Max number of user accounts????

ccs

I have built a web site with a member's only section. Since Abyss doesn't have a way to automatically enter user accounts, I have painstakingly been adding in user accounts by hand. It seems that once I get to about 150 or so, any additional ones fail. I've deleted and reenter the accounts, I've used simple passwords like 123 and abc, but still I can not get some accounts to work.
Is there a maximum number of accounts that the software can handle? Is there ANY way to work around this?
I've been promising this new site for a year and now its open and only a fraction of our members can access it.

cmxflash

Then use a PHP-login instead? I've written a small and secure login which I use on my Apache-powered servers.
You can download it here.
users.php should be in the form:
username|password|plain=0/md5=1
*Edit
Tired to add about 2000 users, Abyss could handle it without a problem.

aprelium

ccs,
There is no limit on the number of users (except the size of your memory to store the list, which should not cause any problem on modern hardware).
Could you please send us your configuration file and let us know which usernames/password do not work as expected?

ccs

Then use a PHP-login instead? I've written a small and secure login which I use on my Apache-powered servers.

I don't want a band-aid, I want the server to do what its supposed to do.
I'm not sure how I can send you my configuration file without blowing a gaping hole in my security, but I'll see what I can come up with.

cmxflash

ccs wrote

Then use a PHP-login instead? I've written a small and secure login which I use on my Apache-powered servers.
I don't want a band-aid, I want the server to do what its supposed to do.

You would save a lot of time with my script. Abyss doesn't need to be restarted when you add a new user and it's pretty simple to use fwrite so people can register an account without having you add it manually.

ccs wrote
I'm not sure how I can send you my configuration file without blowing a gaping hole in my security, but I'll see what I can come up with.

Just remove the MD5-hashes and you should be fine. Or simply send it by mail to Aprelium.

ccs

Ok, I'll take a look, thanks. Does your script modify the Abyss Config file? If not, does it set the environment table like the web server does? (I need that information).
As far as the sending the config file, it seems to me that a modified file would (could) defeat the purpose, but then again, I'm not thrilled with the idea of sending a file with user ids and passwords to anyone. I also don't relish the idea of manually removing all the passwords first either. This is a commercial web site I'm working on, so time very much is money on this project. :)

aprelium

ccs wrote
As far as the sending the config file, it seems to me that a modified file would (could) defeat the purpose, but then again, I'm not thrilled with the idea of sending a file with user ids and passwords to anyone. I also don't relish the idea of manually removing all the passwords first either. This is a commercial web site I'm working on, so time very much is money on this project. :)

But there is no information there that we could use: the passwords are encrypted using a one-way hashing function so we cannot recover the passwords even if we wanted to do it. Such an operation would require a lot of time (several weeks) and a huge computing power.

AbyssUnderground

css,
You are sending the configuration file to the company that made the software. If you cannot trust them, who can you trust?
Just my thoughts.

ccs

You are sending the configuration file to the company that made the software.

I fail to see what difference this makes. Are you saying that just because they sold me a product, all of a sudden I'm supposed to turn over sensitive information to them and all they employ? What do you think my members would say if I told them that I was going to send their login credentials to a company whom I've never personally meet, working in a location I'm not really sure of, who may or may not have other people working for them that are trusted.....but don't worry....just you don't give out your login information to anyone. Doesn't sound all that great an idea from their point of view now, does it?
Its not that I don't "trust" Aprelium, but I am totally liable for all confidential information in my personal control. I think its a wise move to know exactly who I am providing that information too and what potential ramifications it could have.
As it turns out, I checked into the encryption technology used by Abyss's passwords and was satisfied that it wasn't easy to reverse engineer. That doesn't mean that there isn't another way to do it, especially by the people who wrote the software, but I had some reasonable assurances that what I was sending would not compromise my member's personal information beyond reasonable due-diligence.
Of course, if you extend your logic out fully, nobody should have any problem at all sending whatever information is asked for to the likes of Microsoft, right? After all, they wrote the software, who could be more trustworthy :D

TRUSTAbyss

They use a base64 and md5 hash for storing the passwords. No one has ever
broken the md5 hash and probably never will because it's completely random.
You have nothing to worry about.

