I am developing secure login system with php. I want to prevent multiple login for user with same username and password. With my script user can login on account from different browsers or from different IP with same username and password. I need to add some column on my database. When user logged in field becomes 1, and account is locked, when user logged out account is unlocked. But what if user close the browser without logout?
23072
I need to keep a session alive for 30 minutes and then destroy it.
45504
I'm using a PIN code to log on my computer. However, Num ⇩ is always turned off, even if on before shutting down my computer. This is quite annoying as I always have to retype my PIN.  I've tried the suggestions  (same as ). But with no result. If I don't enable num lock on log in screen and use the numbers above the normal keys, num lock turns on after log on. Then it's too late, unfortunately.  So, how can I make num lock enabled by default when logging in? Thanks.  Edit: While I still want to solve this, I've figured it is not such a big problem. I will need to press some key for the "enter PIN screen" to show, and using Num ⇩ works and enables num lock. But then, still annoying if the computer was only locked (with num lock on) and I turn it off, hehe.
39467
I just changed my password, but one time I used my friend's mobile phone to access my account using the add account feature. Sometimes she uses my account to write or read something, and she still accesses my account from her phone.   Can I log myself out of all instances of the account?
77056
I have configured my MySQL Database to require passwords on all users, even root from the machine itself.  Now I discovered that there are empty Users in my Database  Reproduce: mysql -u root -p and then use mysql; &amp; select * from user;  It gives me 2 entries, one with "localhost" and user &lt;empty&gt; and one with the machine's hostname and &lt;empty&gt;.  Now I tried to access the account with mysql -u ' ' (yes it's correct, leave a space between the ' things) and I log in without a password. The user can "only" see information_schema and test, the two databases created by default. He does not has access to mysql or any other custom created databases.  I already changed the Password of this user to something I won't tell you  mysql -u root -p use mysql; UPDATE mysql.user SET Password=PASSWORD('thisisasecretpassword') WHERE USER='root'; FLUSH PRIVILEGES;   Now my Questions:   Is any MySQL Server vulnerable for an attack with this entry? Could an attacker break out of this account or the two default databases? Should I password-protect those Users or can I delete them? Are They required for some MySQL-internal things?
88228
According to the , you can harden a MySQL server by adding passwords, or removing the anonymous accounts.      If you want to prevent clients from connecting as anonymous users   without a password, you should either assign a password to each   anonymous account or else remove the accounts.   Before hardening, my users table looked like this.   mysql&gt; select user,host,password from mysql.user; +------------------+-----------+-------------------------------------------+ | user             | host      | password                                  | +------------------+-----------+-------------------------------------------+ | root             | localhost | *F3A2A51A9B0F2BE246XXXXXXXXXXXXXXXXXXXXXX | | root             | gitlab    |                                           | | root             | 127.0.0.1 |                                           | | root             | ::1       |                                           | |                  | localhost |                                           | |                  | gitlab    |                                           | | debian-sys-maint | localhost | *95C1BF709B26A5BAXXXXXXXXXXXXXXXXXXXXXXXX | | myuser           | localhost | *6C8989366EAF75BB6XXXXXXXXXXXXXXXXXXXXXXX | +------------------+-----------+-------------------------------------------+   I've remove all anonymous accounts, so that the user table now looks like this.  (I'm using puppet to manage the users, but puppet effectively performs a DROP USER command).   mysql&gt; select user,host,password from mysql.user; +------------------+-----------+-------------------------------------------+ | user             | host      | password                                  | +------------------+-----------+-------------------------------------------+ | root             | localhost | *F3A2A51A9B0F2BE246XXXXXXXXXXXXXXXXXXXXXX | | debian-sys-maint | localhost | *95C1BF709B26A5BAXXXXXXXXXXXXXXXXXXXXXXXX | | myuser           | localhost | *6C8989366EAF75BB6XXXXXXXXXXXXXXXXXXXXXXX | +------------------+-----------+-------------------------------------------+   Why is it that I am still able to login to my test system without a username or a password? What do I need to do to prevent any unwanted users from logging in?   root@gitlab:~# mysql Welcome to the MySQL monitor.  Commands end with ; or \g. Your MySQL connection id is 98 Server version: 5.5.32-0ubuntu0.12.04.1 (Ubuntu) .... mysql&gt;    Update:  I've also just discovered that I can login as root, without entering a password.  Update2: I found  which has some good information, but does not solve the issue.   There are no anonymous users.  mysql&gt; select user,host,password from mysql.user where user=''; Empty set (0.00 sec)   I login as root@localhost.  mysql&gt; select USER(),CURRENT_USER(); +----------------+----------------+ | USER()         | CURRENT_USER() | +----------------+----------------+ | root@localhost | root@localhost | +----------------+----------------+    I do not have a default password, or skip-grant-tables defined in my.cnf  root@gitlab:~# cat /etc/mysql/my.cnf |grep -i 'skip-grant-tables'|wc -l 0 root@gitlab:~# cat /etc/mysql/my.cnf |grep -i 'pass'|wc -l 0   Update3:  I have tried performing these steps with puppet, (which should perform a flush privileges automatically). I have also manually flushed privileges and also tried restarting mysql.   Update4: I've also tried changing the mysql root password and flushed privileges. No luck, I can still log in as any user without a password.
