<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	
	>
<channel>
	<title>
	Comments on: Security problem and a fix	</title>
	<atom:link href="https://www.dragonflydigest.com/2012/01/20/security-problem-and-a-fix/feed/" rel="self" type="application/rss+xml" />
	<link>https://www.dragonflydigest.com/2012/01/20/security-problem-and-a-fix/</link>
	<description>A running description of activity related to DragonFly BSD.</description>
	<lastBuildDate>Sun, 22 Jan 2012 23:19:22 +0000</lastBuildDate>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>
	<item>
		<title>
		By: ?????????? ? MySQL, Gitorious, PowerDNS, Suhosin PHP, OpenSSL, Moodle, VirtualBox, Solaris, Wireshark, Glibc, DragonFly BSD, Asterisk&#160;&#124;&#160;AllUNIX.ru &#8212; ????????????? ?????? ? UNIX-????????		</title>
		<link>https://www.dragonflydigest.com/2012/01/20/security-problem-and-a-fix/comment-page-1/#comment-44438</link>

		<dc:creator><![CDATA[?????????? ? MySQL, Gitorious, PowerDNS, Suhosin PHP, OpenSSL, Moodle, VirtualBox, Solaris, Wireshark, Glibc, DragonFly BSD, Asterisk&#160;&#124;&#160;AllUNIX.ru &#8212; ????????????? ?????? ? UNIX-????????]]></dc:creator>
		<pubDate>Sun, 22 Jan 2012 23:19:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.shiningsilence.com/dbsdlog/?p=9029#comment-44438</guid>

					<description><![CDATA[[...] ???????????? ??????? DragonFly BSD ???????? ???????? ? ???????????? ???????, ??????? ?????? [...]]]></description>
			<content:encoded><![CDATA[<p>[&#8230;] ???????????? ??????? DragonFly BSD ???????? ???????? ? ???????????? ???????, ??????? ?????? [&#8230;]</p>
]]></content:encoded>
		
			</item>
		<item>
		<title>
		By: Lazarus		</title>
		<link>https://www.dragonflydigest.com/2012/01/20/security-problem-and-a-fix/comment-page-1/#comment-44431</link>

		<dc:creator><![CDATA[Lazarus]]></dc:creator>
		<pubDate>Sat, 21 Jan 2012 03:28:04 +0000</pubDate>
		<guid isPermaLink="false">http://www.shiningsilence.com/dbsdlog/?p=9029#comment-44431</guid>

					<description><![CDATA[From 
http://onlamp.com/pub/a/bsd/2002/08/08/FreeBSD_Basics.html?page=2
(Works in DragonFly IIRC)

To implement Blowfish hashes, edit /etc/login.conf and change the passwd_format line so that it looks like this:

:passwd_format=blf:\
Save your change, then rebuild the login database with this command:

cap_mkdb /etc/login.conf
You&#039;ll then have to change all of your user&#039;s passwords so they will get a new Blowfish hash. You can do this by typing:

passwd username
as the superuser. Whatever username you use, that will be the user whose password will be updated. Repeat for all of your users, including the root account.

Once you&#039;re finished, double-check that it worked and you didn&#039;t forget any users:

more /etc/master.passwd
All of the passwords for your users should begin with $2.

Finally, configure the adduser utility to use Blowfish whenever you create a new user by editing /etc/auth.conf. Change the crypt_default line so that it looks like this:

crypt_default=blf]]></description>
			<content:encoded><![CDATA[<p>From<br />
<a href="http://onlamp.com/pub/a/bsd/2002/08/08/FreeBSD_Basics.html?page=2" rel="nofollow ugc">http://onlamp.com/pub/a/bsd/2002/08/08/FreeBSD_Basics.html?page=2</a><br />
(Works in DragonFly IIRC)</p>
<p>To implement Blowfish hashes, edit /etc/login.conf and change the passwd_format line so that it looks like this:</p>
<p>:passwd_format=blf:\<br />
Save your change, then rebuild the login database with this command:</p>
<p>cap_mkdb /etc/login.conf<br />
You&#8217;ll then have to change all of your user&#8217;s passwords so they will get a new Blowfish hash. You can do this by typing:</p>
<p>passwd username<br />
as the superuser. Whatever username you use, that will be the user whose password will be updated. Repeat for all of your users, including the root account.</p>
<p>Once you&#8217;re finished, double-check that it worked and you didn&#8217;t forget any users:</p>
<p>more /etc/master.passwd<br />
All of the passwords for your users should begin with $2.</p>
<p>Finally, configure the adduser utility to use Blowfish whenever you create a new user by editing /etc/auth.conf. Change the crypt_default line so that it looks like this:</p>
<p>crypt_default=blf</p>
]]></content:encoded>
		
			</item>
		<item>
		<title>
		By: Anonymous		</title>
		<link>https://www.dragonflydigest.com/2012/01/20/security-problem-and-a-fix/comment-page-1/#comment-44430</link>

		<dc:creator><![CDATA[Anonymous]]></dc:creator>
		<pubDate>Sat, 21 Jan 2012 02:31:11 +0000</pubDate>
		<guid isPermaLink="false">http://www.shiningsilence.com/dbsdlog/?p=9029#comment-44430</guid>

					<description><![CDATA[I wonder whether there is a reason for using SHA and MD5 for password hashing in DFlyBSD? Wouldn&#039;t it be better to use some hashing scheme that was designed with that specific application in mind like bcrypt or PBKDF2? While I&#039;m not an expert in these matters, I link to an article whose argumentation I found quite plausible: http://codahale.com/how-to-safely-store-a-password/]]></description>
			<content:encoded><![CDATA[<p>I wonder whether there is a reason for using SHA and MD5 for password hashing in DFlyBSD? Wouldn&#8217;t it be better to use some hashing scheme that was designed with that specific application in mind like bcrypt or PBKDF2? While I&#8217;m not an expert in these matters, I link to an article whose argumentation I found quite plausible: <a href="http://codahale.com/how-to-safely-store-a-password/" rel="nofollow ugc">http://codahale.com/how-to-safely-store-a-password/</a></p>
]]></content:encoded>
		
			</item>
	</channel>
</rss>
