From 04a9f4a2f3e0856a159f0fe1f7776bd85cbfaabf Mon Sep 17 00:00:00 2001 From: laf Date: Mon, 3 Feb 2014 10:45:34 +0000 Subject: [PATCH 1/5] Updated mysql auth to use PHPass --- html/includes/PasswordHash.php | 253 +++++++++++++++++++++ html/includes/authenticate.inc.php | 1 + html/includes/authentication/mysql.inc.php | 26 ++- sql-schema/028.sql | 1 + 4 files changed, 276 insertions(+), 5 deletions(-) create mode 100644 html/includes/PasswordHash.php create mode 100644 sql-schema/028.sql diff --git a/html/includes/PasswordHash.php b/html/includes/PasswordHash.php new file mode 100644 index 000000000..12958c7f1 --- /dev/null +++ b/html/includes/PasswordHash.php @@ -0,0 +1,253 @@ + in 2004-2006 and placed in +# the public domain. Revised in subsequent years, still public domain. +# +# There's absolutely no warranty. +# +# The homepage URL for this framework is: +# +# http://www.openwall.com/phpass/ +# +# Please be sure to update the Version line if you edit this file in any way. +# It is suggested that you leave the main version number intact, but indicate +# your project name (after the slash) and add your own revision information. +# +# Please do not change the "private" password hashing method implemented in +# here, thereby making your hashes incompatible. However, if you must, please +# change the hash type identifier (the "$P$") to something different. +# +# Obviously, since this code is in the public domain, the above are not +# requirements (there can be none), but merely suggestions. +# +class PasswordHash { + var $itoa64; + var $iteration_count_log2; + var $portable_hashes; + var $random_state; + + function PasswordHash($iteration_count_log2, $portable_hashes) + { + $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; + + if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31) + $iteration_count_log2 = 8; + $this->iteration_count_log2 = $iteration_count_log2; + + $this->portable_hashes = $portable_hashes; + + $this->random_state = microtime(); + if (function_exists('getmypid')) + $this->random_state .= getmypid(); + } + + function get_random_bytes($count) + { + $output = ''; + if (is_readable('/dev/urandom') && + ($fh = @fopen('/dev/urandom', 'rb'))) { + $output = fread($fh, $count); + fclose($fh); + } + + if (strlen($output) < $count) { + $output = ''; + for ($i = 0; $i < $count; $i += 16) { + $this->random_state = + md5(microtime() . $this->random_state); + $output .= + pack('H*', md5($this->random_state)); + } + $output = substr($output, 0, $count); + } + + return $output; + } + + function encode64($input, $count) + { + $output = ''; + $i = 0; + do { + $value = ord($input[$i++]); + $output .= $this->itoa64[$value & 0x3f]; + if ($i < $count) + $value |= ord($input[$i]) << 8; + $output .= $this->itoa64[($value >> 6) & 0x3f]; + if ($i++ >= $count) + break; + if ($i < $count) + $value |= ord($input[$i]) << 16; + $output .= $this->itoa64[($value >> 12) & 0x3f]; + if ($i++ >= $count) + break; + $output .= $this->itoa64[($value >> 18) & 0x3f]; + } while ($i < $count); + + return $output; + } + + function gensalt_private($input) + { + $output = '$P$'; + $output .= $this->itoa64[min($this->iteration_count_log2 + + ((PHP_VERSION >= '5') ? 5 : 3), 30)]; + $output .= $this->encode64($input, 6); + + return $output; + } + + function crypt_private($password, $setting) + { + $output = '*0'; + if (substr($setting, 0, 2) == $output) + $output = '*1'; + + $id = substr($setting, 0, 3); + # We use "$P$", phpBB3 uses "$H$" for the same thing + if ($id != '$P$' && $id != '$H$') + return $output; + + $count_log2 = strpos($this->itoa64, $setting[3]); + if ($count_log2 < 7 || $count_log2 > 30) + return $output; + + $count = 1 << $count_log2; + + $salt = substr($setting, 4, 8); + if (strlen($salt) != 8) + return $output; + + # We're kind of forced to use MD5 here since it's the only + # cryptographic primitive available in all versions of PHP + # currently in use. To implement our own low-level crypto + # in PHP would result in much worse performance and + # consequently in lower iteration counts and hashes that are + # quicker to crack (by non-PHP code). + if (PHP_VERSION >= '5') { + $hash = md5($salt . $password, TRUE); + do { + $hash = md5($hash . $password, TRUE); + } while (--$count); + } else { + $hash = pack('H*', md5($salt . $password)); + do { + $hash = pack('H*', md5($hash . $password)); + } while (--$count); + } + + $output = substr($setting, 0, 12); + $output .