Secure Jam.py ?

[Andreas Schneider]

I want to develop a jam app that securely stores very important data. Web access takes place via password and 2FA. 

Database is a PostgresSQL with TDE (Transparent Data Encryption) (other server only reachable via dedicated network from app server

I assume that the web application server will be hacked in sometime

My main problem is that the admin.sqlite stores the password for the database connection in plain text.

[Dean D. Babic]

Hi, 

I was thinking to try SQLChiper with admin.sqlite but did not have time.

Basically, you could encrypt everything in admin without much overhead.
If the builder is not accessible, then one can't see the DB password even with sqlite access.

The encryption key could be sourced from the environment variable.

Regards

D.

[Andrew Yushev]

You can store users password hash in a separate table.

https://jam-py.com/docs/how_to/authentication/how_to_authenticate_from_custom_users_table.html

пт, 11 авг. 2023 г. в 04:43, Dean D. Babic <bab...@gmail.com>:

--
You received this message because you are subscribed to the Google Groups "Jam.py Users Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jam-py+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jam-py/6322efdb-7c41-4905-855e-38b4fbdf12e7n%40googlegroups.com.

[yush...@gmail.com]

And you can add an empty builder.html file to the project root folder to disable the builder

суббота, 12 августа 2023 г. в 13:01:29 UTC+3, yush...@gmail.com:

[Dean D. Babic]

Hi Andrew, 

I propose this:

Which makes DB password hidden:

[Dean D. Babic]

Hi, 

Exactly the same method can be used for Builder/sys_users :

function on_edit_form_shown(item) {
    $('input.f_password').prop("type", "password");
}


function on_field_get_text(field) {
    var item = field.owner;
    if (field.field_name === 'f_password') {
        if (item.id.value || field.value) {
            return '**********';
        }
    }
}
Will give:

[Dean D. Babic]

2FA for builder might be added like from here:

https://groups.google.com/g/jam-py/c/Nisyemcx6Vc/m/d6m7A4WSDQAJ

[EKuzmin]

Hi,

  I have a similar showstopper — the passwords in the admin.sqlite database are stored in plain text. Hiding the builder is not a real solution. Our pentester was able to obtain this file and extract the passwords without using the builder.
At this point, it's unclear how to properly address this issue.  

среда, 16 августа 2023 г. в 09:01:28 UTC+2, Dean D. Babic:

[Dean D. Babic]

Hi,

The pen tester has access to the server, and the ability to inspect the SQlite file. 

Heaps of pen testing is based on this premise.

Django is the same, hiding the admin panel.

I'm more then happy to accept the pull request with the developed solution. 

Here is the question before doing it:

- how is anyone accessing the builder if the password is lost? 

You could encrypt admin.sqlite database, it's easy to add this to Jam.py:

https://groups.google.com/g/jam-py/c/bnTIpJBZ1og/m/1KRmE_xdAQAJ