PacketFence - BTS - PacketFence
Here is my problem ... I see all password in clear text on my server.
In PF configuration : /usr/local/pf/conf/pf.conf
We can find the password of the MySQL database (ie pass=p@...).
I connect to the DB with this password.
Now i can see all the tables used in PF. And i can see all user passwords
in table 'temporary_password'.
Next i try to change the admin password in the DB and it works !
This is a security issue ? How to remedy this problem and replace passwords
by hashes ?
Regards,
Olive
PS : I already talk about this issue on the user mailing list
*
grep -E '(pass(word)?=).*' -nR --color /usr/local/pf/conf/
mysql -u pf -pp@... pf
SHOW TABLES;
SELECT * from temporary_password;
UPDATE temporary_password SET password='123456' WHERE pid='admin';*
and connect to the admin web interface.
1.html (410) 2014-05-29 11:45https://www.packetfence.org/bugs/file_download.php?file_id=210&type=bug