Bug 9885

Summary:	Passwords generated by command line scripts are weak
Product:	Koha	Reporter:	Peter Kelly <peterAtKohaBugzilla>
Component:	Command-line Utilities	Assignee:	Peter Kelly <peterAtKohaBugzilla>
Status:	CLOSED FIXED	QA Contact:
Severity:	normal
Priority:	P5 - low	CC:	chris, magnus, peterAtKohaBugzilla, robin
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	Sponsored	Patch complexity:	Trivial patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	Patch to address issues as proposed Bug 9885 [SIGNED-OFF] Passwords generated by command line scripts are weak Bug 9885 Passwords generated by command line scripts are weak

Description Peter Kelly 2013-03-21 09:21:34 UTC

The command line scripts koha-reset-passwd and koha-create in debian/scripts generate fairly weak passwords.

Staff passwords are generated as an eight-character "readable" pwgen password, as is the mysql password.  The Zebra password is generated as a 12 character readable password.

The eight character passwords are fairly vulnerable - see the discussion at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=276976 or the somewhat more dry discussion at http://ix.cs.uoregon.edu/~butler/pubs/password.pdf 

Do these passwords really need to be THAT friendly?

I would suggest:
- changing the zebra password and mysql passwords to 16 character "secure" passwords, ie generated with pwgen -s 16 1
- changing the patron password to a 12 character not-secure password.

I'm happy to write the patch for these two files if there is consensus that it should be actioned.

I have checked gitk and while I read the current debian koha-common version of the scripts (package 3.11-1~git+20130321124944.90dfa923), this does not appear to have changed in the master version.

Comment 1 Robin Sheat 2013-03-21 09:30:03 UTC

Yes to all of these. The zebra password is never used by a person, although it is not required to be too secure, there's also no reason not to. The mysql password is used by the admin to create the staff users (assuming a default SQL file is not provided), but in those cases it's probably looked up every time anyway. The default staff user password would be good as a 12-char non-secure, although it probably gets changed anyway.

Comment 2 Magnus Enger 2013-03-21 09:30:47 UTC

I agree that the MySQL should be more secure. I *always* copy and paste it anyway, so the length does not really matter.

Comment 3 Peter Kelly 2013-03-21 09:55:26 UTC Comment hidden (obsolete)

Created attachment 16591 [details] [review]
Patch to address issues as proposed

Comment 4 Robin Sheat 2013-03-21 10:20:45 UTC

Just a note that as Peter works at Catalyst, I can't sign off on this. However it's a very simple patch that could be passed easily. It also affects only the packages, so while I'd like a signoff (for completeness) I'd let it past QA.

Comment 5 Magnus Enger 2013-03-21 11:02:47 UTC

I'd call weak passwords a bug... (Which means the patch will be eligible for inclusion in 3.12 :-).

Comment 6 Magnus Enger 2013-03-21 11:20:58 UTC Comment hidden (obsolete)

Created attachment 16604 [details] [review]
Bug 9885 [SIGNED-OFF] Passwords generated by command line scripts are weak

This changes the scripts so that:
- in koha-create, the zebra password and mysql passwords are set to 16 character "secure" passwords, ie generated with pwgen -s 16 1
- the patron password is set to a 12 character "memorable" password.

Signed-off-by: Magnus Enger <magnus@enger.priv.no>
Looks good. I did not actually build, install and test new packages,
but i did test pwgen with the new arguments and the changes make
sense.

Comment 7 Robin Sheat 2013-03-31 00:41:48 UTC

Created attachment 17069 [details] [review]
Bug 9885 Passwords generated by command line scripts are weak

This changes the scripts so that:
- in koha-create, the zebra password and mysql passwords are set to 16 character "secure" passwords, ie generated with pwgen -s 16 1
- the patron password is set to a 12 character "memorable" password.

Signed-off-by: Magnus Enger <magnus@enger.priv.no>
Looks good. I did not actually build, install and test new packages,
but i did test pwgen with the new arguments and the changes make
sense.

Signed-off-by: Robin Sheat <robin@catalyst.net.nz>
QA signoff

Comment 8 Robin Sheat 2013-03-31 00:42:30 UTC

Did a build and koha-create and noted that the new passwords are indeed better.

Comment 9 Jared Camins-Esakov 2013-03-31 01:40:12 UTC

This patch has been pushed to master.

Comment 10 Chris Cormack 2013-03-31 06:01:55 UTC

Pushed to 3.8.x and 3.10.x will be in 3.8.12 and 3.10.5

Comment 11 Magnus Enger 2013-04-18 20:27:07 UTC

Works nicely on official squeeze-dev packages.