Login System Security Suggestions

Question

I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup:

1. nonce to check if the login originated from our login form
2. session and cookie auth mixed - in a session cookie sha256(username-set-in-a-session,static-cookie-id,user-agent)
3. The php session id is regenerated every request
4. SSL on the whole site
5. Check if they have been active - timeout after 1 hour
6. Password must be 8 characters with at least a number and a letter
7. Password stored with a static and dynamic salt with the hash sha256
8. After 10 failed logins on any account show recaptcha
9. After 10 failed logins on one account disable it for 10 minutes or until email confirm
10. Generic error messages - ex: login failed, please try again
11. SQL injection prevented

Answer 1

The best advice I can give you is to read the definitive guide to forms-based website authentication on StackOverflow. It's pretty much the best answer you'll ever need, and it includes plenty of links to further reading.

Answer 2

You might be duplicating effort and I see weaknesses with your approach to password selection and storage as well as a great way to apply a DoS attack to the admin accounts in your system. You might want to consider using this instead:

http://barebonescms.com/documentation/sso/

That is an enterprise-grade SSO system. It does everything your system does - only better and without the DoS issue.

Polynomial's response is actually pretty good but I doubt it will be the "best answer you'll ever need" - after all, security is a moving target. Today's best answer might be tomorrow's "ZOMG - I can't believe we used to do that!"

Answer 3

session and cookie auth mixed - in a session cookie sha256(username-set-in-a-session,static-cookie-id,user-agent)

With no salt, then that's easily reproducible - how does it help security?

The php session id is regenerated every request

While you should always regenerate a session id on transition between different authentication states, doing it for every request is rather silly. It's not helping security and is likely to break the site in strange ways (e.g. if user splits the session).

After 10 failed logins on one account disable it for 10 minutes or until email confirm

So not bothered about multiple consecutive failed logins from the same IP address / user agent as long as they are for different accounts?

SSL on the whole site

But have you checked you've got the secure and httponly flags on your cookies?