Subj : Passwords in node#.log
To   : All
From : Jay Harris
Date : Mon Jun 15 2020 02:25 pm

Hi All,

I've never really gone through the logs very much, only if there was a
problem that needed sorting out.  Today happened to be one of those days,
while combing through node1.log I noticed something interesting:

------------------- Node 1 (Mystic v1.12 A45 2020/02/18)
2020.06.15 14:16:29 Connect from 10.0.1.49 (E7470-9NJCV)
2020.06.15 14:16:29 Connection by RLogin
2020.06.15 14:16:29 RLogin user warpslide pass *my password!* term ANSI-BBS
2020.06.15 14:16:29 Set time left 4 TE=860
2020.06.15 14:16:29 MPL execute: c:\mystic\themes\default\scripts\botcheck.mpx
2020.06.15 14:16:31 Warpslide logged in

I use RLogin to log into my board, mostly because it's quick, easy &
supports door games.  It seems that RLogin users have their password written
to the logfile whereas Telnet & SSH users do not:

------------------- Node 1 (Mystic v1.12 A45 2020/02/18)
2020.06.15 14:15:08 Connect from 10.0.1.49 (E7470-9NJCV)
2020.06.15 14:15:08 Connection by SSH
2020.06.15 14:15:08 SSH handshake successful
2020.06.15 14:15:08 Set time left 4 TE=859
2020.06.15 14:15:08 MPL execute: c:\mystic\themes\default\scripts\botcheck.mpx
2020.06.15 14:15:11 Warpslide logged in

------------------- Node 1 (Mystic v1.12 A45 2020/02/18)
2020.06.15 14:15:28 Connect from 10.0.1.49 (E7470-9NJCV)
2020.06.15 14:15:28 Connection by Telnet
2020.06.15 14:15:28 Set time left 4 TE=859
2020.06.15 14:15:28 MPL execute: c:\mystic\themes\default\scripts\botcheck.mpx
2020.06.15 14:15:35 Warpslide logged in


Is there a setting somewhere I can turn logging passwords off?  I do have the
PBKDF2 SHA512 Hash option set, but these logs kind of defeat that purpose.

Jay

--- Mystic BBS v1.12 A45 2020/02/18 (Windows/32)
 * Origin: Northern Realms BBS | bbs.nrbbs.net | Binbrook, ON (1:229/664)

.