= $this->encode64($hash, 16); + + return $output; + } + + function gensalt_extended($input) + { + $count_log2 = min($this->iteration_count_log2 + 8, 24); + # This should be odd to not reveal weak DES keys, and the + # maximum valid value is (2**24 - 1) which is odd anyway. + $count = (1 << $count_log2) - 1; + + $output = '_'; + $output .= $this->itoa64[$count & 0x3f]; + $output .= $this->itoa64[($count >> 6) & 0x3f]; + $output .= $this->itoa64[($count >> 12) & 0x3f]; + $output .= $this->itoa64[($count >> 18) & 0x3f]; + + $output .= $this->encode64($input, 3); + + return $output; + } + + function gensalt_blowfish($input) + { + # This one needs to use a different order of characters and a + # different encoding scheme from the one in encode64() above. + # We care because the last character in our encoded string will + # only represent 2 bits. While two known implementations of + # bcrypt will happily accept and correct a salt string which + # has the 4 unused bits set to non-zero, we do not want to take + # chances and we also do not want to waste an additional byte + # of entropy. + $itoa64 = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; + + $output = '$2a$'; + $output .= chr(ord('0') + $this->iteration_count_log2 / 10); + $output .= chr(ord('0') + $this->iteration_count_log2 % 10); + $output .= '$'; + + $i = 0; + do { + $c1 = ord($input[$i++]); + $output .= $itoa64[$c1 >> 2]; + $c1 = ($c1 & 0x03) << 4; + if ($i >= 16) { + $output .= $itoa64[$c1]; + break; + } + + $c2 = ord($input[$i++]); + $c1 |= $c2 >> 4; + $output .= $itoa64[$c1]; + $c1 = ($c2 & 0x0f) << 2; + + $c2 = ord($input[$i++]); + $c1 |= $c2 >> 6; + $output .= $itoa64[$c1]; + $output .= $itoa64[$c2 & 0x3f]; + } while (1); + + return $output; + } + + function HashPassword($password) + { + $random = ''; + + if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) { + $random = $this->get_random_bytes(16); + $hash = + crypt($password, $this->gensalt_blowfish($random)); + if (strlen($hash) == 60) + return $hash; + } + + if (CRYPT_EXT_DES == 1 && !$this->portable_hashes) { + if (strlen($random) < 3) + $random = $this->get_random_bytes(3); + $hash = + crypt($password, $this->gensalt_extended($random)); + if (strlen($hash) == 20) + return $hash; + } + + if (strlen($random) < 6) + $random = $this->get_random_bytes(6); + $hash = + $this->crypt_private($password, + $this->gensalt_private($random)); + if (strlen($hash) == 34) + return $hash; + + # Returning '*' on error is safe here, but would _not_ be safe + # in a crypt(3)-like function used _both_ for generating new + # hashes and for validating passwords against existing hashes. + return '*'; + } + + function CheckPassword($password, $stored_hash) + { + $hash = $this->crypt_private($password, $stored_hash); + if ($hash[0] == '*') + $hash = crypt($password, $stored_hash); + + return $hash == $stored_hash; + } +} + +?> diff --git a/html/includes/authenticate.inc.php b/html/includes/authenticate.inc.php index 543e6416b..b68073af7 100644 --- a/html/includes/authenticate.inc.php +++ b/html/includes/authenticate.inc.php @@ -1,6 +1,7 @@ CheckPassword($password, $row['password'])) { return 1; } @@ -62,7 +74,9 @@ function generateSalt($max = 15) function changepassword($username,$password) { - $encrypted = crypt($password,'$1$' . generateSalt(8).'$'); + //$encrypted = crypt($password,'$1$' . generateSalt(8).'$'); + $hasher = new PasswordHash(8, FALSE); + $encrypted = $hasher->HashPassword($password); return dbUpdate(array('password' => $encrypted), 'users', '`username` = ?', array($username)); } @@ -75,7 +89,9 @@ function adduser($username, $password, $level, $email = "", $realname = "", $can { if (!user_exists($username)) { - $encrypted = crypt($password,'$1$' . generateSalt(8).'