xoops forums

rplima2004

Just popping in
Posted on: 2006/9/20 4:41
rplima2004
rplima2004 (Show more)
Just popping in
Posts: 70
Since: 2004/10/8
#1

How to force the users of ours site to use safe passwords?

First of all, I would like to ask for excuses me for my very poor English. I am strengtheing itself to be able to share with you some of my works.

Security is primordial nowadays. And as everything in the Internet that has a minimum of security demands the use of passwords, is necessary that uses safe passwords to keep its security and the security of the information of the site.

It is known that the majority of the users uses the same password for the majority of the sites that registers and that in the great majority these passwords are not very safe, therefore is short passwords, that remember some thing of the user, at last, this is a risk for you, its site and its users.

But, how to force the users of its site to use safe passwords?

It is simple, installs a quality passwords meter in your site and only allows registers that they reach definitive level of security defined for you.

In the last days some XOOPS sites in Brasil had been hacked and know, at least what it consists, that this invasion was made possible because the invader discovered the password of some user who possessed a weak password.

Was thinking about this that I developed this hack and I hope that with this I can help them to make more difficult the life of this type of person who invades sites to cause the chaos, it at least a little.

Well, go to start.

The first step is make backup of the files that you go edit to install the hack.
The files are:

- include/registerform.php
- edituser.php
- language/your_language/user.php
- modules/system/language/your_language/admin/preferences.php

Made backup, click here and download the necessary files.

Open the files include/registerform.php and edituser.php text editor and only substitutes the code of creation of password field for this:

Quote:

##################################################################################################
# Password Quality Meter
# Type: Core Hack
# Description: This hack creates a Password Quality Meter for the user in the register or edition
# profile form. It only enable the send form button case the typed password reach the level of
# security defined for you in the administration (System Admin=>Preferences=>Users Config).
##################################################################################################
# Rodrigo Pereira Lima aka TheRplima
# therplima@gmail.com
# Last Update: 16/09/2006
# See the hack in my site http://www.xoops.net.br/register.php
##################################################################################################
include_once XOOPS_ROOT_PATH."/include/passwordquality.php";
##################################################################################################
# End of Hack
##################################################################################################


Original password form field creation code in include/registerform.php:
Quote:

$reg_form->addElement(new XoopsFormPassword(_US_PASSWORD, "pass", 10, 32, $myts->htmlSpecialChars($pass)), true);


Original password form field creation code in edituser.php:
Quote:

$pwd_text = new XoopsFormPassword('', 'password', 10, 32);


Made this, the next step is to include the used texts in hack in the definitions of language of xoops.
Opens the file language/your_language/user.php and in the end of the file, before ?> includes the stretch below:
Quote:

##################################################################################################
# Password Quality Meter
# Type: Core Hack
# Description: This hack creates a Password Quality Meter for the user in the register or edition
# profile form. It only enable the send form button case the typed password reach the level of
# security defined for you in the administration (System Admin=>Preferences=>Users Config).
##################################################################################################
# Rodrigo Pereira Lima aka TheRplima
# therplima@gmail.com
# Last Update: 16/09/2006
# See the hack in my site http://www.xoops.net.br/register.php
##################################################################################################
define('_US_REGFORM_NOJAVASCRIPT', 'To register in this site the Javascript of your browser must be enable. Enable it and try again!');
define('_US_REGFORM_WARNING', 'To register in this sitee you will be use a safe password. Try to create your passwords using a mix of letters (case sensitive), numbers and symbols.');
##################################################################################################
# End of Hack
##################################################################################################


Open now modules/system/language/your_language/admin/preferences.php and in the end of the file, before ?> includes the stretch below:
Quote:

##################################################################################################
# Password Quality Meter
# Type: Core Hack
# Description: This hack creates a Password Quality Meter for the user in the register or edition
# profile form. It only enable the send form button case the typed password reach the level of
# security defined for you in the administration (System Admin=>Preferences=>Users Config).
##################################################################################################
# Rodrigo Pereira Lima aka TheRplima
# therplima@gmail.com
# Last Update: 16/09/2006
# See the hack in my site http://www.xoops.net.br/register.php
##################################################################################################
define("_MD_AM_PASSLEVEL","Minimun password security");
define("_MD_AM_PASSLEVEL_DESC","Define which the minimum level of security for the passwords of the users.");
define("_MD_AM_PASSLEVEL1","Unsafe");
define("_MD_AM_PASSLEVEL2","Weak");
define("_MD_AM_PASSLEVEL3","Fair");
define("_MD_AM_PASSLEVEL4","Strong");
define("_MD_AM_PASSLEVEL5","Safe");
define("_MD_AM_PASSLEVEL6","Not rated");
##################################################################################################
# End of Hack
##################################################################################################


Soon, the alterations are made, copy the files passwordquality.php, passwordquality.js and percent_bar.js for inside of the folder include of its site.

