I'm working on a android application that writes, in some parts, in a FileZilla server. In my code, I provide the login and password for the FileZilla so that the client could send some pictures and videos to it.
The client later on needs to read the FTP content (Display it), but for that purpose, he needs to enter the login and password, which I can't provide him otherwise he could write whatever he wants in my server.
Is there any way to require a login and password for writing in the FTP server, but not in the reading ??
You can setup two accounts on the server. One with read-only access, and one with write access. Provide the client with password to read-only account. Or you can allow even anonymous read-only access to the server.
EDIT: Also, be aware that it would not be a problem for a hacker to retrieve the hard-coded password from your Android application binary. Make sure you restrict the area, where the account can write to, ideally to a single folder only. You should also set disk quota for the account, so that the hacker cannot fill your server's disk. And you should definitelly monitor the writable folder for an unusual activity.
Related
I was wondering why FTP supports anonymous login ? Is it not a security issue that anyone can access files on a ftp server without having a real account ? And if anonymous account is a real good thing, what is its importance ?
If the publisher decided that the resource is public, anonymous access is perfectly valid. Take into account that FTP is just another network protocol as HTTP. If you are not scared about pubic http resources not sure why you should have any concern about FTP.
Historically FTP was widely used for placing files for public access, thus it had to support anonymous login. Note, that most servers don't support "no login" but require something like "Anonymous/guest" or "Anonymous/empty_password" login.
RFC 1635 describes "anonymous ftp" as follows:
Anonymous FTP is a means by which archive sites allow general access
to their archives of information. These sites create a special
account called "anonymous". User "anonymous" has limited access
rights to the archive host, as well as some operating restrictions.
In fact, the only operations allowed are logging in using FTP,
listing the contents of a limited set of directories, and retrieving
files. Some sites limit the contents of a directory listing an
anonymous user can see as well. Note that "anonymous" users are not
usually allowed to transfer files TO the archive site, but can only
retrieve files from such a site.
So, it's just a way to give the general public access to your server. To do this, you need to provide a username that everybody knows (i.e. 'anonymous') without a specific password (i.e. any e-mail address will do). But since everybody can access, you want to protect your content against changes, by enforcing heavy operating restrictions.
I work as a student web developer for my computer science department and I've been asked to look into a modification of our password reset procedure for linux accounts. Currently users will log in with their university credentials (via Active Directory) and after being authenticated they get a temporary password through email which they are forced to change as soon as they log in. This way eben if the temporary password it intercepted there is a very short time span in which it could even be used.
Now the idea has been posed that instead of using a temporary password that we might allow the user to pick a new permanent password and set it directly through the web utility. It is my understanding that https is more of "the best we have" than "a great way to secure information". Are there any other avenues I can explore for securing the new password so that we can feel comfortable implementing such a system?
Basically, if you communicate with a server over HTTPS and the private key of the server isn't exposed to someone else, you can be sure that anything you transfer (e.g. the new password) can only be decrypted by the server. Additionally the server certificate assures, that the server you are communicating with, really is the server you want to communicate with.
So, using HTTPS provides authentication and prevents eavesdropping.
If you are working with Active Directory, it is my understanding that the Password Modify Extended Operation (which requires the existing password) is not supported. Therefore, the password must be changed with the LDAP modify request. One solution would be to use the UnboundID LDAP SDK with a web application to execute the LDAP modify with the new password. The modify request should be transmitted over a secure connection, or a non-secure connection promoted to a secure connection using the StartTLS extended operation.
see also
AD password change
Using ldapmodify - this article is about the command line utility ldapmodify but the concepts are useful.
Mozilla claims someone can sit at your computer and get your passwords for each site in 15 seconds. I learned while writing a Firefox extension for the first time that I could access any file in a users directory (given that it was owned by the user). If the passwords are decrypted and written somewhere in the users directory, then they are accessible during a session by a malicious extension or site that uses web code that may access a users directory. What is the process the Software Security Device uses in Firefox that ensures site passwords are really secure from such malicious code?
Decrypting passwords to the hard drive would be insecure because other processes could read them. Does the Software Security Device decrypt them to the users directory?
If not, then does the Software Security Device decrypt them only in ram? If so, then what are the possibilities of another application reading the application space of the Software Security Device?
Please describe.
Describing the process shouldn't be a secret, because secrets are an indication of vulnerability and weakness, instead a true secure method requires brute force to break. An open policy about the encryption process gives a wider audience, which increases the potential for more secure solutions.
I bring this up, because it's not described in the Software Security Device explanation or Master Password explanation on the Mozilla site, leaving me wondering if we are really secure using that feature.
The passwords are stored in the SQLite database signons.sqlite in user's profile directory. By default they are not really encrypted - extracting them from this file and "decrypting" is trivial. To have some security here the user has to define a master password (on the Security tab of the Firefox options), this one will be used to encrypt the passwords in the database. If that has been done then extracting passwords from signons.sqlite is non-trivial, one has to guess the master password.