$'); + //$encrypted = crypt($password,'$1$' . generateSalt(8).'$'); + $hasher = new PasswordHash(8, FALSE); + $encrypted = $hasher->HashPassword($password); return dbInsert(array('username' => $username, 'password' => $encrypted, 'level' => $level, 'email' => $email, 'realname' => $realname, 'can_modify_passwd' => $can_modify_passwd), 'users'); } else { return FALSE; diff --git a/sql-schema/028.sql b/sql-schema/028.sql new file mode 100644 index 000000000..d076e410b --- /dev/null +++ b/sql-schema/028.sql @@ -0,0 +1 @@ +ALTER TABLE `users` CHANGE `password` `password` VARCHAR( 60 ); From 005504ae6da262cdeb7541519d35fcb62e36afff Mon Sep 17 00:00:00 2001 From: laf Date: Mon, 3 Feb 2014 22:32:45 +0000 Subject: [PATCH 2/5] Updated session / cookie support --- html/includes/authenticate.inc.php | 52 ++++++++++++++----- .../includes/authentication/http-auth.inc.php | 5 ++ html/includes/authentication/ldap.inc.php | 5 ++ html/includes/authentication/mysql.inc.php | 16 ++++++ includes/defaults.inc.php | 1 + sql-schema/029.sql | 2 + 6 files changed, 67 insertions(+), 14 deletions(-) create mode 100644 sql-schema/029.sql diff --git a/html/includes/authenticate.inc.php b/html/includes/authenticate.inc.php index b68073af7..005f426ca 100644 --- a/html/includes/authenticate.inc.php +++ b/html/includes/authenticate.inc.php @@ -1,6 +1,8 @@ Temp Directory is not writable ({$config['tmp_dir']}). Graphing may fail."); } +// Clear up any old sessions +dbDelete('session', "`session_expiry` < ?", array(time())); + if ($vars['page'] == "logout" && $_SESSION['authenticated']) { dbInsert(array('user' => $_SESSION['username'], 'address' => $_SERVER["REMOTE_ADDR"], 'result' => 'Logged Out'), 'authlog'); + dbDelete('session', "`session_username` = ? AND session_value = ?", array($_SESSION['username'],$_COOKIE['sess_id'])); unset($_SESSION); + unset($_COOKIE); + setcookie ("sess_id", "", time() - 60*60*24*$config['auth_remember'], "/"); + setcookie ("token", "", time() - 60*60*24*$config['auth_remember'], "/"); + setcookie ("auth", "", time() - 60*60*24*$config['auth_remember'], "/"); session_destroy(); - setcookie ("username", "", time() - 60*60*24*100, "/"); - setcookie ("password", "", time() - 60*60*24*100, "/"); $auth_message = "Logged Out"; header('Location: /'); exit; } -if (isset($_GET['username']) && isset($_GET['password'])) -{ - $_SESSION['username'] = mres($_GET['username']); - $_SESSION['password'] = $_GET['password']; -} elseif (isset($_POST['username']) && isset($_POST['password'])) { +// We are only interested in login details passed via POST. +if (isset($_POST['username']) && isset($_POST['password'])) { $_SESSION['username'] = mres($_POST['username']); $_SESSION['password'] = $_POST['password']; -} elseif (isset($_COOKIE['username']) && isset($_COOKIE['password'])) { - $_SESSION['username'] = mres($_COOKIE['username']); - $_SESSION['password'] = $_COOKIE['password']; } if (!isset($config['auth_mechanism'])) @@ -62,10 +64,12 @@ else $auth_success = 0; -if (isset($_SESSION['username'])) +if ((isset($_SESSION['username'])) || (isset($_COOKIE['sess_id'],$_COOKIE['token']))) { - if (authenticate($_SESSION['username'],$_SESSION['password'])) + if ((authenticate($_SESSION['username'],$_SESSION['password'])) || (reauthenticate($_COOKIE['sess_id'],$_COOKIE['token']))) { + // Regenerate session id for additional security. + session_regenerate_id(); $_SESSION['userlevel'] = get_userlevel($_SESSION['username']); $_SESSION['user_id'] = get_userid($_SESSION['username']); if (!$_SESSION['authenticated']) @@ -76,8 +80,28 @@ if (isset($_SESSION['username'])) } if (isset($_POST['remember'])) { - setcookie("username", $_SESSION['username'], time()+60*60*24*100, "/"); - setcookie("password", $_SESSION['password'], time()+60*60*24*100, "/"); + $sess_id = session_id(); + $hasher = new PasswordHash(8, FALSE); + $token = strgen(); + $auth = strgen(); + $hasher = new PasswordHash(8, FALSE); + $token_id = $_SESSION['username'].'|'.$hasher->HashPassword($_SESSION['username'].