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
115983
I want to get user input in one page, store that in a php variable and use it in another php page. I have tried using 'sessions' but it doesn't seem to be working. Is there another safe alternative? This information is likely to be usernames and passwords.
34757
May someone please show me how I would restrict accounts/people logging into an ubuntu 10.04 server by SSH to a single active session at a time for each account that logs into the server.  Regards
82041
If more than one person is logged in on my computer, Ubuntu requires super user authentication when shutting down the computer. How can I make it so that any user can shutdown the computer without being asked for a password?
104127
As a response to the recent  and , what is the best way to secure your website against brute force login attacks?  Jeff's post suggests putting in an increasing delay for each attempted login, and a suggestion in the comments is to add a captcha after the 2nd failed attempt.  Both these seem like good ideas, but how do you know what "attempt number" it is?  You can't rely on a session ID (because an attacker could change it each time) or an IP address (better, but vulnerable to botnets).  Simply logging it against the username could, using the delay method, lock out a legitimate user (or at least make the login process very slow for them).  Thoughts? Suggestions?
89927
We have several user accounts that we create for automated tasks that require fine-grained permissions, such as file transfer across systems, monitoring, etc.   How do we lock down these user accounts so that these "users" have no shell and are not able to login? We want to prevent the possibility that someone can SSH in as one of these user accounts.
75047
My initial problem was that my computer wouldn't let me login to my account. It seems to shut down after I enter my password. I can login as a guest.  I found fixes but I can't remember / figure out my login for access after I hit Ctrl+Alt+F1 and most of the fixes for finding your login username depend on you having access to your account.  I thought the login was the name which appears on the screen when I start the computer normally, but this has not worked, is there another way to find out my username while being effectively locked out of my root-user profile?  I am also assuming that the password is the same one I always use.  Conversely, if the name which appears on the screen at startup and my normal password should have worked, is there another explanation for why I am not able to login on the black command screen.
7305
When I tried to log out by clicking the logout link at the top (first time for me because I don't really log out of S[OFU] unless I clear my browser's session data), I got the following message:     You're a registered user.      You can log in or out at any time   using the OpenID you've already   associated with your account.   And when I clicked on the parts of the site, it seems that I'm still logged in (see, i'm creating this question after I logged out and this question would probably appear in the list of the questions I asked) and my name is still appearing at the top of the page.  Is this by-design or is this a bug?
47419
I've set up my System to log me in automatically but for some reason I need to "unlock my keyring" x times, where x is a number much larger than one. I've read a few similar threads here and elsewhere but I've yet to find a solution to the problem.  How do I stop this from happening?  Seahorse screenshot  Note : The original title described the behaviour as "molestation" which I think is apt.
94845
This afternoon I set up a Win Server 2008 R2 system for use with Team Foundation source code control. In order to give my team-mates the right to connect, I had to create a user account for each person, 10 in total. (I can't, and I don't want to create a domain).  Now, after doing this, all user accounts are displayed in the login screen.  What can I do so that all the accounts are not displayed there?
75626
I understand that Windows can allow multiple different user logins to the same machine at the same time, either via remote desktop program such as Citrix or other means.  My question is that, does Windows allows multiple same user login to the same machine at the same time? Let's say, I have an account with the user name John, and this John gives the account name and password to his niece, and now both of them want to log into the Windows machine at the same time and do different things-- via remote login.   Is this scenario possible?
40701
I am wondering if programs keep running when users switch account, alas account is locked and another user account logs in. For instance, user Mike runs Photos (that will start curating pictures), then locks account and user Sue logs in to other account; will Photos instance keep running in Mike account in the background?