TYPO3 Core

From Core List:

- Transferring the password using RSA is a good idea, if there is a fallback if RSA does not work.
=> Everyone on Core List considers this the way to go.

- To improve security maybe it is a good idea to store the password SHA-256 encrypted or maybe using saltedpw.
=> There are some concerns. This maybe should be discussed seperately (so it would no longer block the integration of RSA here).

Oh yes right.

The patch has to be probably completely rewritten for 6.2 now (due to the new Install Tool), but the main idea is still very much valid and meaninful. I'm adding our security specialist Helmut Hummel as a watcher, maybe he finds some time to work on that? Or maybe Berhard is still "active" and is willing to contribute a new patch?

Thanks!

My schedule is rather full currently. I don't think I can allocate some spare time soon.

The patch is not that complicated. I think the parts which changed in the services class can get applied almost without change. I didn't have a look at the new install tool login mechanism until now.

The trick with this patch is not only that the password gets transfered via RSA encryption but also how someone can set the install tool password: When logging in with a wrong password not an MD5 is shown to the user but rather a "hash-key:REMOTE_IP" value. This value has to get filled into the "ENABLE_INSTALL_TOOL" file. If someone logs into the install tool with the shown hash from the shown REMOTE_IP the RSA transmitted password is accepted and written into localconf.php ...

The only attack vector I know of (except writing localconf.php directly on the server) is to intercept the transmission using a man-in-the-middle attack either over the network or via a trojan horse on the admins client PC. The first case can only get solved by using SSL or similar technology and trusted certificates, for the second case (trojan horse on admin client PC) there is not really a countermeasure except appropriate anti virus software.

Install tool now uses salted passwords for its password, existing passwords are automatically updated.

• rsaauth relies on database connectivity for key storage and this is not wanted for install tool, key should be stored in install tool session, so rsaauth needs a factory and implementation for different key storage backends.
• rsaauth needs working openssl to be successful
• rsaauth is not a "required" extension and it probably never should be (saltedpasswords is required extension since 6.2 now)

Nicole Cordes is currently working on rsaauth to use it in the install tool ... maybe contact her to get a better feeling on what should / needs to be done?