Subject: [tryton] Re: number of session by users

From: mb <[email-masked]>
Date: Tue, 22 Jul 2008 11:33:27 -0700 (PDT)

Very useful. I don't want to login with a different name, if I just
change to another machine on the same net and forgot to logout or plan
to return to the first machine. Since automatic logout after session
timeout will occur, I don't see security risks from this side.

On 18 Jul., 12:12, Cédric Krier <[email-masked]> wrote:
> In the changeset 653, I have change the session management to allow more
> than one session per users.http://www.tryton.org/hgwebdir.cgi/trytond/rev/571b3bd92246
>
> What do you think about this?
> Is it good for the security?
> Can we just limit to one session and force people to use more user login?
> Is there any case where we need to loggin in the system with the same
> user at the same time?
>
> --
> Cédric Krier
>
> B2CK sprl
> Rue de Rotterdam, 4
> 4000 Liège
> Belgium
> Tel: +32 472 54 46 59
> Email: [email-masked]
> Website:http://www.b2ck.com/
>
>  application_pgp-signature_part
> 1KHerunterladen

--~--~---------~--~----~------------~-------~--~----~
[email-masked] mailing list
-~----------~----~----~----~------~----~------~--~---

---

From: Hartmut Goebel <[email-masked]>
Date: Fri, 18 Jul 2008 14:36:35 +0200

> What do you think about this?

Useful. :-)

 > Can we just limit to one session and force people to use more user

No, this is quite bad. This will lead to a bunch of Users and passwords 
written on sticky notes :-(

> Is it good for the security?

What are your concerns? The only one I see is: An attacker can try to 
login while the user is already logged in.

> Is there any case where we need to loggin in the system with the same

About the code:
- Why is to_del.append(i) only done if real_session == session?
   Shouldn't it be removed when timeout is over?

Some nit-picking (as you are used o from me ;-)
- Suggestion: use to_del.insert(0, ...) to avoid .reserve()
- Code could become shorter and better to read when using enumerate()
   (available since Python 2.3)

BTW: I propose renaming 'reset_timeout' into 'outdate_timeout'.

-- 
Schönen Gruß - Regards
Hartmut Goebel

Goebel Consult
Spezialist für IT-Sicherheit in komplexen Umgebungen
http://www.goebel-consult.de

---

From: Cédric Krier <[email-masked]>
Date: Fri, 18 Jul 2008 12:12:41 +0200

In the changeset 653, I have change the session management to allow more
than one session per users.
http://www.tryton.org/hgwebdir.cgi/trytond/rev/571b3bd92246

-- 
Cédric Krier

B2CK sprl
Rue de Rotterdam, 4
4000 Liège
Belgium
Tel: +32 472 54 46 59
Email: [email-masked]
Website: http://www.b2ck.com/