Files
@ f629e9a0c376
Branch filter:
Location: kallithea/docs/usage/email.rst - annotation
f629e9a0c376
3.4 KiB
text/prs.fallenstein.rst
auth: secure password reset implementation
This is a better implementation of password reset function, which
doesn't involve sending a new password to the user's email address
in clear text, and at the same time is stateless.
The old implementation generated a new password and sent it
in clear text to whatever email assigned to the user currently,
so that any user, possibly unauthenticated, could request a reset
for any username or email. Apart from potential insecurity, this
made it possible for anyone to disrupt users' workflow by repeatedly
resetting their passwords.
The idea behind this implementation is to generate
an authentication token which is dependent on the user state
at the time before the password change takes place, so the token
is one-time and can't be reused, and also to bind the token to
the browser session.
The token is calculated as SHA1 hash of the following:
* user's identifier (number, not a name)
* timestamp
* hashed user's password
* session identifier
* per-application secret
We use numeric user's identifier, as it's fixed and doesn't change,
so renaming users doesn't affect the mechanism. Timestamp is added
to make it possible to limit the token's validness (currently hard
coded to 24h), and we don't want users to be able to fake that field
easily. Hashed user's password is needed to prevent using the token
again once the password has been changed. Session identifier is
an additional security measure to ensure someone else stealing the
token can't use it. Finally, per-application secret is just another
way to make it harder for an attacker to guess all values in an
attempt to generate a valid token.
When the token is generated, an anonymous user is directed to a
confirmation page where the timestamp and the usernames are already
preloaded, so the user needs to specify the token. User can either
click the link in the email if it's really them reading it, or to type
the token manually.
Using the right token in the same session as it was requested directs
the user to a password change form, where the user is supposed to
specify a new password (twice, of course). Upon completing the form
(which is POSTed) the password change happens and a notification
mail is sent.
The test is updated to test the basic functionality with a bad and
a good token, but it doesn't (yet) cover all code paths.
The original work from Andrew has been thorougly reviewed and heavily
modified by Søren Løvborg.
This is a better implementation of password reset function, which
doesn't involve sending a new password to the user's email address
in clear text, and at the same time is stateless.
The old implementation generated a new password and sent it
in clear text to whatever email assigned to the user currently,
so that any user, possibly unauthenticated, could request a reset
for any username or email. Apart from potential insecurity, this
made it possible for anyone to disrupt users' workflow by repeatedly
resetting their passwords.
The idea behind this implementation is to generate
an authentication token which is dependent on the user state
at the time before the password change takes place, so the token
is one-time and can't be reused, and also to bind the token to
the browser session.
The token is calculated as SHA1 hash of the following:
* user's identifier (number, not a name)
* timestamp
* hashed user's password
* session identifier
* per-application secret
We use numeric user's identifier, as it's fixed and doesn't change,
so renaming users doesn't affect the mechanism. Timestamp is added
to make it possible to limit the token's validness (currently hard
coded to 24h), and we don't want users to be able to fake that field
easily. Hashed user's password is needed to prevent using the token
again once the password has been changed. Session identifier is
an additional security measure to ensure someone else stealing the
token can't use it. Finally, per-application secret is just another
way to make it harder for an attacker to guess all values in an
attempt to generate a valid token.
When the token is generated, an anonymous user is directed to a
confirmation page where the timestamp and the usernames are already
preloaded, so the user needs to specify the token. User can either
click the link in the email if it's really them reading it, or to type
the token manually.
Using the right token in the same session as it was requested directs
the user to a password change form, where the user is supposed to
specify a new password (twice, of course). Upon completing the form
(which is POSTed) the password change happens and a notification
mail is sent.
The test is updated to test the basic functionality with a bad and
a good token, but it doesn't (yet) cover all code paths.
The original work from Andrew has been thorougly reviewed and heavily
modified by Søren Løvborg.
2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 fbbe80e3322b 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 66f1b9745905 66f1b9745905 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 c935bcaf7086 c935bcaf7086 c935bcaf7086 c935bcaf7086 c935bcaf7086 c935bcaf7086 c935bcaf7086 c935bcaf7086 2079e864ce51 fbbe80e3322b 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 2079e864ce51 fbbe80e3322b 2079e864ce51 2079e864ce51 22a3fa3c4254 2079e864ce51 2079e864ce51 2079e864ce51 fbbe80e3322b 2079e864ce51 | .. _email:
==============
Email settings
==============
The Kallithea configuration file has several email related settings. When
these contain correct values, Kallithea will send email in the situations
described below. If the email configuration is not correct so that emails
cannot be sent, all mails will show up in the log output.
Before any email can be sent, an SMTP server has to be configured using the
configuration file setting ``smtp_server``. If required for that server, specify
a username (``smtp_username``) and password (``smtp_password``), a non-standard
port (``smtp_port``), encryption settings (``smtp_use_tls`` or ``smtp_use_ssl``)
and/or specific authentication parameters (``smtp_auth``).
Application emails
------------------
Kallithea sends an email to `users` on several occasions:
- when comments are given on one of their changesets
- when comments are given on changesets they are reviewer on or on which they
commented regardless
- when they are invited as reviewer in pull requests
- when they request a password reset
Kallithea sends an email to all `administrators` upon new account registration.
Administrators are users with the ``Admin`` flag set on the *Admin > Users*
page.
When Kallithea wants to send an email but due to an error cannot correctly
determine the intended recipients, the administrators and the addresses
specified in ``email_to`` in the configuration file are used as fallback.
Recipients will see these emails originating from the sender specified in the
``app_email_from`` setting in the configuration file. This setting can either
contain only an email address, like `kallithea-noreply@example.com`, or both
a name and an address in the following format: `Kallithea
<kallithea-noreply@example.com>`. However, if the email is sent due to an
action of a particular user, for example when a comment is given or a pull
request created, the name of that user will be combined with the email address
specified in ``app_email_from`` to form the sender (and any name part in that
configuration setting disregarded).
The subject of these emails can optionally be prefixed with the value of
``email_prefix`` in the configuration file.
Error emails
------------
When an exception occurs in Kallithea -- and unless interactive debugging is
enabled using ``set debug = true`` in the ``[app:main]`` section of the
configuration file -- an email with exception details is sent by WebError_'s
``ErrorMiddleware`` to the addresses specified in ``email_to`` in the
configuration file.
Recipients will see these emails originating from the sender specified in the
``error_email_from`` setting in the configuration file. This setting can either
contain only an email address, like `kallithea-noreply@example.com`, or both
a name and an address in the following format: `Kallithea Errors
<kallithea-noreply@example.com>`.
*Note:* The WebError_ package does not respect ``smtp_port`` and assumes the
standard SMTP port (25). If you have a remote SMTP server with a different port,
you could set up a local forwarding SMTP server on port 25.
References
----------
- `Error Middleware (Pylons documentation) <http://pylons-webframework.readthedocs.org/en/latest/debugging.html#error-middleware>`_
- `ErrorHandler (Pylons modules documentation) <http://pylons-webframework.readthedocs.org/en/latest/modules/middleware.html#pylons.middleware.ErrorHandler>`_
.. _WebError: https://pypi.python.org/pypi/WebError
|