backend/server/importlib/userAuth.py | 21
+++++++++-
java/code/src/com/redhat/rhn/frontend/servlets/PxtSessionDelegateImpl.java | 3 +
java/code/src/com/redhat/rhn/manager/user/UserManager.java | 16
++++++-
3 files changed, 35 insertions(+), 5 deletions(-)
New commits:
commit 0797b7149402fe0e713094df308bbe73e6963ecf
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Thu Feb 24 08:42:06 2011 +0100
always generate new session after login
diff --git a/java/code/src/com/redhat/rhn/frontend/servlets/PxtSessionDelegateImpl.java
b/java/code/src/com/redhat/rhn/frontend/servlets/PxtSessionDelegateImpl.java
index 6ff1d6e..44fd9fd 100644
--- a/java/code/src/com/redhat/rhn/frontend/servlets/PxtSessionDelegateImpl.java
+++ b/java/code/src/com/redhat/rhn/frontend/servlets/PxtSessionDelegateImpl.java
@@ -59,6 +59,9 @@ public class PxtSessionDelegateImpl implements PxtSessionDelegate {
*/
public void updateWebUserId(HttpServletRequest request, HttpServletResponse
response,
Long id) {
+ // generate new session to prevent session fixation (BZ 672159)
+ Object sessionAttribute = createPxtSession();
+ request.setAttribute("session", sessionAttribute);
getPxtSession(request).setWebUserId(id);
refreshPxtSession(request, response);
commit 8078e15bd208c60a98d120b8b9f7532dae4df7e0
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Thu Feb 24 08:40:49 2011 +0100
set timeout after unsuccessful login
diff --git a/java/code/src/com/redhat/rhn/manager/user/UserManager.java
b/java/code/src/com/redhat/rhn/manager/user/UserManager.java
index 9a7be48..0e6bea2 100644
--- a/java/code/src/com/redhat/rhn/manager/user/UserManager.java
+++ b/java/code/src/com/redhat/rhn/manager/user/UserManager.java
@@ -407,13 +407,14 @@ public class UserManager extends BaseManager {
* @throws LoginException if login fails. The message is a string resource key.
*/
public static User loginUser(String username, String password) throws LoginException
{
+ String exceptionType = null;
try {
User user = UserFactory.lookupByLogin(username);
if (!user.authenticate(password)) {
- throw new LoginException("error.invalid_login");
+ exceptionType = "error.invalid_login";
}
else if (user.isDisabled()) {
- throw new LoginException("account.disabled");
+ exceptionType = "account.disabled";
}
else {
user.setLastLoggedIn(new Date());
@@ -423,8 +424,17 @@ public class UserManager extends BaseManager {
}
}
catch (LookupException le) {
- throw new LoginException("error.invalid_login");
+ exceptionType = "error.invalid_login";
}
+ // invalid login/password; set timeout to baffle
+ // brute force password guessing attacks (BZ 672163)
+ try {
+ Thread.sleep(2000);
+ }
+ catch (InterruptedException ie) {
+ log.warn("Failed to set timeout: " + ie.getMessage());
+ }
+ throw new LoginException(exceptionType);
}
/**
commit 83a8456ee144bdccaa0bf1dabc540eb0f73f69bc
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Thu Feb 24 08:40:49 2011 +0100
set timeout after unsuccessful login
diff --git a/backend/server/importlib/userAuth.py b/backend/server/importlib/userAuth.py
index 406f4cf..14464c2 100644
--- a/backend/server/importlib/userAuth.py
+++ b/backend/server/importlib/userAuth.py
@@ -16,6 +16,7 @@
# Authentication
#
+import time
from spacewalk.common import rhnFault, log_debug, add_to_seclist
from spacewalk.common.rhnTranslate import _
@@ -29,13 +30,29 @@ class UserAuth:
def auth(self, login, password):
add_to_seclist(password)
- self.groups, self.org_id, self.user_id = getUserGroups(login, password)
+ try:
+ self.groups, self.org_id, self.user_id = getUserGroups(login, password)
+ except rhnFault, e:
+ if e.code == 2:
+ # invalid login/password; set timeout to baffle
+ # brute force password guessing attacks (BZ 672163)
+ time.sleep(2)
+ raise e
+
log_debug(4, "Groups: %s; org_id: %s; user_id: %s" % (
self.groups, self.org_id, self.user_id))
def auth_session(self, session_string):
user_instance = rhnUser.session_reload(session_string)
- self.groups, self.org_id, self.user_id =
getUserGroupsFromUserInstance(user_instance)
+ try:
+ self.groups, self.org_id, self.user_id =
getUserGroupsFromUserInstance(user_instance)
+ except rhnFault, e:
+ if e.code == 2:
+ # invalid login/password; set timeout to baffle
+ # brute force password guessing attacks (BZ 672163)
+ time.sleep(2)
+ raise e
+
log_debug(4, "Groups: %s; org_id: %s; user_id: %s" % (
self.groups, self.org_id, self.user_id))
Show replies by date