Security vs. Code Efficiency in Sessions

[synergypoint]

I need some advice on best practices for using sessions securely and efficiently.

I am writing an add on of sorts to Plesk, a web server management tool which controls webserver management of ftp logins, mysql databases, email accounts, etc.

I have written my own database management tool and am taking advantage of the user information Plesk stores in MySQL databases on the server to control access to my database manager.

I have set up SSL access to my control panel and verify the login against the password stored in MySQL.

Once the user is logged in I need to access several other sets of usernames and passwords. I need the clients FTP login for uploading files to the server, and their MySQL login for their particular database.

Right now my system creates a new session on a successful login and stores an encrypted hash version of their password in the session. On each new page load I compare that to the database password to validate the user.

Now I am moving on to connecting to their database and ftp server. I can do the same thing for those passwords on each page load or I can just store their password and login info in the session. But at what risk. I have done everything I can to be secure but if someone does steal a session id then they potentially have access to everything about that server. If I validate main login, MySQL login, and FTP login every time a page loads it seems like I am hitting the server a lot.

If I have hundreds of users all doing this at the same time is the extra overhead likely to be more of a problem than the security risk of storing usernames and passwords in the session?

Does anyone have experience or a useful opinion about this?

Any other ideas or better ways to do this?

Thanks.

[drawmack]

or you could just store their userid in a session and use that to look up their account in the database when needed. Don't put someone's password in a session variable.

[buducom]

you said you set up SSL. did you do your own CA
and do the certificate and key or did you go with verisign etc?
if you did your own please contact me.
I want to do that

[drawmack]

you can't do your own CA. Well technically you could but it won't be trusted by browsers and the user will be told that.

[buducom]

but once the user accepts the certificate even if the user knows will it not function as a normal ssl and the certificate gets installed in the browser?

[drawmack]

well yes, but why would someone accept a certificate from an untrusted source? That's kind of like letting Bill from accounting keep your passwords for you.

[LordShryku]

Did you know Bill from accounting is 99% kelp?

[drawmack]

BTW: the bill from accounting is a completely fictional character and in no way represents a real person including the Bill from accounting that he is based on.

[LordShryku]

yarr