Re: [Assp-test] Web Interface security.

2008-02-14 Thread Paul Houlbrooke
Fritz Borgstedt wrote: > ASSP development mailing list > schreibt: >> In 14.9 the only way I can login now is to enter the encypted version >> of >> the password. I erased the webAdminPassword in the config file, >> restarted the service so it would recreate it, and entered the >> default >> pa

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Fritz Borgstedt
ASSP development mailing list schreibt: >In 14.9 the only way I can login now is to enter the encypted version >of >the password. I erased the webAdminPassword in the config file, >restarted the service so it would recreate it, and entered the >default >password, nospam4me. I could not login. I

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Paul Houlbrooke
Marrco wrote: >> **BUT** when I use firefox 3b3 is allows >> access without asking for password !!! > > Wait.. restarted explore and firefox, deleted cache. Assp 14.9, now NO > password asked. I can access my configuration without any prompt !! > > I tried to change the password a few times, and

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Marrco
> **BUT** when I use firefox 3b3 is allows > access without asking for password !!! Wait.. restarted explore and firefox, deleted cache. Assp 14.9, now NO password asked. I can access my configuration without any prompt !! I tried to change the password a few times, and it's in the logs Feb-14-0

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Paul Houlbrooke
Paul Houlbrooke wrote: > Fritz Borgstedt wrote: >> ASSP development mailing list >> schreibt: >>> Password is no longer visible via View Source in Windows. However, >>> when >>> changing the password a restart of the service is required for the >>> crypt() function to do it's thing. After changi

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Paul Houlbrooke
Fritz Borgstedt wrote: > ASSP development mailing list > schreibt: >> Password is no longer visible via View Source in Windows. However, >> when >> changing the password a restart of the service is required for the >> crypt() function to do it's thing. After changing the password, it is >> stil

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Marrco
> I was unsure after the report of marco if crypt() is working at all in > windows so i changed to a module. > > please test .9 > >you need to install Crypt::Blowfish Crypt is installed and reported OK when assp is starting. The password in the logs is written encrypted I can connect ONLYusing

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Fritz Borgstedt
ASSP development mailing list schreibt: > >Password is no longer visible via View Source in Windows. However, >when >changing the password a restart of the service is required for the >crypt() function to do it's thing. After changing the password, it is >still in plain text in the assp.cfg fil

Re: [Assp-test] Web Interface security.

2008-02-14 Thread Paul Houlbrooke
Fritz Borgstedt wrote: >> When viewing the ASSP admin pages, the 'Admin Password' is filled >> in with the actual admin password. The password is therefore visible >> via > >> both a 'view source' and when network tracing. > > > Using the crypt() function I changed it. > > We need testing fro

Re: [Assp-test] Web Interface security.

2008-02-13 Thread Fritz Borgstedt
>When viewing the ASSP admin pages, the 'Admin Password' is filled >in with the actual admin password. The password is therefore visible >via >both a 'view source' and when network tracing. Using the crypt() function I changed it. We need testing from windows users. ---

[Assp-test] Web Interface security.

2008-02-12 Thread David le Blanc
Hello Fritz, When viewing the ASSP admin pages, the 'Admin Password' is filled in with the actual admin password. The password is therefore visible via both a 'view source' and when network tracing. Using SSL doesn't solve the issue of a simple 'view source' exposing the password in the event I