Disable password expire feature in 90 days :- Help

Can any one tell me how to disable password expire feature in 90 days? I know its a security flaw or PCI non-compliant but I do really wanna do this. Any help please?

BACKUP YOUR DATABASE FIRST!!!

If you need to be PCI compliant, they you probably don't want to do this. But if you're useing ZC in a testing environment, then there's no reason that you can't use the same password over and over again.

I haven't found the trick to disabling the forced password reset alltoghther, but there is a work around using phpmyadmin to change the password back to what it was. Change your password when it asks you to, then In phpmyadmin, under the admin table, edit your user name, and blank out the prev_pass1, prev_pass2 and prev_pass3.

Then change your password back to what it was.

Kind of a pain, but at least it works.

I was snooping around and stumbled across admin_access.php in /public_html/admin/includes/functions .
Look at line 433. Then look at the end of line 442. There's the 90 day setting. I'm going to set this to... 200000. That's 500+ years.

Keep in mind, if this does fix the password expiration after 90 days, and you need to be PCI compliant, DON'T CHANGE THIS SETTING!
I'm only changing it on a demo ZC install.

I'll update everybody in 3 months and let you know if it worked.

canemasters:

I'll update everybody in 3 months and let you know if it worked.

did it work?

It does work, only what I ended up doing was just commenting out the entire process that performs the check in admin_access.php:

/**

• Check whether the specified admin user's password expired more than 90 days ago
• THIS IS A PA-DSS REQUIREMENT AND MUST NOT BE CHANGED
• @param string $adminID
  */ <--- Move this
  function zen_check_for_expired_pwd ($adminID) {
  global $db;
  $sql = "SELECT admin_id FROM " . TABLE_ADMIN . "
  WHERE admin_id = :adminID:
  AND pwd_last_change_date < DATE_SUB(CURDATE(),INTERVAL 90 DAY)";
  $sql = $db->bindVars($sql, ':adminID:', $adminID, 'integer');
  $result = $db->Execute($sql);
  $retVal = $result->RecordCount();
  return $retVal;
  }
  */ <--- To here

canemasters:

It does work, only what I ended up doing was just commenting out the entire process that performs the check in admin_access.php:

/**

• Check whether the specified admin user's password expired more than 90 days ago
• THIS IS A PA-DSS REQUIREMENT AND MUST NOT BE CHANGED
• @param string $adminID
  */ <--- Move this
  function zen_check_for_expired_pwd ($adminID) {
  global $db;
  $sql = "SELECT admin_id FROM " . TABLE_ADMIN . "
  WHERE admin_id = :adminID:
  AND pwd_last_change_date < DATE_SUB(CURDATE(),INTERVAL 90 DAY)";
  $sql = $db->bindVars($sql, ':adminID:', $adminID, 'integer');
  $result = $db->Execute($sql);
  $retVal = $result->RecordCount();
  return $retVal;
  }
  */ <--- To here

You are no doubt aware that you have just relinquished one of the major security features of your store?

Yes, I'm fully aware of what doing that does, but like I mentioned in the above post, if you're only running a developement test site with no sales, there shouldn't be any reason that this would hurt anything.

If you're running a live site, you absuolutely shout NOT do this to your site.

Not sure I understand PCI compliance issues. If we are not actually processing credit cards, but using Authorize.net to process them on their site, is it okay to change it?

You need to get that answer from authorize.net.

It will probably be "no".

aperfecthost:

Not sure I understand PCI compliance issues. If we are not actually processing credit cards, but using Authorize.net to process them on their site, is it okay to change it?

http://www.pcicomplianceguide.org/pcifaqs.php
Q: What is PCI?
**A: **The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that **process, store **or **transmit **credit card information maintain a secure environment. Essentially any merchant that has a Merchant ID (MID).

If this doesn't apply then you have no need for compliance. HOWEVER, the PCI requirements themselves are little more than a set of good security practices, which are always good to follow regardless of whether they are required or not.

Personally, I often feel that a mandatory change of passwords every 'x' number of days can often lead to a weakness in security because they'll often cause the the use of weak passwords (to help people remember them), and even writing the more complex passwords down on a sticky note attached to the monitor, which makes me a little at odds with strict PCI compliance when not essential for legal purposes.

Cheers
RodG
adv dip network security

RodG:

Personally, I often feel that a mandatory change of passwords every 'x' number of days can often lead to a weakness in security because they'll often cause the the use of weak passwords (to help people remember them), and even writing the more complex passwords down on a sticky note attached to the monitor, which makes me a little at odds with strict PCI compliance when not essential for legal purposes.

I agree.

Before I retired I would visit many small companies each year to train operators in software, and the number of times I would see passwords taped to monitors or inside desk drawers was laughable.:shocking:

Then one day, someone hacks your site because **secure **passwords were such an inconvenience. If there was a permanent note and a count down of days **ON **the admin screen it would prepare those using the site regularly that the **change **is coming, and necessary.

You'd be surprised what simple suggestive messages can do to guide people...

rodg:

http://www.pcicomplianceguide.org/pcifaqs.php
q: What is pci?
**a: **the payment card industry data security standard (pci dss) is a set of requirements designed to ensure that all companies that **process, store **or **transmit **credit card information maintain a secure environment. Essentially any merchant that has a merchant id (mid).

If this doesn't apply then you have no need for compliance. However, the pci requirements themselves are little more than a set of good security practices, which are always good to follow regardless of whether they are required or not.

Personally, i often feel that a mandatory change of passwords every 'x' number of days can often lead to a weakness in security because they'll often cause the the use of weak passwords (to help people remember them), and even writing the more complex passwords down on a sticky note attached to the monitor, which makes me a little at odds with strict pci compliance when not essential for legal purposes.

Cheers
rodg
adv dip network security

thank you!

pewe:

I agree.

Before I retired I would visit many small companies each year to train operators in software, and the number of times I would see passwords taped to monitors or inside desk drawers was laughable.:shocking:
Yep.. my fav were those users who would "hide" their password post it's in their desk drawers.. (cause NOONE will look there!) :laugh:

DivaVocals:

Yep.. my fav were those users who would "hide" their password post it's in their desk drawers.. (cause NOONE will look there!) :laugh:
The most amusing I came across was the girl who wrote down her password backwards (supposedly to confuse would be abusers) - but then made a note on another post it to say 'remember the password is back to front'. :blink::laugh:

using authorize.net IS processing credit cards.. not sure where you got the idea that this wasn't the case..

That's awesome..

DivaVocals:

using authorize.net IS processing credit cards.. not sure where you got the idea that this wasn't the case..

It is processing of course. The information however isn't stored or kept on our website. It's all done on Authorize.net's website.

aperfecthost:

It is processing of course. The information however isn't stored or kept on our website. It's all done on Authorize.net's website.
Let me clarify.. if you are using a credit card processing gateway (which Authorize.net is) you will need to be PCI compliant..your site transmits data to the payment gateway.. therefore you must be PCI compliant..

DivaVocals:

Let me clarify.. if you are using a credit card processing gateway (which Authorize.net is) you will need to be PCI compliant..your site transmits data to the payment gateway.. therefore you must be PCI compliant..

PayPal is also a credit card processing Gateway, but since the CC details are never processed by the store itself (using IPN or Express checkout) then PCI compliance is NOT required for the store itself.

I've never used Authorize.net, but if "It's all done on Authorize.net's website." as stated by aperfecthost, then PCI compliance is not required for the store here either.

Cheers
RodG