On Thu, Jul 30, 2009 at 01:27:14PM +0200, Tomasz Sterna wrote: > From: "John Schmitt" <[email protected]> >>>> Could I just enter the plaintext password there? >>> You enter the password, not the hash to the config file. >> How was that long string derived from "secret" generated? Why was it >> used rather than a plain text password? How can I generate my own? > > Where did you get the idea of hashes in config files?
I got them from looking at the default configuration files in my distribution, Fedora 11. > Have you read http://jabberd2.xiaoka.com/wiki/InstallGuide ? Yes. I see mention of changing the password but no mention of how to generate the long string used in the default configuration. >>>> Would that make my setup less secure? >>> Why would that? >> For the same reason that it's not a plain text password in every .xml >> file. I only vaguely understand security but I understand that you >> don't want to send a password in the clear over a network, but I don't >> understand why some .xml files store a hashed string and some simply >> store a plaintext password. > > Putting the password (a shared secret to be more precise) in the > configuration file does not mean it will be send plaintext over the wire. I assume that is the case. > The jabberd2 server has hashing and encryption implemented and is > perfectly able to hash secrets and encrypt the stream by itself. :-) Obviously. I'm not feeling understood, so I'd like to try again. Below I've pasted excerpts from the /etc/jabberd/*.xml files that contain password information. 1. How is the long string that begins with <pass> generated? What is the relationship between that string and the string 'secret'? See c2s.xml line 18 for an example. 2. Why is that string used instead of the string 'secret'? My only guess is that it is security related. If so, would using plain passwords make my system less secure? 3. I want my system to be secure and I assume I must generate my own shared secrets. How do I do that properly? Feel free to be condescending if it's in the documentation and I overloooked it. Feel free to be derisive if a simple google search would explain it. I failed at answering my questions using google search.k Thanks for taking the time. >From /etc/jabberd/*.xml:------------------------------------------ c2s.xml-17- <user>jabberd</user> <!-- default: jabberd --> c2s.xml:18: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> <!-- default: secret --> -- c2s.xml-382- <user>jabberd2</user> c2s.xml:383: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> -- c2s.xml-417- <user>jabberd2</user> c2s.xml:418: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> -- c2s.xml-431- <user>jabberd2</user> c2s.xml:432: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> -- s2s.xml-17- <user>jabberd</user> <!-- default: jabberd --> s2s.xml:18: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> <!-- default: secret --> -- sm.xml-19- <user>jabberd</user> <!-- default: jabberd --> sm.xml:20: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> <!-- default: secret --> -- sm.xml-111- <user>jabberd2</user> sm.xml:112: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> -- sm.xml-142- <user>jabberd2</user> sm.xml:143: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> -- sm.xml-174- <user>jabberd2</user> sm.xml:175: <pass>f0053b4195a2517c384542d6fb6d5e8d862eabcb</pass> ---------------------------------------------- PS Would it help if I tried another language? The spanish I learned in university is now abysmally poor, but with german I might still be able to cobble a few sentences together. -- To unsubscribe send a mail to [email protected]