$token); + // If we have been asked to remember the user then set the relevant cookies and create a session in the DB. + setcookie("sess_id", $sess_id, time()+60*60*24*$config['auth_remember'], "/", null, null, true); + setcookie("token", $token_id, time()+60*60*24*$config['auth_remember'], "/", null, null, true); + setcookie("auth", $auth, time()+60*60*24*$config['auth_remember'], "/", null, null, true); + dbInsert(array('session_username' => $_SESSION['username'], 'session_value' => $sess_id, 'session_token' => $token, 'session_auth' => $auth, 'session_expiry' => time()+60*60*24*$config['auth_remember']), 'session'); + //setcookie("username", $_SESSION['username'], time()+60*60*24*100, "/"); + //setcookie("password", $_SESSION['password'], time()+60*60*24*100, "/"); + } + if (isset($_COOKIE['sess_id'],$_COOKIE['token'],$_COOKIE['auth'])) + { + // If we have the remember me cookies set then update session expiry times to keep us logged in. + $sess_id = session_id(); + dbUpdate(array('session_value' => $sess_id, 'session_expiry' => time()+60*60*24*$config['auth_remember']), 'session', 'session_auth=?', array($_COOKIE['auth'])); + setcookie("sess_id", $sess_id, time()+60*60*24*$config['auth_remember'], "/", null, null, true); + setcookie("token", $_COOKIE['token'], time()+60*60*24*$config['auth_remember'], "/", null, null, true); + setcookie("auth", $_COOKIE['auth'], time()+60*60*24*$config['auth_remember'], "/", null, null, true); } $permissions = permissions_cache($_SESSION['user_id']); } diff --git a/html/includes/authentication/http-auth.inc.php b/html/includes/authentication/http-auth.inc.php index e34a0dde2..9b0f51107 100644 --- a/html/includes/authentication/http-auth.inc.php +++ b/html/includes/authentication/http-auth.inc.php @@ -27,6 +27,11 @@ function authenticate($username,$password) return 0; } +function reauthenticate($sess_id = "",$token = "") +{ + return 0; +} + function passwordscanchange($username = "") { return 0; diff --git a/html/includes/authentication/ldap.inc.php b/html/includes/authentication/ldap.inc.php index 1d4e7cc20..d640097d7 100644 --- a/html/includes/authentication/ldap.inc.php +++ b/html/includes/authentication/ldap.inc.php @@ -49,6 +49,11 @@ function authenticate($username,$password) return 0; } +function reauthenticate($sess_id,$token) +{ + return 0; +} + function passwordscanchange($username = "") { return 0; diff --git a/html/includes/authentication/mysql.inc.php b/html/includes/authentication/mysql.inc.php index a639af54d..91cc8f189 100644 --- a/html/includes/authentication/mysql.inc.php +++ b/html/includes/authentication/mysql.inc.php @@ -36,6 +36,22 @@ function authenticate($username,$password) return 0; } +function reauthenticate($sess_id,$token) +{ + list($uname,$hash) = explode("|",$token); + $session = dbFetchRow("SELECT * FROM `session` WHERE `session_username` = '$uname' AND session_value='$sess_id'"); + $hasher = new PasswordHash(8, FALSE); + if($hasher->CheckPassword($uname.$session['session_token'],$hash)) + { + $_SESSION['username'] = $uname; + return 1; + } + else + { + return 0; + } +} + function passwordscanchange($username = "") { /* diff --git a/includes/defaults.inc.php b/includes/defaults.inc.php index e96e505f6..f06b1137d 100644 --- a/includes/defaults.inc.php +++ b/includes/defaults.inc.php @@ -390,6 +390,7 @@ $config['irc_chan'][] = "##" . $config['project_id']; $config['allow_unauth_graphs'] = 0; # Allow graphs to be viewed by anyone $config['allow_unauth_graphs_cidr'] = array(); # Allow graphs to be viewed without authorisation from certain IP ranges $config['auth_mechanism'] = "mysql"; # Available mechanisms: mysql (default), ldap, http-auth +$config['auth_remember'] = '30'; # This is how long in days to remember users who select remember me // LDAP Authentication diff --git a/sql-schema/029.sql b/sql-schema/029.sql new file mode 100644 index 000000000..d6e8a5714 --- /dev/null +++ b/sql-schema/029.sql @@ -0,0 +1,2 @@ +CREATE TABLE IF NOT EXISTS `session` ( `session_id` int(11) NOT NULL AUTO_INCREMENT, `session_username` varchar(30) NOT