The website I am working on just failed a security audit because the passwords in enterprise_admin_passwords do not have salts.

I tried looking at the Enterprise_Pci module (where the table is declared) - and found that the table is used to save old passwords, possibly for the purpose of forcing the admin user to change them when they expire.

  • What is that table used for ?
  • Are the passwords there used without salts, or are they taken from the admin_user table ?
  • try to connection with database and goto admin_user table ,select your user and update password using has password – Amit Bera Sep 2 '14 at 8:12

You are on the right track.
The table holds the admin passwords for 2 reasons.

  1. To check if the latest password has expired. IN this case the admin will be prompted with a message to change his password.
  2. To check if the password has already been used. In this case the admin will not be able to use the password he is trying to use.

The passwords kept in this table are the hashes of the passwords kept in the admin_user table. So if they are not hashed in that table they are not hashed in the passwords table either.

  • So the passwords are unsalted to ensure that the admin passwords are unique ? Or are they all using the salt from admin_user ? – Vlad Preda Sep 2 '14 at 8:16
  • @VladPreda. I think the passwords from enterprise_admin_passwords should be in the same form as the ones in admin_user – Marius Sep 2 '14 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.