ceph / ceph/calamari

calamari-ctl initialize does not enforce minimum password complexity

Open
#454 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
345
Forks
175
PR merge metrics
No merged PRs in 30d

Description

calamari-ctl initialize does not enforce minimum password complexity. Setting weak or trivial passwords is possible.

```
# calamari-ctl initialize
[INFO] Loading configuration..
[INFO] Starting/enabling salt...
[INFO] Starting/enabling postgres...
[INFO] Initializing database...
[INFO] You will now be prompted for login details for the administrative user account. This is the account you will use to log into the web interface once setup is complete.
Username (leave blank to use 'root'):
Email address: root@example.com
Password:
Password (again):
Superuser created successfully.
[INFO] Initializing web interface...
[INFO] Starting/enabling services...
```

This should be be checked though cracklib-check or similar. The underlying process doing this seems to be https://docs.djangoproject.com/en/1.9/ref/django-admin/#createsuperuser

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the calamari-ctl initialize entry point and trace the administrative-user creation through Django's createsuperuser process. Check how cracklib-check or a similar validator could be used there; done means weak or trivial passwords are rejected during initialization while acceptable passwords still create the account.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.