0003229: Link password insecurity - UnrealIRCd Bug Tracker

ID	Project	Category	View Status	Date Submitted	Last Update
0003229	unreal	ircd	public	2007-02-04 21:28	2007-04-18 04:49

Reporter	JasonTik	Assigned To
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	no change required
Product Version	3.2.6

Summary	0003229: Link password insecurity
Description	At link time: -> PASS :client.password_connect <- PASS :server.password_receive This is bad. It defeats the point of being able to hash your link::password-receive. I can just take the password-connect, telnet the server, and get the password-receive.

3rd party modules

aquanight 2007-02-04 21:37 reporter ~0013196 Last edited: 2007-02-04 21:38	Hence why you guard both passwords, and use a hostname limit on top of that. If someone snags password-connect, they can already get server-level access. (edit: or better yet, use SSL certificates)

JasonTik 2007-02-04 21:48 reporter ~0013197 Last edited: 2007-02-04 21:58	Is that even possible? (The certs?) [Post IRC Expanation Edit] mmm, certs! /me like!

WolfSage 2007-04-17 17:59 reporter ~0013488	So.... do we have an issue here?

~~stskeeps~~ 2007-04-18 04:48 reporter ~0013495	We already have proper methods to deal with this, mentioned in comments and in SSL client certificates etc.

Date Modified	Username	Field	Change
2007-02-04 21:28	JasonTik	New Issue
2007-02-04 21:37	aquanight	Note Added: 0013196
2007-02-04 21:38	aquanight	Note Edited: 0013196
2007-02-04 21:48	JasonTik	Note Added: 0013197
2007-02-04 21:58	JasonTik	Note Edited: 0013197
2007-04-17 17:59	WolfSage	Note Added: 0013488
2007-04-18 04:48	~~stskeeps~~	Status	new => closed
2007-04-18 04:48	~~stskeeps~~	Note Added: 0013495
2007-04-18 04:49	~~stskeeps~~	Resolution	open => no change required