<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Dear Vtiger Community,<br>
<br>
I have just realized after the fresh install of vtiger 6.1 (SVN
14165) that the mentioned by Bastiaan security issue (below
highlighted by bold) point 2 is resolved.<br>
<br>
You can use any names for the admin user.<br>
How you can do it?<br>
<br>
After install go the user management, and change the admin user
name into any string more safe then 'admin'.<br>
Important note: after changing the admin user name, please chnage
the admin user password also. <br>
It looks like the password hash uses the username so, if you will
not create a new password for the main admin user in this step,
you will not be able to login next time.<br>
<br>
But using these two steps the main admin user name can be changed
to other string.<br>
<br>
Kindest regards:<br>
Istvan<br>
<br>
<br>
<div class="moz-signature">üdvözlettel:<br>
<br>
<b>Holbok István</b><br>
<br>
+3670-342-0900<br>
<b>e-mail:</b> <a class="moz-txt-link-abbreviated" href="mailto:holbok@gmail.com">holbok@gmail.com</a><br>
<b>SkyPe:</b> holboki<br>
<br>
</div>
2014.07.01. 9:43 keltezéssel, Zebra Hosting írta:<br>
</div>
<blockquote cite="mid:CFD8309D.24049%25support@zebrahosting.eu"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div>Since the CRM is used to store a lot of personal data, I was
wondering how secure vTiger is and if there are any extra
options we could discuss.</div>
<div><br>
</div>
<div>Let me start with a few points:</div>
<div>1. At the login I don’t see something simple as brute force
protection.</div>
<div><b>2. The standard admin user cannot be changed, it needs
another account and then needs to be deleted. Using standard
admin usernames is bad practice.</b></div>
<div>3. Having the vTiger name and even the version number at the
login screen makes it very easy for hackers . </div>
<div>4. It would be nice to have a black/whitelist to restrict
access by IP. (yes I know htaccess could be used but I talking
about average users)</div>
<div>5. Use the <a moz-do-not-send="true"
href="http://www.projecthoneypot.org/" style="font-size:
medium; font-family: Arial;">http://www.projecthoneypot.org/</a> project
to ban access at the gate for spammers. (Works so very well in
Joomla, I don’t need to use captcha’s anymore )</div>
<div>6. Big warning in the installer to use <a class="moz-txt-link-freetext" href="https://">https://</a> to encrypt
the loginscreen pw.</div>
<div>7. Minimum password length/complexity</div>
<div><br>
</div>
<div>Just some thoughts.</div>
<div><br>
</div>
<div>Bastiaan Houtkooper</div>
<div>Zebra Hosting</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<!--?xml version="1.0" encoding="UTF-8" standalone="no"?-->
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
<a class="moz-txt-link-freetext" href="http://www.vtiger.com/">http://www.vtiger.com/</a></pre>
</blockquote>
<br>
</body>
</html>