2

Before you think I should post it on an other forum - this is Windows OS related question, not programming.

I'm creating intranet website which needs user to authorize through Kerberos. After days of research I think that using PHP for this is not really best-way-to-do-it and I need to find other solution. So I got this idea, which works really good: I can use my knowledge in C# to use .NET Framework to do work for me. So I wrote (for now) little application, which uses Kerberos to check user credentials. I run application from PHP to check its return code something like:

myapplication.exe user_name password1!

(in near future it will get more information through command line)

It returns code based on authorization check, so my PHP application knows if it was success or not. Kerberos authorization is encrypted (that was super-easy with .NET), so I have "two birds with one stone". Of course, whole process is more complicated so I don't need to use it every single time, when user logins, but that's not the point here.

I'm asking questions, because I may learn something useful and I want to be sure:

Is this approach really secure? Does anybody can get password which I'm passing to command line? Can it be logged somewhere? And if yes - can I prevent this? If this is not secure - can I pass credentials more safely?

It's really just one question "Is this secure?" but I want to give you some idea what I'm asking for. I don't want to go too far with this, unless I'm sure it's good idea. Also, everything is working perfectly so far.

I'm using Apache server on Windows Server with MySQL database (probably will change to MSSQL Express).

[EDIT] I should point out that I'm using exec() command in PHP. I'm asking if you can somehow get communication between Apache service starting/running myapplication.exe, because password is passed one-time-only there as plain text.

Improve this question
1

1 Answer 1

Reset to default
1

No, this approach is insecure. On Windows, command line arguments are protected by user rights (technically it’s about access to the process object), but that’s not enough. A bug could exist in your web application that allows arbitrary code/command execution.

Instead, use stdin to “enter” the password. Of course, this requires that the application you’re calling knows to expect the password this way.

Also, you need to be very careful about passing user-provided command line arguments or I’ll just enter ; rm -rf / as the username. ;)

By the way: This method will have significant performance implications unless you aggressively cache return values.

Improve this answer
9
  • I'm using exec() function in PHP. You can use safe mode as pointed in "Notes" section. Also, I'm not keeping user credentials, only pass them directly to "myapp.exe", it check if you can authorize in domain (encrypted by Kerberos protocol) and only returns code (0 for succeed and other for failures). Also, as I said, there's more logic behind this. It will not only pass arguments, because first you need to check if user exists in database. It is also not "free for all" application, because users are created by administrators.
    – hagier
    Sep 27, 2016 at 8:25
  • I made small edit thanks to your answer. I hope it's more clear now. :)
    – hagier
    Sep 27, 2016 at 8:32
  • Safe mode is long gone. It’s also not about “keeping” credentials. If they appear on the command line of a process, they have left your application’s control. That’s the most important point.
    – Daniel B
    Sep 27, 2016 at 8:48
  • Good point about safe mode. But still a point of my question is: is there a way to interrupt this communication and gain access to a password? I can protect myself from running commands/script through username.
    – hagier
    Sep 27, 2016 at 8:59
  • 1
    Standard Input, like I wrote in my answer. You can view command line parameters using your favorite task manager like Task Manager or Process Explorer. The process command line should be considered public information.
    – Daniel B
    Sep 27, 2016 at 9:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .