The mailing list for listmasters using Sympa

["Philip Crandall" <address@concealed>]

Hello,

We need to replace the cookie secret value for our sympa installation.  I know that the secret is used for passwords stored in the database as well as for generating session cookies.  Most of our users are ldap users, and I’ve figured out how to decrypt and re-encrypt the passwords in the database manually.  I also see that the cookie.history file would need to be changed to allow sympa to start with the new value.  Is there anywhere else that the secret is used?  Are there other caveats to changing this value?

 

Additionally, we feel that an 8 byte hash probably does not provide sufficient protection of the secret.  Is there a specific reason for an 8-byte length (in cookielib.pm)?  Would it be safe to increase the length to 16 or 32 bytes?

 

Thanks,

 

Philip Crandall

NSIT Network-Based Services

University of Chicago

 

Attachment: smime.p7s
Description: S/MIME cryptographic signature