PDA

View Full Version : Security issue/enhancement


siepel
24-07-2004, 04:40
Last week I changed my server from SQLite to MySQL.

After the migration, I logged into mysql with phpmyadmin and could see everyones password as plain tekst in the database.
Even the super admins password.

I think this is a mayor mistake, it should be hashed (md5 or so) because many ppl using teamspeak migrate to mysql and use it in the same dbase as there website is. (allowing one sign up for ts and www thus having same user and pass on both apz)

mysql, php ts they are all good safe apz, but when people code pages and start messing with mysql there can be many issues. like sql injectons to get super admin rights, or statements to get full list of all passwords.

And i think u want to make it as hard as it can get to the hackers.
Besides of all u cant trust a server admin this way, because he can see your password at any time. He can now not only kick/ban you from the server, but also log into all your accounts (if you use one pass for everything , as most people do)

Peter
24-07-2004, 13:02
1. A serveradmin should not have access to the database (else you have the problems you describe).
2. Its possible to use hashed passwords with TeamSpeak, use the search function to find some people that did it already.

siepel
24-07-2004, 16:02
Many teamspeak server administrators run ts beside there website, websites are almost any time php/mysql so I guess it should be set to some hash at default.

Bcz many admins use phpnuke i think it should be default md5 hash. That way it is possible to sign op at website and login to ts with same user en pass.

Because there are alot of groups that are all friends and one of them has a ts server running at their home connection. He would be able to see mysql any time.

I guess this happens more often then you think.
Can you think of even one argument that it shouldn`t be hashed?

Brain
24-07-2004, 16:13
Sure, if someone manages to steal a password using an injection attack he'll just get the hash. However since development on TS2 has been stopped and the devs are working full force on TS3 I don't think TS2 will be changed in any way anymore.
But perhaps you get hashed passwords with TS3. Personally, I think an asymmetric key authentication system would be even better because it eliminates the need for passwords. Or how about using PAM? Then everybody can implement authentication methods as s/he sees fit. :)

siepel
25-07-2004, 06:19
Tobad it takes a long time to ts 3 ... cant wait.. trying to get a md5 hash on my current database...

think ou for answering this suggesting/question.

jara06
13-09-2004, 15:00
somewhat easy to implement md5 yourself thanks to clever thinking at the TS team (?) ;)

just go through the mysql_sql/ folder and make your corrections, and voila