Comments (7)
You ask a very complex question and start with "Not a big question".
In modern authentication schemes, passwords are not transmitted to the server, the client usually sends a "proof" that it knows the password, but not the password itself. the server should have its own means to authenticate the proof sent by the client. in most modern implementations, the server itself does not have direct access to the password.
this is a huge topic that is outside the scope of the "issues" section of the library.
from smblibrary.
I plan to implement it through a database, so your built-in class of blocking requests will not help.
This sentence is likely to be incorrect, IndependentNTLMAuthenticationProvider can be used with a database.
from smblibrary.
I realize that from a security standpoint this is not the best way, however it is the most effective way to see if there are some not-so-good people trying to pick up the password and login to the server.
So far, at the moment the server is running an FTP server via the pyftpdlib library and the logging of authorization goes into a database. So: as soon as I bought a public IP, immediately some bot appeared, which every 5 seconds for several hours picking up passwords and logins (I can send a screenshot, but I think you already assume what it is).
If you still don't agree to make the password available, please suggest alternative ways to check such people.
from smblibrary.
This sentence is likely to be incorrect, IndependentNTLMAuthenticationProvider can be used with a database.
When I looked at your library code, I found a flood protection in it. This is what I call "protection", although it is only protection against too many requests.
from smblibrary.
If you still don't agree to make the password available, please suggest alternative ways to check such people.
I'm repeating again that passwords are not transmitted to the server, the library cannot provide what it does not have.
To limit a user from too many unsuccessfully login attempts you simply have to know the username and that the login attempt was unsuccessful. the library supports that as you can provide your own authentication mechanism (or use a proxy design pattern). (and you definitely do not need the password)
Please understand that I'm a volunteer with very little time, please do your homework and refrain from wasting my time.
from smblibrary.
I think I understand what you are trying to say.
The password is transmitted in encoded form (bytes) and, as I understand, it is impossible to decode it.
Am I understanding you correctly?
from smblibrary.
Your phrasing is a bit odd, but essentially yes. if you wish to understand it better I suggest you read up on cryptography and modern authentication schemes.
from smblibrary.
Related Issues (20)
- Can't access most QueryDirectoryFileInformation attributes HOT 2
- Connecting to Subshare throws STATUS_BAD_NETWORK_NAME HOT 1
- What is NTStatus 3221225680? HOT 1
- Issue with Creating Nested Folders and Files Using SMBLibrary in AWS Lambda HOT 2
- The server is returning STATUS_SHARING_VIOLATION while creating a handle to delete a folder. HOT 1
- SMB 3.1.1 Support HOT 1
- How do I hide a shared folder? HOT 1
- System.Net.Sockets.SocketException: Connection reset by peer HOT 5
- Not enough credits due to connection resilience issues HOT 4
- Authntication Failed HOT 5
- High RAM consumption. HOT 10
- Is it possible to get a login and NTLM? HOT 4
- Making ClientMaxReadSize and ClientMaxWriteSize Configurable HOT 1
- The new Connect method in the 1.5.0.2 version HOT 1
- ACCESS_DENIED_ACE type is missing HOT 1
- Login without user and password HOT 1
- Bug after latest ArrayPool implementation HOT 4
- Issue not receiving ReadResponse when reading a file HOT 16
- Renaming File to one Character HOT 1
- Async exception on sync operation HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from smblibrary.