NULL, `session_value` varchar(60) NOT NULL, `session_token` varchar(60) NOT NULL, `session_auth` varchar(16) NOT NULL, `session_expiry` int(11) NOT NULL, PRIMARY KEY (`session_id`)) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ; + From 18f9b89639712ae7d25a7d4cd8be3e8b3dd4ab0f Mon Sep 17 00:00:00 2001 From: laf Date: Sun, 23 Feb 2014 17:55:07 +0000 Subject: [PATCH 3/5] Removed code that was previously commented out --- html/includes/authenticate.inc.php | 2 -- html/includes/authentication/mysql.inc.php | 2 -- 2 files changed, 4 deletions(-) diff --git a/html/includes/authenticate.inc.php b/html/includes/authenticate.inc.php index 005f426ca..e8e15900b 100644 --- a/html/includes/authenticate.inc.php +++ b/html/includes/authenticate.inc.php @@ -91,8 +91,6 @@ if ((isset($_SESSION['username'])) || (isset($_COOKIE['sess_id'],$_COOKIE['token setcookie("token", $token_id, time()+60*60*24*$config['auth_remember'], "/", null, null, true); setcookie("auth", $auth, time()+60*60*24*$config['auth_remember'], "/", null, null, true); dbInsert(array('session_username' => $_SESSION['username'], 'session_value' => $sess_id, 'session_token' => $token, 'session_auth' => $auth, 'session_expiry' => time()+60*60*24*$config['auth_remember']), 'session'); - //setcookie("username", $_SESSION['username'], time()+60*60*24*100, "/"); - //setcookie("password", $_SESSION['password'], time()+60*60*24*100, "/"); } if (isset($_COOKIE['sess_id'],$_COOKIE['token'],$_COOKIE['auth'])) { diff --git a/html/includes/authentication/mysql.inc.php b/html/includes/authentication/mysql.inc.php index 91cc8f189..67b2c5990 100644 --- a/html/includes/authentication/mysql.inc.php +++ b/html/includes/authentication/mysql.inc.php @@ -90,7 +90,6 @@ function generateSalt($max = 15) function changepassword($username,$password) { - //$encrypted = crypt($password,'$1$' . generateSalt(8).'$'); $hasher = new PasswordHash(8, FALSE); $encrypted = $hasher->HashPassword($password); return dbUpdate(array('password' => $encrypted), 'users', '`username` = ?', array($username)); @@ -105,7 +104,6 @@ function adduser($username, $password, $level, $email = "", $realname = "", $can { if (!user_exists($username)) { - //$encrypted = crypt($password,'$1$' . generateSalt(8).'$'); $hasher = new PasswordHash(8, FALSE); $encrypted = $hasher->HashPassword($password); return dbInsert(array('username' => $username, 'password' => $encrypted, 'level' => $level, 'email' => $email, 'realname' => $realname, 'can_modify_passwd' => $can_modify_passwd), 'users'); From 519e4aba844659c4b70275e775a20351691e3e0f Mon Sep 17 00:00:00 2001 From: laf Date: Sun, 23 Feb 2014 22:05:22 +0000 Subject: [PATCH 4/5] Update PasswordHash.php --- html/includes/PasswordHash.php | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/html/includes/PasswordHash.php b/html/includes/PasswordHash.php index 12958c7f1..bdce4439e 100644 --- a/html/includes/PasswordHash.php +++ b/html/includes/PasswordHash.php @@ -48,10 +48,17 @@ class PasswordHash { function get_random_bytes($count) { $output = ''; - if (is_readable('/dev/urandom') && - ($fh = @fopen('/dev/urandom', 'rb'))) { - $output = fread($fh, $count); - fclose($fh); + + $output = openssl_random_pseudo_bytes($count,$strong); + + if(empty($count)) + { + if (is_readable('/dev/urandom') && + ($fh = @fopen('/dev/urandom', 'rb'))) + { + $output = fread($fh, $count); + fclose($fh); + } } if (strlen($output) < $count) { From 1fffec8e2d9031b65d4c5a7197cfd9f02974e913 Mon Sep 17 00:00:00 2001 From: laf Date: Tue, 25 Feb 2014 23:45:12 +0000 Subject: [PATCH 5/5] Update PasswordHash.php Updated line 54 to $output. --- html/includes/PasswordHash.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/includes/PasswordHash.php b/html/includes/PasswordHash.php index bdce4439e..757d47d55 100644 --- a/html/includes/PasswordHash.php +++ b/html/includes/PasswordHash.php @@ -51,7 +51,7 @@ class PasswordHash { $output = openssl_random_pseudo_bytes($count,$strong); - if(empty($count)) + if(empty($output)) { if (is_readable('/dev/urandom') && ($fh = @fopen('/dev/urandom', 'rb')))