Index: [Article Count Order] [Thread]

Date:  Fri, 03 Feb 2006 00:33:22 +0100
From:  Anders <andersb (at mark) blacksun.ca>
Subject:  [coba-e:03997] Re: Strong Password Enforcement (PKG)
To:  <coba-e (at mark) bluequartz.org>
Message-Id:  <C0085552.1867D%andersb (at mark) blacksun.ca>
In-Reply-To:  <200602022334.19223.bq (at mark) solarspeed.net>
X-Mail-Count: 03997

Michael Stauber wrote:

>> But it seems that your patch/replacement is already aware of this :-)
> 
> That's correct. I had the choice here of substituting a modified *.mo that
> replaces the one that comes with base-user*, or put in a separate one with
> just the new strings in it. However, part of the onscreen error message is a
> direct output from cracklib's results (like "password too short", "not enough
> different characters", etc.) There are about 15 different answers that
> cracklib may return upon checking a password and ultimately for a 100%
> correct localization one therefore would need 15 different tokens and a few
> IF statements to make sure the correct token is picked and displayed. So I
> cut a few corners for the sake of simplicity. But yes, for propper
> integration that eventually would need to be done.

I think it could be enough with a generic one: "cracklib refused your
password" and then quote the message that it returned in a [[VAR.msg]] ?

Or perhaps just lookup what it returns with i18n, and default to English.
i.e. use the cracklib result as the "msgid", in the base-user locale file.

>> Q: If you set the minimal length of a password to 8 in the CCE schema,
>> doesn't this break the default setup of admin/admin on a new installation ?
> 
> No, it doesn't look that way. The default password for admin upon install is
> applied without adhering to the limitations lined out in the CCE schema. So
> that would still work if the cracklib support and schema changes were part of
> the original base-user* RPMs. If the PKG in its current form is added onto
> Brian's BQ CD (in the /PKG directory and the corresponding "install.files"),
> then the PKG will be installed well after the default password for admin/root
> has been set anyway.

OK, so that's all good then. (Was meaning for it to be patched into base)
That was the only reservation. Well that, and my *test* pw is < 8 chars :-)

But at the very least the password != username should be good to go as-is...

--anders