greenbone / gvmd

Greenbone Vulnerability Manager - The database backend for the Greenbone Community Edition
GNU Affero General Public License v3.0
286 stars 153 forks source link

Cannot use space in username #185

Closed TheGroundZero closed 3 years ago

TheGroundZero commented 6 years ago

Expected behavior

Successfully create a new credential with a space in the username.

Current behavior

(Status code: 400) Operation 'Create Credential' failed Given login was invalid

Steps to reproduce

  1. Create a new credential
  2. Enter username with a space in it
  3. Try to save credential

GVM versions

gsa: (gsad --version)
7.0.3

gvm: (gvmd --version)
/

openvas-scanner: (openvassd --version)
5.1.3

gvm-libs:

openvas-smb:

Environment

Operating system:
Greenbone Security Manager Community Edition

Installation method / source: (packages, source installation)
ISO from site

Logfiles

This issue was originaly opened under openvas-scanner.

While it is strongly discouraged because it may other systems, Windows (and perhaps other OSes) allow users to create accounts with a space in the username.

It'd be nice if the tool allows you to create such credential to be used by the scanner. If not, I would suggest to at least include a more descriptive error message ( e.g. "Username cannot contain whitespace" or "Unsupported character used in field username").

cfi-gb commented 5 years ago

If not, I would suggest to at least include a more descriptive error message ( e.g. "Username cannot contain whitespace" or "Unsupported character used in field username").

Seems this is now done via https://github.com/greenbone/gvmd/pull/59 from April 2018 and will be shipped with the next openvas-manager 7.0 release.

Also quoting @bjoernricks from https://github.com/greenbone/gvmd/issues/312#issuecomment-451094960:

That's not an easy task as it sounds first. Due to local policies and different operating systems some usernames might be valid on one system but not on the other. There is no username rule that fits for all systems.

We are aware of these problems and are thinking about something like "test these credentials to login into this system" functionality. But this is in an early stage and will take some time.

bjoernricks commented 3 years ago

Should be re-tested with current version. If it is still valid please re-open.