uyuni-project / uyuni-tools

Tools to work with containerized Uyuni server
Apache License 2.0
13 stars 14 forks source link

Fix password entry usability (bsc#1226437) #380

Open nadvornik opened 1 week ago

nadvornik commented 1 week ago

What does this PR change?

Test coverage

Links

Issue(s): https://github.com/SUSE/spacewalk/issues/24640 https://bugzilla.suse.com/show_bug.cgi?id=1226437

Changelogs

Make sure the changelogs entries you are adding are compliant with https://github.com/uyuni-project/uyuni/wiki/Contributing#changelogs and https://github.com/uyuni-project/uyuni/wiki/Contributing#uyuni-projectuyuni-repository

If you don't need a changelog check, please mark this checkbox:

If you uncheck the checkbox after the PR is created, you will need to re-run changelog_test (see below)

Before you merge

Check How to branch and merge properly!

admd commented 1 week ago

@nadvornik @rjmateus how hard it would be force a password policy here ? I don't mean just the length but something like

  1. password must contain one special character
  2. Must contain a lower-case alphabetic
  3. Must contain an upper case alphabetic
  4. Must contain a digit
nadvornik commented 1 week ago

The entered password already is checked for spaces and tabs with regexp, extending the regexp is easy. This is however not applied on the passwords entered via commandline options.

rjmateus commented 1 week ago

I think that according to latest guidances don't bring security improvements. What would improve is to have a higher minimal length on the password.