I've been working to wrap my head around DBIx::UserDB, who's POD includes the following statement: 

Passwords are uuencoded for storage (for minimal privacy not for secur
+ity), so take this into account when setting the password field's len
+gth. If you want to store password in plaintext, use the scramble_pas
+sword method.

[download]
It seems that WWW::Authenticate will handle creating sessions to maintain state for an authenticated user; that DBIx::UserDB will handle the management of user, group and privilege tables as well as consultation with an Access Control List to authorize access to applications and resources. I've been hacking on the former to integrate with the latter.

It seems now that the one missing piece for my access control / security regime is a method for encrypting passwords used in my authentication scheme. I'll use an ssl connection to prevent sniffing, man-in-the-middle threats. Now my concern is with folks who might have shell access to the database server for applications deployed to shared hosting environments. If I could only figure out how to use these tools together with a password encryption scheme, and a method for comparing encrypted passwords at authentication, I'd be in business.

Can anyone advise me on this? All help is appreciated.

-- Hugh

In reply to Integrating Password encryption into DBIx::UserDB by hesco

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.