A few bugs?

[gentoose]

I have tried to search the forum about this, but didn't find anything... I'm using ISP-config 2.2.6 on debian etch.

#1. When I add a subdomain everything is smooth, but when i delete it, the DNS-entry is still there. It doesn't get deleted. Bug?

#2. The passwords somehow seems to be limited to 8 characters. If I choose a password for an e-mailuser like 'donotcrackthis', i can still log in in both roundcube and squirrelmail with the password 'donotcra' or 'donotcradle' or whatever, as long as it has the first 8 characters of the password. Has anyone else experienced this? Or is it something i my installation?

[till]

#1. When I add a subdomain everything is smooth, but when i delete it, the DNS-entry is still there. It doesn't get deleted. Bug?

Thats the intended behavioour. If you delete a website it does not mean that the dns entry shall be deleted too as you may run other services on your server that may need this DNS entry.

#2. The passwords somehow seems to be limited to 8 characters. If I choose a password for an e-mailuser like 'donotcrackthis', i can still log in in both roundcube and squirrelmail with the password 'donotcra' or 'donotcradle' or whatever, as long as it has the first 8 characters of the password. Has anyone else experienced this? Or is it something i my installation?

Thats a configuration issue, the default crypt algorithm in linux uses only the first 8 chars of a password. Please change the line:

$go_info["server"]["password_hash"] = 'crypt';

to:

$go_info["server"]["password_hash"] = 'md5';

in the file /home/admispconfig/ispconfig/lib/config.inc.php

[gentoose]

Thats the intended behavioour. If you delete a website it does not mean that the dns entry shall be deleted too as you may run other services on your server that may need this DNS entry.

Ok I see. But if the customer wants to delete the dns-entry, he has no possibility to do this, or am I missing something? Maybe a choice if you want to delete the dns-entry when deleting the sub-domain would be desirable in the future, at least if it were up to me. :)

Thats a configuration issue, the default crypt algorithm in linux uses only the first 8 chars of a password. Please change the line:

$go_info["server"]["password_hash"] = 'crypt';

to:

$go_info["server"]["password_hash"] = 'md5';

in the file /home/admispconfig/ispconfig/lib/config.inc.php

Ah... beautiful. Thank You!

[falko]

Ok I see. But if the customer wants to delete the dns-entry, he has no possibility to do this, or am I missing something? Maybe a choice if you want to delete the dns-entry when deleting the sub-domain would be desirable in the future, at least if it were up to me. :)

Customers don't have access to the DNS Manager, only resellers and the admin.

[gentoose]

Customers don't have access to the DNS Manager, only resellers and the admin.

Yes, that's what I thought. In other words: the customer can create a dns-entry by creating a subdomain, but cannot remove the very same entry that he or she just created. I don't know if this is intentionally by design, but it seems a bit backwards to me. If the customer creates something, it seems reasonable (at least to me) that he or she can delete it, without asking a reseller or admin. At least that is what I would have wanted. Maybe a suggestion for the next version of this great software? :)

[falko]

Yes, that's what I thought. In other words: the customer can create a dns-entry by creating a subdomain, but cannot remove the very same entry that he or she just created. I don't know if this is intentionally by design
Yes, that's intended.

[./w]

Hi,

I'm using CentOS 5.0, ISPConfig 2.2.12, and I can't get to use md5 (long) passwords. They're being cut at 8 chars.
I've changed that line (from 'crypt' to 'md5'), and it's still the same.

Help please !
Thanks.

[till]

After you changed the value from crypt to md5, only new users or users where you eneter a new password will use the new encryption method. Have a look at /etc/shadow, you will recognize that the password hashes look differently.

[./w]

wow ... this is weird !!
I thoght I have to reset the password, or even create a new user. I had tried that with no luck at all (in fact, tried many times, I even rebooted the server).

Today (after 2 days) I've tryied setting up a new password again, and it's working just fine with the 'md5' modification (I haven't changed anything more).
Could it be that ISPConfig needed some time to be aware of that change ? (maybe running some scripts at night).

If that's not the case, then it can be a chache issue or something. Quite strange !!
Anyway, it seems to be working now.

Thanks Till for your help !

[jbravo]

After you changed the value from crypt to md5, only new users or users where you eneter a new password will use the new encryption method. Have a look at /etc/shadow, you will recognize that the password hashes look differently.

What about other kinds of hashes? Can i use SHA-1 instead of MD5?

--
GreetZ .JbRaVo:.

[till]

You can only use the values crypt and md5 in this config setting.