Removing Salt

[Norco]

Hello everyone.

I just purchased a vbulletin forum, which I want to integrate my users from my current site (a user system which I coded, and has approximately 4000 members. I thought all I would need to do is transfer them into the vb user table, but I noticed the salt which I don't use on my site which I am wanting to integrate with. I do use md5 encryption for the passwords although.

I am wondering how I would go about removing the salt system from my forum so it doesn't use it to login / out. I've already searched the forum for such things, but no one really said how, or just mentioned its a big security risk (I'm willing to take that chance).

Thanks to anyone who helps me through this process. And please remember, if you are, explain in a little more detail then you probably usually are used to. I don't know to much about anything.. I just installed vbulletin today!

[Coders Shack]

mass email telling them to request their passwords? or mass password reset message. lol

[Norco]

Right now I am thinking it would be easier to use the same salt system on my website usersystem... but how? Hmmm.

Even if I did install it, I would have to mass email all 4000 members linking to a password reset form where they would have to enter their email, which would email them a temporary password, but would update the hash for it. Problem is about that is I have no clue how to do it... I would need to find the same type of salt system vb uses, or extract it from the coding..

[Dismounted]

salt is a random 3-character combination generated on registration, so you would simply have to assign users a random 3-letter combination. Passwords are encrypted like so:
md5(md5($password) . $salt)

[Norco]

Ok, I have decided to migrate the salt system to my user system on my website. In the coding for the salt system I've come up with.. this is how is randomly sets a salt:


$salt = md5(rand(1,5000) * rand(1,5000) * rand(1,5000));

$password = md5($password . $salt);

I would 'NOT' be using the vbulletn registration system, it would all be done through my website. So.. if everyone of my useres reset their password (which I would include the whole salt thing when its done) it would update for the site system, and the forum?

Right?

[Brad]

In vBulletin the salt is generated like this;

From the file /includes/class_dm_user.php

/**
* Generates a new user salt string
*
* @param integer (Optional) the length of the salt string to generate
*
* @return string
*/
function fetch_user_salt($length = SALT_LENGTH) // Note; by default SALT_LENGTH is 3
{
$salt = '';

for ($i = 0; $i < $length; $i++)
{
$salt .= chr(rand(32, 126));
}

return $salt;
}

Depending on how your current system works you may or may not need to reset the passwords. Can you give us some code to look at?

Once you get your custom registration system hashing passwords like vBulletin all you'll have to do is get that data over to the vBulletin database (pretty easy task).

[Paul M]

You could just set the salt column in the users table to '' (null string) for everyone - and edit the function that vb uses (shown above) to always return '' as well.

(in fact, defining SALT_LENGTH as 0 might be enough, not sure where that is set)

[Brad]

Line 18 in the file class_dm_user.php :)

I usually change it to something other than the default when I install vBulletin. I don't know if it helps much but hey...why not? :)

[Norco]

What could would you like to see? Login?

Edit; I need to know like, how the login of the vb uses the salt with the md5 encrypted password to check if it is right.

[Dismounted]

It just compares the two passwords.

[Norco]

It just compares the two passwords.

Yes, I realize that, but I need to find the coding which does this.

[Dismounted]

Simply fetch the salt from the database, encrypt the password, and check.

[Norco]

Ok.. maybe this would help if I posted my login function, this will not work, and I do not know why. Whenever I try to login, it doesn't work - always returns a wrong password. I copied the encrypted md5 password and salt directly from my account in the vb user table, and put it into my site's users table.. under my account.


function login(){
if (!$_POST[login]) {
global $Ybox;
$Ybox->top("Welcome Guest");
echo("<form method='POST' style='margin: 0px;'>
<div style='text-align: center; padding: 3px;'>
Username: <br>
<input type='text' size='15' maxlength='25' $read name='username'><br>
Password: <br>
<input type='password' size='15' maxlength='25' $read name='password'><br>
</div>
<br>
<center><input type='submit' name='login' value='Login'> <input type='reset' name='reset' value='Reset'><br><br>
</form>
<a href='/register/'>Register</a> | <a href='/forgotpass/'>Forgot Password?</a></center>");
$Ybox->stop();
}else{
$username = safe($_POST["username"]);
$info = mysql_query("SELECT * FROM users WHERE username = '$username'") or die(mysql_error());
$data = mysql_fetch_array($info);
$pass5 = md5($_POST['password']);
$password = ($pass5 . $data[salt]);
$passcheck = ($data[password] . $data[salt]);
if($data[password] != $password) {
global $Nav;
Bbox ("Error","Incorrect Username or Password, Please go back and fix this.");
}else{
Rbox("Success","<center>Please wait as you are being logged in!</center>");
}
}
}

[Dismounted]

Try:
function login(){
if (!$_POST[login]) {
global $Ybox;
$Ybox->top("Welcome Guest");
echo("<form method='POST' style='margin: 0px;'>
<div style='text-align: center; padding: 3px;'>
Username: <br>
<input type='text' size='15' maxlength='25' $read name='username'><br>
Password: <br>
<input type='password' size='15' maxlength='25' $read name='password'><br>
</div>
<br>
<center><input type='submit' name='login' value='Login'> <input type='reset' name='reset' value='Reset'><br><br>
</form>
<a href='/register/'>Register</a> | <a href='/forgotpass/'>Forgot Password?</a></center>");
$Ybox->stop();
}else{
$username = safe($_POST["username"]);
$info = mysql_query("SELECT * FROM users WHERE username = '$username'") or die(mysql_error());
$data = mysql_fetch_array($info);
$password = md5(md5($_POST['password']) . $data['salt']);
if($data[password] != $password) {
global $Nav;
Bbox ("Error","Incorrect Username or Password, Please go back and fix this.");
}else{
Rbox("Success","<center>Please wait as you are being logged in!</center>");
}
}
}

[Norco]

Ooh, thanks! Ill test it out to see if it works.