But Firefox needs to decrypt the passwords to use them of course. If some browser code requests a password (via nsILoginManager) a master password prompt appears - the user needs to enter the master password to allow decrypting his passwords. The decrypted passwords are never written to disk but the browser (and any browser extensions) will be able to access them after that.
Firefox doesn't do anything to prevent extensions from accessing passwords because it would be pointless. The only way to prevent a malicious extension from getting to your passwords is to avoid installing a malicious extension in the first place. Even if nsILoginManager were not there, a malicious extension could still sniff on your communication with the web page when the password is transmitted. Or it could listen to what you type when asked for the master password. Or it could fake a master password dialog and get the master password directly. There are tons of possibilities - an application cannot possibly beat another application that is running with the same privileges.
PS: Software Security Device is for certificates, not passwords - entirely unrelated. But it uses the same master password, hence the confusing dialog.
I have an application server (webservice or remoting, not yet decided) on a remote machine and a client on the same domain. I want to authenticate the user as a domain user on the server.
I can ask the user to enter their Windows username/password and send those to the server and get the server to check them against Active Directory but I would rather not. Is there any way I can get the client to send some kind of token which the server can then use to identify which domain user is sending it a request? Obviously I want to protect the server against someone sending a fake user ID and impersonating another user.
Clarification
The client on computer A will communicate with the server on computer B. I think I will probably using .NET remoting for this communication. On the server I merely need to know the ID of the user on computer A; if the app on computer A must send the ID I need to be sure that it hasn't sent the ID of a different user.
I don't need to impersonate the other user, I merely need to know (for certain) who it is.
Are you saying that the client communicates against your server, and you need to use the client's privileges at a third server? That scenario describes The Double-Hop Problem. The blog most describes it in detail, and what can be done to circumvent it (domain modifications).
[...] you can get around the problem and use proper delegation if you set up your network to use Kerberos and set up the web server in question as trusted for delegation.
Added:
I know of no way you can identify the user on computer A. Would it be enough if it was just the user executing your program? You could use windows authentication in a domain scenario, but that would only give you the privileges used by the program to authenticate, which may differ from the actual evil user in front of the keyboard.
Added:
Your comments to this post indicates that windows authentication with impersonation would work for you. Check http://community.bartdesmet.net/blogs/bart/archive/2006/08/26/4277.aspx for code examples.
What is the best way to send a password to a Windows Service? Our application needs a password in order to start. I don't care that services are "normally" supposed to run without user interaction. Its good enough for us that an operator can start the application and then log off.
On a unix system, I would just echo the password over stdin but the service has no stdin.
Currently, we use the DPAPI to just store the password using CryptProtectData. While this, works, it presents other problems that are beginning to become troublesome.
I'm guessing that I'll need to use some form of IPC between the service and the application that is sending the password but I'm not sure which method is appropriate, if any.
Thanks
Two main options:
You could listen on a socket on startup and wait for the required password to be supplied (maybe embed an SSH server in there, so that the password cannot be snooped over the wire)
My preferred option would be to read the password from a configuration file (that can be secured to the minimum readership) or registry setting (again, sufficiently secure such that only your service and administrators can read/change it)
Thanks for responding Rowland.
You could listen on a socket on
startup and wait for the required
password to be supplied (maybe embed
an SSH server in there, so that the
password cannot be snooped over the
wire)
I considered that but without certificate verification, wouldn't that leave us open to a man in the middle attack?
My preferred option would be to read
the password from a configuration file
(that can be secured to the minimum
readership) or registry setting
(again, sufficiently secure such that
only your service and administrators
can read/change it)
We're trying to follow "defense in depth" as much as possible such that if an attacker compromised the machine, he would not able to access our application.
You can use kerberos mutual authentication. There are few options and examples there.
But just wondering. On a compromised machine, There may be a key logger. So typing the password is never secure if you want to maintain security in this environment. The same problem exist afaik for unix terminals.
DPAPI in UserMode is really the best option, and storing the encrypted data in a protected location, e.g. registry key with limited ACL.
What exactly were the problems that are beginning to be troublesome? Maybe we can just solve those...
What exactly were the problems that
are beginning to be troublesome? Maybe
we can just solve those...
Currently, the application runs as the Local System account.
Our application stores a number of credentials in an encrypted file and uses the DPAPI (in UserMode) for the encryption.
Thus, when the application is installed, the installer is run as the Local System account. We also have a set of tools that ship with the application, some of which need access to this encrypted file and thus, they too need to run as the Local System account.
By the time the application is installed and started, we're heavily dependent on that account.
We're running into problems because one of our users wants to use the application to access a shared network drive. The Local System account has no such privileges and we can't simply run our service as a different user because our encrypted information is protected under the Local System Account.
We've tried to avoid the process of setting up a user account just for our application because it is installed across many different customers and environments, all of whom have wildly different security policies.
You can access a remote drive from a service running under system account. However, you will need to have credentials & share information to connect to the remote machine. You can use the API wnetaddconnection to gain access. Probably your encrypted file can store this credential as well.