[Openvas-commits] r3317 - in trunk/openvas-server: . doc openvasd

scm-commit@wald.intevation.org scm-commit at wald.intevation.org
Mon May 11 11:05:30 CEST 2009


Author: mwiegand
Date: 2009-05-11 11:05:29 +0200 (Mon, 11 May 2009)
New Revision: 3317

Modified:
   trunk/openvas-server/ChangeLog
   trunk/openvas-server/doc/openvas-adduser.8
   trunk/openvas-server/openvas-adduser.in
   trunk/openvas-server/openvasd/users.c
Log:
Implementing the first part of Change Request #31: Remove support for
plaintext password storage (http://www.openvas.org/openvas-cr-31.html).

* openvasd/users.c (check_user): openvasd will now display a warning
message on both stderr and the logfile when it encounters a password
stored in plaintext.

* openvas-adduser.in: Adding users without a working md5 algorithm is no
longer possible. Added an exit 1 in case no algorithm is found, removed
now obsolete reference to plaintext storage when storing credentials.

* doc/openvas-adduser.8: Updated, removed obsolete parts.


Modified: trunk/openvas-server/ChangeLog
===================================================================
--- trunk/openvas-server/ChangeLog	2009-05-11 08:34:39 UTC (rev 3316)
+++ trunk/openvas-server/ChangeLog	2009-05-11 09:05:29 UTC (rev 3317)
@@ -1,3 +1,18 @@
+2009-05-11  Michael Wiegand <michael.wiegand at intevation.de>
+
+	Implementing the first part of Change Request #31: Remove support for
+	plaintext password storage (http://www.openvas.org/openvas-cr-31.html).
+
+	* openvasd/users.c (check_user): openvasd will now display a warning
+	message on both stderr and the logfile when it encounters a password
+	stored in plaintext.
+
+	* openvas-adduser.in: Adding users without a working md5 algorithm is no
+	longer possible. Added an exit 1 in case no algorithm is found, removed
+	now obsolete reference to plaintext storage when storing credentials.
+
+	* doc/openvas-adduser.8: Updated, removed obsolete parts.
+
 2009-05-05  Jan Wagner <waja at cyconet.org>
 
 	* packaging/debian/changelog: reengineered Michaels changes :P

Modified: trunk/openvas-server/doc/openvas-adduser.8
===================================================================
--- trunk/openvas-server/doc/openvas-adduser.8	2009-05-11 08:34:39 UTC (rev 3316)
+++ trunk/openvas-server/doc/openvas-adduser.8	2009-05-11 09:05:29 UTC (rev 3317)
@@ -1,4 +1,4 @@
-.TH OpenVAS-ADDUSER 8 "April 2000" "The OpenVAS Project" "User Manuals"
+.TH OpenVAS-ADDUSER 8 "May 2009" "The OpenVAS Project" "User Manuals"
 .SH NAME
 openvas-adduser \- add a user in the openvasd userbase
 .sp
@@ -17,11 +17,9 @@
 each user has.
 
 .B openvas-adduser
-is a simple program which will add a user in the proper 
+is a simple program which will add a user to the
 .B openvasd
-configuration files, and will send a signal to 
-.B openvasd
-if it is running to notify it of the changes.
+userbase.
 
 The program is straightforward and asks for the following items:
 .IP "\(bu Login"
@@ -33,14 +31,6 @@
 the password that the user will use to connect to 
 .B openvasd
 
-.IP "\(bu Authentification type"
-the authentification method the client will use. The recommended
-method is \*(lqcipher\*(rq. However, if you compiled 
-.B openvasd 
-without the 
-cipher support or if you are using a OpenVAS client which does not
-support the cipher layer, you'll have to use \*(lqplaintext\*(rq
-
 .IP "\(bu Rules"
 the set of rules to apply to the user. See below.
 
