Bug 9885 - Passwords generated by command line scripts are weak
Summary: Passwords generated by command line scripts are weak
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Command-line Utilities (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Peter Kelly
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-03-21 09:21 UTC by Peter Kelly
Modified: 2013-12-05 20:05 UTC (History)
5 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Patch to address issues as proposed (2.03 KB, patch)
2013-03-21 09:55 UTC, Peter Kelly
Details | Diff | Splinter Review
Bug 9885 [SIGNED-OFF] Passwords generated by command line scripts are weak (2.22 KB, patch)
2013-03-21 11:20 UTC, Magnus Enger
Details | Diff | Splinter Review
Bug 9885 Passwords generated by command line scripts are weak (2.28 KB, patch)
2013-03-31 00:41 UTC, Robin Sheat
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Kelly 2013-03-21 09:21:34 UTC
The command line scripts koha-reset-passwd and koha-create in debian/scripts generate fairly weak passwords.

Staff passwords are generated as an eight-character "readable" pwgen password, as is the mysql password.  The Zebra password is generated as a 12 character readable password.

The eight character passwords are fairly vulnerable - see the discussion at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=276976 or the somewhat more dry discussion at http://ix.cs.uoregon.edu/~butler/pubs/password.pdf 

Do these passwords really need to be THAT friendly?

I would suggest:
- changing the zebra password and mysql passwords to 16 character "secure" passwords, ie generated with pwgen -s 16 1
- changing the patron password to a 12 character not-secure password.

I'm happy to write the patch for these two files if there is consensus that it should be actioned.

I have checked gitk and while I read the current debian koha-common version of the scripts (package 3.11-1~git+20130321124944.90dfa923), this does not appear to have changed in the master version.
Comment 1 Robin Sheat 2013-03-21 09:30:03 UTC
Yes to all of these. The zebra password is never used by a person, although it is not required to be too secure, there's also no reason not to. The mysql password is used by the admin to create the staff users (assuming a default SQL file is not provided), but in those cases it's probably looked up every time anyway. The default staff user password would be good as a 12-char non-secure, although it probably gets changed anyway.
Comment 2 Magnus Enger 2013-03-21 09:30:47 UTC
I agree that the MySQL should be more secure. I *always* copy and paste it anyway, so the length does not really matter.
Comment 3 Peter Kelly 2013-03-21 09:55:26 UTC Comment hidden (obsolete)
Comment 4 Robin Sheat 2013-03-21 10:20:45 UTC
Just a note that as Peter works at Catalyst, I can't sign off on this. However it's a very simple patch that could be passed easily. It also affects only the packages, so while I'd like a signoff (for completeness) I'd let it past QA.
Comment 5 Magnus Enger 2013-03-21 11:02:47 UTC
I'd call weak passwords a bug... (Which means the patch will be eligible for inclusion in 3.12 :-).
Comment 6 Magnus Enger 2013-03-21 11:20:58 UTC Comment hidden (obsolete)
Comment 7 Robin Sheat 2013-03-31 00:41:48 UTC
Created attachment 17069 [details] [review]
Bug 9885 Passwords generated by command line scripts are weak

This changes the scripts so that:
- in koha-create, the zebra password and mysql passwords are set to 16 character "secure" passwords, ie generated with pwgen -s 16 1
- the patron password is set to a 12 character "memorable" password.

Signed-off-by: Magnus Enger <magnus@enger.priv.no>
Looks good. I did not actually build, install and test new packages,
but i did test pwgen with the new arguments and the changes make
sense.

Signed-off-by: Robin Sheat <robin@catalyst.net.nz>
QA signoff
Comment 8 Robin Sheat 2013-03-31 00:42:30 UTC
Did a build and koha-create and noted that the new passwords are indeed better.
Comment 9 Jared Camins-Esakov 2013-03-31 01:40:12 UTC
This patch has been pushed to master.
Comment 10 Chris Cormack 2013-03-31 06:01:55 UTC
Pushed to 3.8.x and 3.10.x will be in 3.8.12 and 3.10.5
Comment 11 Magnus Enger 2013-04-18 20:27:07 UTC
Works nicely on official squeeze-dev packages.