|
Grex > Agorage > #4: Proposal: Eliminate grex's custom password hash. | |
|
| Author |
Message |
| 25 new of 81 responses total. |
tod
|
|
response 50 of 81:
| 
Sep 27 16:57 UTC 2006 |
The change is absolutely non-urgent, so I don't see much reason
to do it before then.
How about: "Why not?"
If there are staff folks willing to perform upgrades or implement standards
then why stop them?
If a major upgrade or emergency is the prerequisite for module improvements
then lets simply state it so nobody gets too invested in the garage conference
in discussions under false pretenses.
|
cross
|
|
response 51 of 81:
|
Sep 27 19:35 UTC 2006 |
Regarding #49; I think that's sensible, though another couple of points I'd
throw out are that (a) this doesn't necessarily involve any downtime, and (b)
there's nothing that says you can't put the pieces in slowly. For instance,
the current login code handles both OpenBSD's native password format and
grex's. We could modify (potentially) plop in the new version of newuser at
any time with no effect on existing users at all. Similarly, the passwd
command could be put in at any time. The changes to wnu were just to the
Makefile (to get it to link against some the stuff I added to newuser to
support the OpenBSD hash format). That could be done at any time. A
potential plan could be to pick the least frequently used of these commands,
put it in, watch for trouble for a few weeks, move in the next
least-frequently used command, watch for trouble, etc. The slight advantage
over doing it all during an upgrade is that *if* there's a problem and the
changes need to be backed out (and it's not discovered during the upgrade
itself) you aren't stuck backing everything out at the same time.
I also agree with Todd that it's not *so* risky as to be undoable before the
next upgrade.
I'd champion the middle ground, piecemeal approach, so that it could be backed
out at the first sign of trouble.
|
tod
|
|
response 52 of 81:
|
Sep 27 19:37 UTC 2006 |
re #51
I'd champion the middle ground, piecemeal approach, so that it could be
backed out at the first sign of trouble.
I'm betting anything you suggest "fixing" will get the kebosh if it has any
vested ego behind it.
|
cross
|
|
response 53 of 81:
|
Sep 27 22:10 UTC 2006 |
It's up to them to prove you wrong.
|
tod
|
|
response 54 of 81:
|
Sep 27 22:33 UTC 2006 |
re #53
Yes, I'm baiting. Thanks for waving your arms and jumping on the pier.
|
cross
|
|
response 55 of 81:
|
Sep 27 22:40 UTC 2006 |
You lost me, coach.
|
gull
|
|
response 56 of 81:
|
Oct 2 23:02 UTC 2006 |
My feeling is that altering the login routine to change hashes is an
unnecessary complication. If you just set passwd up to use the
standard hash, normal password expiration will eventually get us
switched over. (Assuming passwords still expire...come to think of it,
mine hasn't in a while.)
|
cross
|
|
response 57 of 81:
|
Oct 2 23:08 UTC 2006 |
They don't; I think password expiration got turned off with the move to
OpenBSD on the i386.
|
cross
|
|
response 58 of 81:
|
Oct 7 05:44 UTC 2006 |
So, Steve said we won't do this without discussion. Marcus posted some
comments but hasn't responded to the latest round of responses. Where do
people sit with this?
|
gull
|
|
response 59 of 81:
|
Oct 7 20:26 UTC 2006 |
It goes into the Grex Process, where people talk it to death until
everyone loses interest, and eventually it's let slide unless some kind
of disaster happens. This is very similar to the Seattle Process, which
is how transportation issues are managed here in the Pacific Northwest.
|
cross
|
|
response 60 of 81:
|
Oct 7 20:56 UTC 2006 |
How true.
|
tod
|
|
response 61 of 81:
|
Oct 7 21:04 UTC 2006 |
re #59
The light rail is on track but I know what you mean if you're referring to
the viaduct.
|
spooked
|
|
response 62 of 81:
|
Oct 7 22:24 UTC 2006 |
I was about to laugh... but, then I realised this is really quite sad
cause it could not be more true.
|
gull
|
|
response 63 of 81:
|
Oct 8 07:25 UTC 2006 |
Re resp:61: The viaduct, the 520 bridge, the monorail...take your pick.
|
tod
|
|
response 64 of 81:
|
Oct 8 16:29 UTC 2006 |
Too true
Now if only the Army Corps of Engineers would step up to replace the Viaduct
since they originally made it and if Nicholls and the Seattle circus would
keep their noses out of roadway decisions then...
Monorail should be strictly a mayor's call, imo
|
cross
|
|
response 65 of 81:
|
Oct 20 01:21 UTC 2006 |
An interesting discussion with Solar Designer, the author of the ``John the
Ripper'' software cracker. He discusses password security and the OpenBSD
bcrypt algorithm.
http://www.securityfocus.com/columnists/388/2
|
cross
|
|
response 66 of 81:
|
Oct 20 13:36 UTC 2006 |
As I read over my responses, I'm amazed by the number of typos I make.
|
cross
|
|
response 67 of 81:
|
Oct 20 13:39 UTC 2006 |
Btw- as an experiment, I grafted support for grexhash into John the Ripper.
It was pretty easy; it took about an hour.
Also, regarding OpenBSD upgrades: OpenBSD only supports upgrades between
consecutive releases; grex is running OpenBSD 3.8 now. To do a supported
upgrade, it would have to upgrade to OpenBSD 3.9 and then to 4.0.
I don't think skipping releases is a particularly good idea.
|
cross
|
|
response 68 of 81:
|
Oct 23 03:30 UTC 2006 |
So this was proposed over a month ago, and serious discussion stopped about
that long ago. What's the deal?
|
naftee
|
|
response 69 of 81:
|
Oct 24 02:07 UTC 2006 |
that's GreX for you :(
|
cross
|
|
response 70 of 81:
|
Oct 24 02:34 UTC 2006 |
Yeah, it is. Sad.
|
null
|
|
response 71 of 81:
|
Mar 11 09:08 UTC 2007 |
*sings* Time keeps on slippin... into the future....
|
cross
|
|
response 72 of 81:
|
May 13 03:04 UTC 2007 |
I implemented this about a month ago. We now have the majority of grex users
using bcrypt'ed passwords.
|
cross
|
|
response 73 of 81:
|
Jul 1 04:28 UTC 2007 |
As of right now, all but 15 or so users are using bcrypt'ed passwords. Had
we plugged this in back in September, it would be down to three or four.
|
jared
|
|
response 74 of 81:
|
Jul 1 15:41 UTC 2007 |
yup, made me login :-P
|