, I've detailed the salt and hashing code, as well as all the steps the client and server go through for login, and the fact that messages are back/forth in plain-text, but the password is hashed client-side then the hash is sent to the server.

Final paragraph with actual question:

> Can I improve this any further, or is this the best I can get? At a minimum I want to protect the plain-text password entered by the user so that it cannot (easily) be gathered by an attacker. I would also like to protect the communication between client/server if possible. At the moment an attacker could intercept the password hash and login as the player/user.

Gilles

20:00

@EBrown if the client hashes the password then the hash is the password!

why would you do that???

I'm sure we've had questions about this before

EBrown

@Gilles To protect the 'plain-text' password entered by the user.

Gilles

@EBrown i.e. you don't want the server to know the password, in case the user also uses it on another site?

then you need to double hash

again, we probably have a question about this already

EBrown

@Gilles Yes. I don't want the clear-text password to be interceptable, period.

@Gilles Well I'll try and find it if I get time, in the mean-time I suppose I'll go ask someone else.

Stack Exchange

20:52

Stack Overflow Podcast #101 - Matt Mullenweg on Open Source, Blogs, and Beyoncé

Kaitlin Pike on February 20, 2017

Welcome to the Stack Overflow Podcast #101. Fact: We now have as many episodes as we have adorable Disney dalmatians. Today's podcast is brought to you by the WordPress Development Stack Exchange.

3 hours later…

Gilles

23:40

Q: Audit and or monitor every command sent through an SSH connection?

I am writing because I need a way to monitor what my users send via ssh. I have a jumphost and I tried the following: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Configuring_PAM_for_Auditing.html both system-auth and password-auth have the ...