AbyssUnderground

TRUSTAbyss wrote
They use a base64 and md5 hash for storing the passwords. No one has ever
broken the md5 hash and probably never will because it's completely random.
You have nothing to worry about.

Actually its not random, its just irriversable. There are decoders out there but they get the "decoded" part from the encoded part. They set a computer to do every letter "a" "b" then "aa" "ab" etc until they have however many letter/words and their encryption. They store it in a database and before you know it they can decode a fair amount of md5 hashes. I tried the same thing myself but I didnt get very far, plus I have no reason to.

TRUSTAbyss

It depends how complex the password is. If you use letters and numbers, you
should have a secure enough password, right?

cmxflash

TRUSTAbyss wrote
They use a base64 and md5 hash for storing the passwords.

Not true. Just MD5.

css wrote
I fail to see what difference this makes. Are you saying that just because they sold me a product, all of a sudden I'm supposed to turn over sensitive information to them and all they employ?

If they were after your sensetive data, they could easily create a back-door in their software and access your server that way. I'm assuming you're using X2 since you wrote you bought the product, so it would be easy for them to create a special version and send it out to you using their update system.
MD5 is impossible to reverse engineer, it's only possible to either brute force a hash value or use a rainbow table (common words and passwords). And that would take a lot of time.
My script doesn't modify the abyss configuration file in any way. You'll have to manually add every account into the users.php file, or write some simple script that does the job for you.
Also, since you have 150+ users and run a commercial website, I would suggest you to get some sort of dynamic serverbased language(PHP, Perl, Python, ASP.NET, ect).

AbyssUnderground

TRUSTAbyss wrote
It depends how complex the password is. If you use letters and numbers, you
should have a secure enough password, right?

Yes. Also "A" and "a" are two different characters if I remember rightly. So it is difficult to decode a hash unless you have a very good system for encoding them and storing them in the first place. Even on a moden PC this would take a very very very long time.

ccs

If they were after your sensitive data, they could easily create a back-door in their software and access your server that way.

I really don't feel like hashing (no pun intended :D) this over and over, but there is much more to security than simply encrypting data. There are LEGAL aspects to security too. If someone breaks down my defenses, gets through my firewalls, even uses a back-door in seemingly legitimate software, I can protect myself legally by showing I took reasonable measures to protect my data. However, if I send a configuration file anyplace out of my control, knowing that it has valid user names and passwords, and that information is compromised, any lawyer in the world, not even a good one, will eat me alive in a courtroom. There is far more involved than simple "trust me" or "if they really wanted to...".

Also, since you have 150+ users and run a commercial website, I would suggest you to get some sort of dynamic server based language(PHP, Perl, Python, ASP.NET, ect).

Most of my site is dynamic content, but I choose to use compiled executables instead of less secured scripting languages. However, I expect the web server software to do a few basic functions, one of which is user management. There is no reason anyone should have to reinvent the wheel on things that properly belong in the server software to begin with.
For the record, Aprelium support was very responsive (as always) and to the best of my knowledge, the problem is solved. I will say that I've found other web server packages to be a bit more mature in certain areas, such as native SSL support and user management, but I have not once found a package that was so well supported as Abyss. It is mainly because of the support that Aprelium has provided now and in the past, that convinced me to switch from Sambar to Abyss on my commercial server.

AbyssUnderground

I would never doubt Aprelium even for a second. :-)

ccs

I would never doubt Aprelium even for a second. :-)

Personally, I agree. Legally, you would lose everything with this as your defense :-)

AbyssUnderground

ccs wrote

I would never doubt Aprelium even for a second. :-)
Personally, I agree. Legally, you would lose everything with this as your defense :-)

Maybe, but Aprelium wouldnt do anything like that. They've worked too hard to be stupid and lose it all :-)

aprelium

We thank you all for your positive feedback.
As AbyssUnderground said, we are working very hard so it would be a suicide if we don't protect our customers' information and consider it as highly confidential.
Your use of the access control and the number of users you have configured suggested to us several improvements which we will add in the future versions. With the new system you will have a much more easier and programmable system to control accesses to protected files.