Re: [Firebird-devel] Insecure hashing and encryption in Firebird 3
On Monday, July 27, 2015, Alex Peshkoff wrote: > On 07/26/2015 10:00 PM, Ivan Arabadzhiev wrote: > > Personally, I've recently started using (mostly for kicks) things like > > https://en.wikipedia.org/wiki/Scrypt > > https://en.wikipedia.org/wiki/Bcrypt > > https://en.wikipedia.org/wiki/PBKDF2 > > I suppose the option to tune them in the future (or even introduce a > > configurable parameter) is also a plus. > > You may write authentication plugin using that things and use it in FB3, > no changes in the rest of firebird are required for it. > For people who do not need a lot of connections per second this may be > useful. > > > An interesting aspect of this approach is that is an architectural, pre-established denial of service facility. All that is necessary to render such a system unavailable is to hit it with a relatively low number of unsuccessful connection requests. If each takes one hundred milliseconds to compute the hash and reject the request, it would take only 10 * the number of cores capable of authentication to consume 100% of available cpu time. Virtually all authentication schemes have a substantial computation cost, but designing intentionally designing a scheme exposed to the world to maximize CPU consumption leads the system open to DOS by an attacker -- or an errant program. The ideal authentican scheme has zero cost and astronomic combinatorics so a brute force attack takes more time than the universe has to live until the Big Crunch. This dictates very large quasi-random passwords, but this is what password managers are all about. Scrypt and Bcrypt are, without doubt, fascinating thesis material, but their use in actual computing systems is stupid beyond belief. If you are concerned with deep robustness, bundle a client side password manager and require 32 character passwords. A simple password that an attacker never sees opens the vault. Firebird could be the first RDBMS on the block to have such a client. -- Jim Starkey -- Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] Insecure hashing and encryption in Firebird 3
27.07.2015 17:07, Jim Starkey wrote: > Question: Does Firebird detect, report, and shutdown repetitive attacks > on passwords? Yes, it does (in single-process architectures). Dmitry -- Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
[Firebird-devel] [FB-Tracker] Created: (CORE-4887) AFTER CREATE/ALTER PACKAGE DDL triggers runs in incorrectly moment
AFTER CREATE/ALTER PACKAGE DDL triggers runs in incorrectly moment
--
Key: CORE-4887
URL: http://tracker.firebirdsql.org/browse/CORE-4887
Project: Firebird Core
Issue Type: Bug
Components: Engine
Affects Versions: 3.0 Beta 2
Reporter: Adriano dos Santos Fernandes
AFTER CREATE/ALTER PACKAGE DDL triggers is running before inserts and updates
of RDB$PROCEDURES and RDB$FUNCTIONS, while they should run after all system
tables changes.
Test case:
create exception e 'Empty package'!
create or alter trigger t_trig after create package
as
begin
if ((select count(*) from rdb$functions where rdb$package_name =
rdb$get_context('DDL_TRIGGER', 'OBJECT_NAME')) = 0) then
exception e;
end!
create package xpk1
as
begin
function f1 returns integer;
end!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://tracker.firebirdsql.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
--
Firebird-Devel mailing list, web interface at
https://lists.sourceforge.net/lists/listinfo/firebird-devel
[Firebird-devel] [FB-Tracker] Created: (CORE-4889) FBSVCMGR with `action_trace_start` prevents in 3.0 SuperServer from connecting using local protocol (in particularly, prevents from doing NBACKUP)
FBSVCMGR with `action_trace_start` prevents in 3.0 SuperServer from connecting using local protocol (in particularly, prevents from doing NBACKUP) -- Key: CORE-4889 URL: http://tracker.firebirdsql.org/browse/CORE-4889 Project: Firebird Core Issue Type: Bug Components: Engine, NBACKUP, SVCMGR Affects Versions: 3.0 RC 1 Environment: LI-V3.0.0.31942, SuperServer only. Reporter: Pavel Zotov window #1: == launch fbsvcmgr in order to trace FB 3.0 SS activity: /opt/fb30ss/bin/fbsvcmgr localhost/:service_mgr user SYSDBA password masterke action_trace_start trc_cfg ./fb30ss_trace.conf window #2: == Doing with isql only: game-1: ~~ /opt/fb30ss/bin/isql localhost/:/var/db/fb30/e30.fdb -- OK, it works quit; /opt/fb30ss/bin/isql /var/db/fb30/e30.fdb -- OK, it works Now restart FB and launch again fbsvcmgr in session #1, than return to window #2 and continue: game-2: ~~~ /opt/fb30ss/bin/isql /var/db/fb30/e30.fdb Result: isql will HANG (no matter of was messages about detaching from sec3.fdb appeared in trace window or no). Now restart FB and launch again fbsvcmgr in session #1, than return to window #2 and continue. Doing with nbackup (which should use only LOCAL protocol, otherwise we get "PROBLEM ON "nbackup needs local access to database file" / SQLCODE:-999"): game-3: ~~~ /opt/fb30ss/bin/nbackup -b 0 /var/db/fb30/e30.fdb ./tmpnbk.nbk0 Result: nbackup will HANG. This occur only when FB-3 runs in SS architecture. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://tracker.firebirdsql.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira -- Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
[Firebird-devel] Parsing fbtrace.conf
I managed to accidentally create this pseudo config file today: enabled false blah blah enabled true blah blah and was very surprised to find no trace output for mydb. After a lot of head scratching I finally worked it out. It looks as if the parser stops on the first match of mydb, rather than continuing to the end. So the question is - is this by design or is it a bug ? Of course, there is another related question - what is the correct behaviour? I know a lot of config file parsers are written to parse to the end and whichever values are set last are the values used. For example postfix is specifically designed to allow this: myparam = x < snip lots of config > myparam = y and the final value used for myparam will be y. Paul -- Paul Reeves http://www.ibphoenix.com Supporting users of Firebird -- Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] Parsing fbtrace.conf
28.07.2015 20:12, Paul Reeves wrote: > > I managed to accidentally create this pseudo config file today: > > > enabled false > blah blah > > > > enabled true > blah blah > > > and was very surprised to find no trace output for mydb. After a lot of head > scratching I finally worked it out. It looks as if the parser stops on the > first match of mydb, rather than continuing to the end. So the question is - > is this by design or is it a bug ? It is by design and clearly stated in default fbtrace.conf: # Trace configuration. Following rules are used : ... # - if database name matches pattern, options are immediately applied and # search does not continue Regards, Vlad -- Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
Re: [Firebird-devel] Parsing fbtrace.conf
28.07.2015 20:12, Paul Reeves wrote: > > Of course, there is another related question - what is the correct behaviour? > I know a lot of config file parsers are written to parse to the end and > whichever values are set last are the values used. For example postfix is > specifically designed to allow this: > >myparam = x >< snip lots of config > >myparam = y > > and the final value used for myparam will be y. I think there's a difference between multiple subsequent assignments inside a plain config or inside one section: enabled false blah blah enabled true which probably should work as you describe, and multiple subsequently matched sections: enabled false blah blah enabled true blah blah which IMO should raise an error, as it's likely some copy-paste error (database name pattern was not changed after copying). Dmitry -- Firebird-Devel mailing list, web interface at https://lists.sourceforge.net/lists/listinfo/firebird-devel
