Item13402: Sudo admin password problem

How to reproduce

• take the trunk
• go to configure -> Passwords
• in the ISO-8859-1 (or any other terminal but NOT utf8) use some international characters e.g. (iso-latin[1-15]) in the command htpasswd, such
• htpasswd -nb admin pßü
• you will get an answer such: admin:$apr1$YfziUtWw$pWz1/5SdX5kSh/E7dvpP41
• copy the $apr... part into the configure and save
• logout
• try LOGIN as sudo "admin" with the new password
• result: incorrect password - and the admin is locked out

Why this happens

• The htpasswd utility happily create password from anything it get as argument
• It uses always bytes. e.g. when the users in the ISO-8859-1 terminal creating the password, the htpasswd uses 3 bytes: 160 337 374 (in octal).
• However, the 1.2 trunk has default encoding in the web-forms utf8.
• But when the user enters the same characters into the login-form, the Foswiki get: 5 bytes 160 303 237 303 274 and the Crypt::PasswdMD5 happily create a password from 5 bytes - the result is: different passwords.
• If the users encodes the same pßü password on the UTF8 terminal (e.g. the htpasswd will get 5 bytes) - he will be able login.
• we haven't any mechanism to find out what encoding uses the admin in his terminal.

Possible solutions

1. The easiest - leave this as it is - and document it as known problem.
2. Second easy too - add to the configure some Warnings about the issue, and tell the admins: use ONLY ascii characters in the password, or only passwords created on the utf8 terminal.
3. Third, use some Javascript md5 utility, e.g.
   • in the configure the user enters the password cleartext,
   • the Javascript will create the md5 password and will send it to the server.
   • This way always will be generated the password from utf8 byte strings.

-- JozefMojzis - 13 May 2015

Looks like similar issues with the configure tool.

tools/configure -save -set {Password}="pßü" and I cannot use pßü from the admin login prompt.

-- GeorgeClark - 14 May 2015

Doing some more debug printing, the password appears to be being set correcly, if I can assume that a "print STDERR" gets it right:

 tools/configure -save -set {Password}="pßü"
Called with pßü
encoded pßü as $apr1$lQBLUdXW$n.ZPTP/HM2YCyXE4Yx92x0

But then the login:

Checking password (p��)

So it looks like the input from the sudo admin login form is incorrectly encoded? I added that print statement to core/lib/Foswiki/Users/BaseUserMapping.pm subroutine checkPassword.

-- GeorgeClark - 14 May 2015

Meantime I managed one htpasswd generator - JS implementation - here is the demo: http://foswiki.org/Sandbox/JomoJsPassGen Of course, need more work to adapt it into "configure" and/or into login panel.

Using such generator in the login panel, we can ensure than Foswiki never POSTs password in cleartext. (nor from the login form).

-- JozefMojzis - 15 May 2015

I think that this is actually fixed, could you please verify it? Thanks. Note that we no long recommend using htpasswd tool to generate admin passwords.

-- GeorgeClark - 14 Jun 2015

I've updated the manual reset docs to indicated only supported for plain ascii passwords.

-- GeorgeClark - 14 Jun 2015

I've updated the manual reset docs to indicated only supported for plain ascii passwords.

-- GeorgeClark - 14 Jun 2015

Closing, without the htpasswd this isn't any issue.

-- JozefMojzis - 14 Jun 2015

Commenting is disabled while not logged in