The command line scripts koha-reset-passwd and koha-create in debian/scripts generate fairly weak passwords. Staff passwords are generated as an eight-character "readable" pwgen password, as is the mysql password. The Zebra password is generated as a 12 character readable password. The eight character passwords are fairly vulnerable - see the discussion at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=276976 or the somewhat more dry discussion at http://ix.cs.uoregon.edu/~butler/pubs/password.pdf Do these passwords really need to be THAT friendly? I would suggest: - changing the zebra password and mysql passwords to 16 character "secure" passwords, ie generated with pwgen -s 16 1 - changing the patron password to a 12 character not-secure password. I'm happy to write the patch for these two files if there is consensus that it should be actioned. I have checked gitk and while I read the current debian koha-common version of the scripts (package 3.11-1~git+20130321124944.90dfa923), this does not appear to have changed in the master version.
Yes to all of these. The zebra password is never used by a person, although it is not required to be too secure, there's also no reason not to. The mysql password is used by the admin to create the staff users (assuming a default SQL file is not provided), but in those cases it's probably looked up every time anyway. The default staff user password would be good as a 12-char non-secure, although it probably gets changed anyway.
I agree that the MySQL should be more secure. I *always* copy and paste it anyway, so the length does not really matter.
Created attachment 16591 [details] [review] Patch to address issues as proposed
Just a note that as Peter works at Catalyst, I can't sign off on this. However it's a very simple patch that could be passed easily. It also affects only the packages, so while I'd like a signoff (for completeness) I'd let it past QA.
I'd call weak passwords a bug... (Which means the patch will be eligible for inclusion in 3.12 :-).
Created attachment 16604 [details] [review] Bug 9885 [SIGNED-OFF] Passwords generated by command line scripts are weak This changes the scripts so that: - in koha-create, the zebra password and mysql passwords are set to 16 character "secure" passwords, ie generated with pwgen -s 16 1 - the patron password is set to a 12 character "memorable" password. Signed-off-by: Magnus Enger <magnus@enger.priv.no> Looks good. I did not actually build, install and test new packages, but i did test pwgen with the new arguments and the changes make sense.
Created attachment 17069 [details] [review] Bug 9885 Passwords generated by command line scripts are weak This changes the scripts so that: - in koha-create, the zebra password and mysql passwords are set to 16 character "secure" passwords, ie generated with pwgen -s 16 1 - the patron password is set to a 12 character "memorable" password. Signed-off-by: Magnus Enger <magnus@enger.priv.no> Looks good. I did not actually build, install and test new packages, but i did test pwgen with the new arguments and the changes make sense. Signed-off-by: Robin Sheat <robin@catalyst.net.nz> QA signoff
Did a build and koha-create and noted that the new passwords are indeed better.
This patch has been pushed to master.
Pushed to 3.8.x and 3.10.x will be in 3.8.12 and 3.10.5
Works nicely on official squeeze-dev packages.