@@ -105,7 +95,7 @@
 .RE
 
 .SH SEE ALSO
-.BR openvas-rmuser (8),\  openvasd (8),\  openvas (1)
+.BR openvas-rmuser (8),\  openvasd (8)
 
 .SH MORE INFORMATION ABOUT THE OpenVAS PROJECT
 The canonical places where you will find more information 
@@ -115,11 +105,6 @@
 http://www.openvas.org/
 .UE
 (Official site)
-.br
-.UR
-http://cvs.openvas.org
-.UE
-(Developers site)
 .RE
    
 

Modified: trunk/openvas-server/openvas-adduser.in
===================================================================
--- trunk/openvas-server/openvas-adduser.in	2009-05-11 08:34:39 UTC (rev 3316)
+++ trunk/openvas-server/openvas-adduser.in	2009-05-11 09:05:29 UTC (rev 3317)
@@ -100,7 +100,9 @@
       "$X" = "401B30E3B8B5D629635A5C613CDB7919" ]; then
   MD5CMD=md5sum
  else
-  MD5CMD=""
+  gettext "No MD5 algorithm found in the current path!"; echo
+  gettext "Please make sure either openssl or md5sum is available!"; echo
+  exit 1
  fi
 fi
 
@@ -293,7 +295,6 @@
 chmod 0700 "$localstatedir/lib/openvas/users/$login/auth"
 
 if [ "$auth" = "pass" ]; then
-    if [ "$MD5CMD" ]; then
     	test -c /dev/urandom &&
 	{
 	URANDOM=`dd if=/dev/urandom bs=16 count=16 2>/dev/null|$MD5CMD`
@@ -301,9 +302,6 @@
 	SEED=`(echo $SEED; date; df; ls -l; echo $URANDOM) | $MD5CMD | awk '{print $1}'`
 	H=`echo $Xn $SEED$password$Xc | $MD5CMD | awk '{print $1}'`
 	echo $H $SEED > "$localstatedir/lib/openvas/users/$login/auth/hash"
-    else
-	echo "$password" > "$localstatedir/lib/openvas/users/$login/auth/password"
-    fi
 elif [ "$auth" = "cert" ]; then
 	echo "$dn" > "$localstatedir/lib/openvas/users/$login/auth/dname"
 fi

Modified: trunk/openvas-server/openvasd/users.c
===================================================================
--- trunk/openvas-server/openvasd/users.c	2009-05-11 08:34:39 UTC (rev 3316)
+++ trunk/openvas-server/openvasd/users.c	2009-05-11 09:05:29 UTC (rev 3317)
@@ -268,6 +268,26 @@
    if ((f = fopen(fname, "r")) == NULL)
      return BAD_LOGIN_ATTEMPT;
    
+   fprintf (stderr, "\n===========================================================\n");
+   fprintf (stderr, "WARNING! Plaintext password found in:\n");
+   fprintf (stderr, "  %s\n", fname);
+   fprintf (stderr, "The account for user \"%s\" may have been compromised!\n", user);
+   fprintf (stderr, "Please create a new account with openvas-adduser and\n");
+   fprintf (stderr, "delete this account!\n");
+   fprintf (stderr, "Support for passwords stored in plaintext will be\n");
+   fprintf (stderr, "removed in the next openvas-server release!");
+   fprintf (stderr, "\n===========================================================\n");
+
+   log_write ("\n===========================================================\n");
+   log_write ("WARNING! Plaintext password found in:\n");
+   log_write ("  %s\n", fname);
+   log_write ("The account for user \"%s\" may have been compromised!\n", user);
+   log_write ("Please create a new account with openvas-adduser and\n");
+   log_write ("delete this account!\n");
+   log_write ("Support for passwords stored in plaintext will be\n");
+   log_write ("removed in the next openvas-server release!");
+   log_write ("\n===========================================================\n");
+
    bzero(orig, sizeof(orig));
    fgets(orig, sizeof ( orig ) - 1, f);
    fclose(f);



More information about the Openvas-commits mailing list