blob: 162e5d323322c0b9d59bb170779d6c50f48a0ef9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
The security of this plugin scares me. As noted in the plugin
documentation, you basically have to use it with SSL, since snooping on the
login password doesn't give you an essentially useless account -- it gives
you an actual account on the machine!
Also, apparently pwauth defers *all* auth attempts if one fails, and it
does this by using a lock file, and sleeping after a failed auth attempt.
Which is needed to avoid brute-forcing, since this is a significant
password.. but how will that interact with ikiwiki? Well, ikiwiki _also_
uses a lock file. So, at a minimum, someone can not only try to brute-force
the pwauth password, but the ikiwiki processes that stack up due to that
will also keep ikiwiki's lock held. Which basically DOSes the wiki for
everyone else; noone else can try to log in, or log out, or edit a page,
all of which require taking the lock.
So I don't think I'll be accepting this plugin into ikiwiki itself..
--[[Joey]]
|