Encrypted php session files

[jaytraxx]

Hi there,

I found a problem in phpgwapi/inc/class_sessions_php4.inc.php:

In list_sessions() the raw php session files are read to find out which other users are online/offline. This works on my server with php4 (the file looks like "mytest|s:6:“mytest”; => serialized).
But with php5, the session files are somehow encrypted (the file looks like “SDFSK…443.d99”), so list_sessions() has to decrypt the file before unserializing …

I played around with PHPs session_decode() but this function is only used to unserialize a raw php file, not to decrypt it. Has anyone got an idea how to decrypt those files and make list_sessions useable again? The problem is that e.g. notifications-app will not work without this function (I could swith to db-based sessions but I think php-based sessions should work too).

Thanx
Christian

[jaytraxx]

Found a solution and I think I should make a reply for all those who have the same problem, cause notifications will not work if the session class cannot read from the session files.

There’s a ‘hardened-php’ Project, named suhosin which is installed in Mandriva’s (and maybe other distributors) php by default. The module suhosin.so makes php more secure, but this is atm a problem for eGWs session-handler.

So, just disable suhosin’s php session encryption with sushosin.session.encrypt=Off in the corresponding php config file (php.ini or php.d/*)

Hi there,

I found a problem in phpgwapi/inc/class_sessions_php4.inc.php:

In list_sessions() the raw php session files are read to find out which other users are online/offline. This works on my server with php4 (the file looks like "mytest|s:6:“mytest”; => serialized).
But with php5, the session files are somehow encrypted (the file looks like “SDFSK…443.d99”), so list_sessions() has to decrypt the file before unserializing …

I played around with PHPs session_decode() but this function is only used to unserialize a raw php file, not to decrypt it. Has anyone got an idea how to decrypt those files and make list_sessions useable again? The problem is that e.g. notifications-app will not work without this function (I could swith to db-based sessions but I think php-based sessions should work too).

Thanx
Christian

[Frank-D]

Hi Christian,

if I use phpinfo to see if sushosin is running, it should be listed somewhere, if it’s is active, should it not?
Some time ago, I had a session problem to, so we had to switch to DB-sessioin management and we could not identify the cause for the problem up to know.

All the best Frank

Found a solution and I think I should make a reply for all those who have the same problem, cause notifications will not work if the session class cannot read from the session files.

There’s a ‘hardened-php’ Project, named suhosin which is installed in Mandriva’s (and maybe other distributors) php by default. The module suhosin.so makes php more secure, but this is atm a problem for eGWs session-handler.

So, just disable suhosin’s php session encryption with sushosin.session.encrypt=Off in the corresponding php config file (php.ini or php.d/*)

Hi there,

I found a problem in phpgwapi/inc/class_sessions_php4.inc.php:

In list_sessions() the raw php session files are read to find out which other users are online/offline. This works on my server with php4 (the file looks like "mytest|s:6:“mytest”; => serialized).
But with php5, the session files are somehow encrypted (the file looks like “SDFSK…443.d99”), so list_sessions() has to decrypt the file before unserializing …

I played around with PHPs session_decode() but this function is only used to unserialize a raw php file, not to decrypt it. Has anyone got an idea how to decrypt those files and make list_sessions useable again? The problem is that e.g. notifications-app will not work without this function (I could swith to db-based sessions but I think php-based sessions should work too).

Thanx
Christian

[jaytraxx]

Hi Frank,

Frank-D schrieb:

Hi Christian,

if I use phpinfo to see if sushosin is running, it should be listed
somewhere, if it’s is active, should it not?

For me, the simpliest way would be to look at the php.d/ dir to see if
there’s a file suhosin.ini. Normally, in that file the params get set
and the module gets loaded.

I simply moved the suhosin.ini elsewhere and restarted the apache.

Some time ago, I had a session problem to, so we had to switch to
DB-sessioin management and we could not identify the cause for the problem
up to know.

The same story like mine (hopefully)

All the best Frank

Bye
Christian

jaytraxx wrote:

Found a solution and I think I should make a reply for all those who have
the same problem, cause notifications will not work if the session class
cannot read from the session files.

There’s a ‘hardened-php’ Project, named suhosin which is installed in
Mandriva’s (and maybe other distributors) php by default. The module
suhosin.so makes php more secure, but this is atm a problem for eGWs
session-handler.

So, just disable suhosin’s php session encryption with
sushosin.session.encrypt=Off in the corresponding php config file (php.ini
or php.d/*)

jaytraxx wrote:

Hi there,

I found a problem in phpgwapi/inc/class_sessions_php4.inc.php:

In list_sessions() the raw php session files are read to find out which
other users are online/offline. This works on my server with php4 (the
file looks like "mytest|s:6:“mytest”; => serialized).
But with php5, the session files are somehow encrypted (the file looks
like “SDFSK…443.d99”), so list_sessions() has to decrypt the file before
unserializing …

I played around with PHPs session_decode() but this function is only used
to unserialize a raw php file, not to decrypt it. Has anyone got an idea
how to decrypt those files and make list_sessions useable again? The
problem is that e.g. notifications-app will not work without this
function (I could swith to db-based sessions but I think php-based
sessions should work too).

Thanx
Christian

---

Check out the new SourceForge.net Marketplace.
It’s the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace

---

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

[Frank-D]

Hi Christian,

it always takes some time, because I have no root access to this server, have to ask my admin.

We have no sushosin.ini this path. So perhaps in our installation it’s due to some other reason.

Thanks Frank

Hi Frank,

Frank-D schrieb:

Hi Christian,

if I use phpinfo to see if sushosin is running, it should be listed
somewhere, if it’s is active, should it not?

For me, the simpliest way would be to look at the php.d/ dir to see if
there’s a file suhosin.ini. Normally, in that file the params get set
and the module gets loaded.

I simply moved the suhosin.ini elsewhere and restarted the apache.

Some time ago, I had a session problem to, so we had to switch to
DB-sessioin management and we could not identify the cause for the problem
up to know.

The same story like mine (hopefully)

All the best Frank

Bye
Christian

jaytraxx wrote:

Found a solution and I think I should make a reply for all those who have
the same problem, cause notifications will not work if the session class
cannot read from the session files.

There’s a ‘hardened-php’ Project, named suhosin which is installed in
Mandriva’s (and maybe other distributors) php by default. The module
suhosin.so makes php more secure, but this is atm a problem for eGWs
session-handler.

So, just disable suhosin’s php session encryption with
sushosin.session.encrypt=Off in the corresponding php config file (php.ini
or php.d/*)

jaytraxx wrote:

Hi there,

I found a problem in phpgwapi/inc/class_sessions_php4.inc.php:

In list_sessions() the raw php session files are read to find out which
other users are online/offline. This works on my server with php4 (the
file looks like "mytest|s:6:“mytest”; => serialized).
But with php5, the session files are somehow encrypted (the file looks
like “SDFSK…443.d99”), so list_sessions() has to decrypt the file before
unserializing …

I played around with PHPs session_decode() but this function is only used
to unserialize a raw php file, not to decrypt it. Has anyone got an idea
how to decrypt those files and make list_sessions useable again? The
problem is that e.g. notifications-app will not work without this
function (I could swith to db-based sessions but I think php-based
sessions should work too).

Thanx
Christian

---

Check out the new SourceForge.net Marketplace.
It’s the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace

---

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers