318880 - Despot should log authentication results

Status: RESOLVED FIXED

(Webtools Graveyard :: Despot, defect)

Description

[Dave Miller [:justdave]]

Despot controls a fairly critical piece of CVS infrastructure, and thus should log authentication results (success or failure) just like the linux login shells do, so we can tell when people log in, or when someone is attempting to brute-force someone's password.

Using a perl warn() statement so it shows up in Apache's error log would probably be sufficient for now, but long-term it would be nice to feed it to syslog's auth.* channel.

Comment 1

[timeless]

so from memory, despot doesn't know the difference between a user logging in and a user clicking on some other button elsewhere in the site (all pages include the password and use it as a hidden form field).

do you really want despot to log each page visit, or should the code try to discover what a session is?

really, the code should seriously consider moving to using a login cookie.

Comment 2

[Dave Miller [:justdave]]

Yeah, I agree there, we need to move to a session-based auth instead of passing 
the password back and forth on every page view/button click.

Comment 3

[Dave Miller [:justdave]]

Attachment: Patch v1

In the meantime, here's what we've had locally patched on production for the last year or so.

Comment 4

[Reed Loden [:reed]]

Checking in despot.cgi;
/cvsroot/mozilla/webtools/despot/despot.cgi,v  <--  despot.cgi
new revision: 1.51; previous revision: 1.50
done