Files
@ f629e9a0c376
Branch filter:
Location: kallithea/docs/usage/performance.rst - annotation
f629e9a0c376
2.5 KiB
text/prs.fallenstein.rst
auth: secure password reset implementation
This is a better implementation of password reset function, which
doesn't involve sending a new password to the user's email address
in clear text, and at the same time is stateless.
The old implementation generated a new password and sent it
in clear text to whatever email assigned to the user currently,
so that any user, possibly unauthenticated, could request a reset
for any username or email. Apart from potential insecurity, this
made it possible for anyone to disrupt users' workflow by repeatedly
resetting their passwords.
The idea behind this implementation is to generate
an authentication token which is dependent on the user state
at the time before the password change takes place, so the token
is one-time and can't be reused, and also to bind the token to
the browser session.
The token is calculated as SHA1 hash of the following:
* user's identifier (number, not a name)
* timestamp
* hashed user's password
* session identifier
* per-application secret
We use numeric user's identifier, as it's fixed and doesn't change,
so renaming users doesn't affect the mechanism. Timestamp is added
to make it possible to limit the token's validness (currently hard
coded to 24h), and we don't want users to be able to fake that field
easily. Hashed user's password is needed to prevent using the token
again once the password has been changed. Session identifier is
an additional security measure to ensure someone else stealing the
token can't use it. Finally, per-application secret is just another
way to make it harder for an attacker to guess all values in an
attempt to generate a valid token.
When the token is generated, an anonymous user is directed to a
confirmation page where the timestamp and the usernames are already
preloaded, so the user needs to specify the token. User can either
click the link in the email if it's really them reading it, or to type
the token manually.
Using the right token in the same session as it was requested directs
the user to a password change form, where the user is supposed to
specify a new password (twice, of course). Upon completing the form
(which is POSTed) the password change happens and a notification
mail is sent.
The test is updated to test the basic functionality with a bad and
a good token, but it doesn't (yet) cover all code paths.
The original work from Andrew has been thorougly reviewed and heavily
modified by Søren Løvborg.
This is a better implementation of password reset function, which
doesn't involve sending a new password to the user's email address
in clear text, and at the same time is stateless.
The old implementation generated a new password and sent it
in clear text to whatever email assigned to the user currently,
so that any user, possibly unauthenticated, could request a reset
for any username or email. Apart from potential insecurity, this
made it possible for anyone to disrupt users' workflow by repeatedly
resetting their passwords.
The idea behind this implementation is to generate
an authentication token which is dependent on the user state
at the time before the password change takes place, so the token
is one-time and can't be reused, and also to bind the token to
the browser session.
The token is calculated as SHA1 hash of the following:
* user's identifier (number, not a name)
* timestamp
* hashed user's password
* session identifier
* per-application secret
We use numeric user's identifier, as it's fixed and doesn't change,
so renaming users doesn't affect the mechanism. Timestamp is added
to make it possible to limit the token's validness (currently hard
coded to 24h), and we don't want users to be able to fake that field
easily. Hashed user's password is needed to prevent using the token
again once the password has been changed. Session identifier is
an additional security measure to ensure someone else stealing the
token can't use it. Finally, per-application secret is just another
way to make it harder for an attacker to guess all values in an
attempt to generate a valid token.
When the token is generated, an anonymous user is directed to a
confirmation page where the timestamp and the usernames are already
preloaded, so the user needs to specify the token. User can either
click the link in the email if it's really them reading it, or to type
the token manually.
Using the right token in the same session as it was requested directs
the user to a password change form, where the user is supposed to
specify a new password (twice, of course). Upon completing the form
(which is POSTed) the password change happens and a notification
mail is sent.
The test is updated to test the basic functionality with a bad and
a good token, but it doesn't (yet) cover all code paths.
The original work from Andrew has been thorougly reviewed and heavily
modified by Søren Løvborg.
fa88997aa421 fa88997aa421 fa88997aa421 22a3fa3c4254 fa88997aa421 fa88997aa421 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 5d12768a0aa1 5d12768a0aa1 5ae8e644aa88 5ae8e644aa88 5d12768a0aa1 5ae8e644aa88 4e6dfdb3fa01 5ae8e644aa88 5d12768a0aa1 e73a69cb98dc fa88997aa421 3b179f1ac3a2 fa88997aa421 6257de126ec7 4610a39d3be9 fa88997aa421 5ae8e644aa88 8b8edfc25856 5ae8e644aa88 5ae8e644aa88 5ae8e644aa88 778f7ae3b6eb 778f7ae3b6eb 8b8edfc25856 e73a69cb98dc fa88997aa421 5ae8e644aa88 5ae8e644aa88 4cd84f4f28fb 4cd84f4f28fb d79f3505549e 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4cd84f4f28fb 4cd84f4f28fb 778f7ae3b6eb fbbe80e3322b 778f7ae3b6eb | .. _performance:
================================
Optimizing Kallithea performance
================================
When serving a large amount of big repositories, Kallithea can start
performing slower than expected. Because of the demanding nature of handling large
amounts of data from version control systems, here are some tips on how to get
the best performance.
* Kallithea is often I/O bound, and hence a fast disk (SSD/SAN) is
usually more important than a fast CPU.
* Sluggish loading of the front page can easily be fixed by grouping repositories or by
increasing cache size (see below). This includes using the lightweight dashboard
option and ``vcs_full_cache`` setting in .ini file.
Follow these few steps to improve performance of Kallithea system.
1. Increase cache
Tweak beaker cache settings in the ini file. The actual effect of that
is questionable.
2. Switch from SQLite to PostgreSQL or MySQL
SQLite is a good option when having a small load on the system. But due to
locking issues with SQLite, it is not recommended to use it for larger
deployments. Switching to MySQL or PostgreSQL will result in an immediate
performance increase. A tool like SQLAlchemyGrate_ can be used for
migrating to another database platform.
3. Scale Kallithea horizontally
Scaling horizontally can give huge performance benefits when dealing with
large amounts of traffic (many users, CI servers, etc.). Kallithea can be
scaled horizontally on one (recommended) or multiple machines. In order
to scale horizontally you need to do the following:
- Each instance needs its own .ini file and unique ``instance_id`` set.
- Each instance's ``data`` storage needs to be configured to be stored on a
shared disk storage, preferably together with repositories. This ``data``
dir contains template caches, sessions, whoosh index and is used for
task locking (so it is safe across multiple instances). Set the
``cache_dir``, ``index_dir``, ``beaker.cache.data_dir``, ``beaker.cache.lock_dir``
variables in each .ini file to a shared location across Kallithea instances
- If celery is used each instance should run a separate Celery instance, but
the message broker should be common to all of them (e.g., one
shared RabbitMQ server)
- Load balance using round robin or IP hash, recommended is writing LB rules
that will separate regular user traffic from automated processes like CI
servers or build bots.
.. _SQLAlchemyGrate: https://github.com/shazow/sqlalchemygrate
|