Announcement

Collapse
No announcement yet.

Getting ready to upgrade

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Getting ready to upgrade

    Okay so questions.

    I bought the upgrade and have been messing around with a clean install but I need to migrate my board. Do I loose my mods on the clean install and have to start again?

    How do I go about setting the password system to legacy meaning 4.25? I use a custom mysql auth apache mod that is set for 4.25.

  • #2
    You would lose all vBulletin 4.2.X customizations on upgrade. The code and database structure of vBulletin 5 is completely different.

    Not sure why you would want to set the password security to Legacy. The vBulletin 4.X password storage scheme provides the bare minimum of password security. The schemes in vBulletin 5, are a lot stronger and secure. When you upgrade the password storage of all users will be set to "Legacy" automatically. This will allow them to log in the first time. Once they log in, the password will be stored in either bcrypt or argon2id formats. Which one depends on your server configuration. argon2id is considered one of the most secure password storage schemes there is.

    I don't know what this is but if it involves custom code within vBulletin, then you will need to update and integrate that code into vBulletin 5's class system. However, I don't think the database classes are extendible since they are outside the API.
    Translations provided by Google.

    Wayne Luke
    The Rabid Badger - a vBulletin Cloud demonstration site.
    vBulletin 5 API

    Comment


    • #3
      Hi Wayne

      Got it on the style and mods.

      The next issue is a bit different. We have a legacy site that uses Apache basic auth which relies on the vb user table , username, salt, password. We are getting ready to go to bcrypt but that is a ways off. I read before purchasing 5 that legacy auth was still available but it was unclear how to set it.

      Cheers,
      Peter

      Comment


      • #4
        You can set it as the dominant scheme in the /core/includes/xml/pwschemes_vbulletin.xml file. Simply give it a higher priority than other schemes in the file.
        Translations provided by Google.

        Wayne Luke
        The Rabid Badger - a vBulletin Cloud demonstration site.
        vBulletin 5 API

        Comment


        • #5
          You rock!

          Comment


          • #6
            Do I just put the number order or do I need to reorder the list?

            Comment


            • #7
              You would have to change the priority in the file. The order of the rows doesn't matter. When the upgrade script is run, it will build the pwschemes datastore and the system should sort by priority.
              Translations provided by Google.

              Wayne Luke
              The Rabid Badger - a vBulletin Cloud demonstration site.
              vBulletin 5 API

              Comment


              • #8
                Thanks

                Comment


                • #9
                  Sorry I have to open this questions again. We have vb5 up and running and are happy with the upgrade. Now though I have to deal with integrating our legacy site with the new database.

                  With vb4 we built a custom msqlauth mod for Apache that uses vb password hashing. It still works great but no we need to connect to the new database.

                  I had a look at the new db and there is no user table but I did find ppgc_users. Comparing the passwords from the vb4 db and this they are not the same. Is there another table with the username, password, salt is stored? We did use legacy passwords when we installed and upgraded.

                  AuthName "Portal"
                  AuthType Basic
                  AuthBasicProvider mysql
                  AuthMySQLHost localhost
                  AuthMySQLPort 3306
                  AuthMySQLDB vb_fourm
                  AuthMySQLUser super
                  AuthMySQLPassword ##############
                  AuthMySQLUserTable user
                  AuthMySQLNameField username
                  AuthMySQLPasswordField password
                  AuthMySQLSaltField salt
                  AuthMySQLPwEncryption vb
                  #AuthMySQLGroupField membergroupids
                  AuthMySQLGroupField usergroupid
                  AuthMySQLEnable On
                  #require valid-user
                  require group 6 7 47 49 50

                  Comment


                  • #10
                    vB4 and vB5 use entirely different password schemes.

                    vB5 uses some form of Argon2 if I recall correctly.

                    You might take a look at the passwordhistory table and see if it contains the data for which you are looking.

                    Comment


                    • #11
                      We don't store passwords in vBulletin 5. We store token representations of the password in vBulletin 5. The token field will generally contain more information than a simple password hash. The information it holds varies based on the password scheme used. Again, I have to recommend against using the Legacy password format that is compatible with vBulletin 4.X. Password storage has come a long way in the last decade and I recommend using the lastest schemes available in vBulletin 5.
                      Translations provided by Google.

                      Wayne Luke
                      The Rabid Badger - a vBulletin Cloud demonstration site.
                      vBulletin 5 API

                      Comment


                      • #12
                        Originally posted by In Omnibus View Post
                        vB4 and vB5 use entirely different password schemes.

                        vB5 uses some form of Argon2 if I recall correctly.

                        You might take a look at the passwordhistory table and see if it contains the data for which you are looking.
                        Yeah definitely not that table

                        Before we upgraded Wayne gave me instructions on how to use Legacy which should have maintained the hash and previous login info.

                        Comment


                        • #13
                          Originally posted by Wayne Luke View Post
                          We don't store passwords in vBulletin 5. We store token representations of the password in vBulletin 5. The token field will generally contain more information than a simple password hash. The information it holds varies based on the password scheme used. Again, I have to recommend against using the Legacy password format that is compatible with vBulletin 4.X. Password storage has come a long way in the last decade and I recommend using the lastest schemes available in vBulletin 5.
                          Yes I fully understand your points. But I simply can't lock my users out. I need to find a way to connect the legacy site with the new vb db. What table contains the legacy data?

                          Comment


                          • #14
                            There is no table that contains the legacy data. Their legacy passwords would have been updated to use the token system and the storage would have been updated as well. After they log in, the system will automatically update the token storage to the password scheme with the highest priority. We're using off the shelf password schemes built into PHP. You should be able to access these in your legacy site using the same algorithms.
                            Translations provided by Google.

                            Wayne Luke
                            The Rabid Badger - a vBulletin Cloud demonstration site.
                            vBulletin 5 API

                            Comment

                            Related Topics

                            Collapse

                            Working...
                            X