ngcp-panel

Commit Graph

Author	SHA1	Message	Date
Andreas Granig	8f8e1d5fc9	TT#78557 - Use bcrypt to hash webpassword * Change the way webpassword is handled accross NGCP Panel UI/API to comply with new password encryption * At login, if password is not encrypted with high cost due to the ngcp-bcrypt-webpassword script, encrypt it with proper cost * Accept old password format as well until all webpasswords are encrypted Change-Id: Iefa9584a62ab4b7d2a224d10bdd415e9cbb8dfb5	6 years ago
Gerhard Jungwirth	9fd02605ee	TT#29909 fix remaining "use warnings" perlcritic errors Change-Id: I6f0d1537c8de161b969d6afac8c2a2d3fecb6c31	8 years ago
Andreas Granig	8ad683d5ae	TT#12601 Move admin pass to bcrypt and drop cert For the migration of the admin pwd, the logic is as follows: 1. If the admin has a bcrypt password already, use this 2. If not, perform auth via md5, then clear the md5 column and write a salted bcrypt hash instead. For dropping the ssl client cert, we simply not store anymore the client certificate in the DB. As a result, you cannot download the certs (pem, p12) after creation anymore, so we immediately download the two certs in a zip file after creation. A cost of 13 takes 500ms on an i7-5500U CPU @ 2.40GHz, which seems to be a reasonable value. Change-Id: I1ce21321c58d8c57d7ddce1541995f64821b0053	9 years ago

Author

SHA1

Message

Date

Andreas Granig

8f8e1d5fc9

TT#78557 - Use bcrypt to hash webpassword

* Change the way webpassword is handled accross
	   NGCP Panel UI/API to comply with new password
	   encryption
	 * At login, if password is not encrypted with
	   high cost due to the ngcp-bcrypt-webpassword
	   script, encrypt it with proper cost
	 * Accept old password format as well until all
	   webpasswords are encrypted

Change-Id: Iefa9584a62ab4b7d2a224d10bdd415e9cbb8dfb5

Gerhard Jungwirth

9fd02605ee

TT#29909 fix remaining "use warnings" perlcritic errors

Change-Id: I6f0d1537c8de161b969d6afac8c2a2d3fecb6c31

Andreas Granig

8ad683d5ae

TT#12601 Move admin pass to bcrypt and drop cert

For the migration of the admin pwd, the logic is as follows:

1. If the admin has a bcrypt password already, use this
2. If not, perform auth via md5, then clear the md5 column
   and write a salted bcrypt hash instead.

For dropping the ssl client cert, we simply not store anymore
the client certificate in the DB. As a result, you cannot
download the certs (pem, p12) after creation anymore, so
we immediately download the two certs in a zip file after
creation.

A cost of 13 takes 500ms on an i7-5500U CPU @ 2.40GHz, which
seems to be a reasonable value.

Change-Id: I1ce21321c58d8c57d7ddce1541995f64821b0053

3 Commits (328bce85cc40db0db22b8299a137f6b9eeca13fd)