Secure Login in Drupal

Question

I'm designing a sensitive site and I want that login/passwd is not sent as plain text. I don't want to provide https connection or maintain a SSL certificate as it can easily be compromised on shared hosting.

For non-admin users login using openid will solve this issue but how do I do it for Admin(uid=1) ?

For admin login one way is to use a secured VPN of another country to login and once session cookie is placed I can close VPN and use my normal internet connection.

Any ideas?

Although this question isn't version specific but I need it for D6 site.

Answer 1

If you're already using OpenID, then that should work, but if you dont want to add yet another module and you have access to a server over ssh, you can temporarily route all traffic in a tunnel through the server, which will effectively secure all internet traffic, and allow you to connect to the site and send the password "in the clear" as it were over HTTP, but the SSH tunnel would encrypt it before it left your machine.

If you happen to be on a mac, i highly recommend using Sidestep.app to facilitate quickly connecting/disconnecting from the tunnel.

http://chetansurpur.com/projects/sidestep/

For this to really work for you and not be a complete annoyance, I repeat, you need to have SSH access to a server already set up, ideally, with public key access configured.

Answer 2

• I think the idea of VPN is bit complicated, as at times i have faced few issues like slow connections and server down problems. While having a go at my latest project i found Secure Login this module.
• I can assure you the security as this never passes the passwd in a plain text format. The MD5 encryption can add a great integrity to your site. Even if this does work for you, you can make use of http://www.cisco.com/en/US/products/sw/secursw/ps2308/index.html.