[
https://issues.apache.org/jira/browse/GUACAMOLE-1162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17186605#comment-17186605
]
Nick Couchman commented on GUACAMOLE-1162:
------------------------------------------
This has been widely discussed, with a couple of conclusions:
* There is no practical way to securely store passwords in the database for
things like connection passwords and the like. Since Guacamole must be able to
reverse the passwords into clear text to make use of them (to send to a server,
for example), any encryption done would necessarily need to be reversible, and
thus is really only obscuring the password, not actually securing it.
* Using password pass-through with a setup that involves LDAP or AD and
Parameter Tokens often allows you to avoid having to actually store usernames
and passwords, and even avoids the need to maintain connection configurations
for individual users.
* The database that backs Guacamole Client should be protected and not shared
outside of usage by the administrator of the Guacamole system along with the
Guacamole Client itself.
* There are already efforts underway to support the use of Credential Vaults
and the like for storing passwords, when needed, more securely than having them
in a database. We believe the effort to support these methods is more
worthwhile than to try to implement encryption in the database that would have
to be reversible. See GUACAMOLE-641.
> security in guacamole_user_attribute
> ------------------------------------
>
> Key: GUACAMOLE-1162
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-1162
> Project: Guacamole
> Issue Type: Improvement
> Components: guacamole-auth-jdbc-mysql
> Affects Versions: 1.2.0
> Environment: any
> Reporter: jean louis abegg
> Priority: Trivial
> Labels: security
>
> Hello,
> I've backuped a guacamole install 1.2.0 and sniffed in the .sql file.
> In the table guacamole_user_attribute, i've seen clear password in it.
> A suggestion would be to encrypt the parameter_value when parameter_name is
> equal to "password"
> Unless i'ts already done in 1.3.0?
> Thank you for your hard work.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