We now go effectively to install hack in xoops. Copy the file Securitypasshack_install.php for the root of its site. Make a login as admin and access XOOPS_URL/securitypasshack_install.php.

It is very fast and if everything ok you will receive a success message and will be redirected for the main page of its site.

Erase the file Securitypasshack_install.php to prevent problems.

The installation is complete, it goes now in System Admin=>Preferences=>Users Config and sees if the length of the password and the level of security are in accordance with its necessities and are felt safer!

I hope that they have liked.

Here the link of original post in my site (Portuguese).

TheRplima

iHackCode

Module Developer
Posted on: 2006/9/20 12:09
iHackCode
iHackCode (Show more)
Module Developer
Posts: 1037
Since: 2004/6/29
#2

Re: How to force the users of ours site to use safe passwords?

i havent tried it yet, but sounds great. wouldnt mind having something like this in the core.
CBB / LatestNews / Publisher / XM-Spotlight

(ノ◕ヮ◕)ノ*:・゚✧
Posted on: 2006/9/20 12:24
bluenova
bluenova (Show more)
Posts: 1022
Since: 2004/4/10
#3

Re: How to force the users of ours site to use safe passwords?

Nice work. I would suggest submitting the code here

Will_H

Friend of XOOPS
Posted on: 2006/9/20 12:32
Will_H
Will_H (Show more)
Friend of XOOPS
Posts: 1786
Since: 2004/10/10
#4

Re: How to force the users of ours site to use safe passwords?

hotness.

rplima2004

Just popping in
Posted on: 2006/9/20 12:57
rplima2004
rplima2004 (Show more)
Just popping in
Posts: 70
Since: 2004/10/8
#5

Re: How to force the users of ours site to use safe passwords?

Thanks all for coments.

@bluenova: i have posted there, see the link

TheRplima

hervet

Friend of XOOPS
Posted on: 2006/9/20 15:42
hervet
hervet (Show more)
Friend of XOOPS
Posts: 2267
Since: 2003/11/4
#6

Re: How to force the users of ours site to use safe passwords?

One thing is just missing, on the form of an option, a way to block the account after, let say, 3 unsuccessful logins.

rplima2004

Just popping in
Posted on: 2006/9/20 20:37
rplima2004
rplima2004 (Show more)
Just popping in
Posts: 70
Since: 2004/10/8
#7

Re: How to force the users of ours site to use safe passwords?

@hervet: Yes, this is a great idea. Although to run away a little to the target from hack. But I go to give one analyzed in this and perhaps make another one hack.

TheRplima

giba

Just can't stay away
Posted on: 2006/9/23 15:20
giba
giba (Show more)
Just can't stay away
Posts: 638
Since: 2003/4/26
#8

Re: How to force the users of ours site to use safe passwords?

yes Hervé, good idea too

TheRpLima in analysing for implements and features is reported in sourceforge. Now new adition verify fields forms, branch 2.0.15 and formelements 2.0.16 Skalpa and idea TheRpLima

This force users safe passwords is very important too.

Thanks for comments all xoopers.

irmtfan

Module Developer
Posted on: 2006/9/23 16:06
irmtfan
irmtfan (Show more)
Module Developer
Posts: 3419
Since: 2003/12/7
#9

Re: How to force the users of ours site to use safe passwords?

idea is great also set time limit for passwords is another feature to force user to change passwords regularly.

Quote:

hervet wrote:
One thing is just missing, on the form of an option, a way to block the account after, let say, 3 unsuccessful logins.


IMHO its not a good idea at all.
because anyone can block any account just by 3 faild login.
Or maybe create a script to block all accounts in the XOOPS site? i think its a kind of DOS attack.

rplima2004

Just popping in
Posted on: 2006/9/23 16:29
rplima2004
rplima2004 (Show more)
Just popping in
Posts: 70
Since: 2004/10/8
#10

Re: How to force the users of ours site to use safe passwords?

Quote:

irmtfan wrote:
idea is great also set time limit for passwords is another feature to force user to change passwords regularly.

IMHO its not a good idea at all.
because anyone can block any account just by 3 faild login.
Or maybe create a script to block all accounts in the XOOPS site? i think its a kind of DOS attack.


Yes, irmtfan, thinking about you say, i agree with you. If this is implemented anyone can block account of anyone, includding admin account. Really this has that to be thought better before being implemented. So about the time limit for passwords i like this.

TheRplima