calamari-ctl initialize does not enforce minimum password complexity
- Dominant language
- Python
- Stars
- 345
- Forks
- 175
- PR merge metrics
- No merged PRs in 30d
Description
calamari-ctl initialize does not enforce minimum password complexity. Setting weak or trivial passwords is possible.
```
# calamari-ctl initialize
[INFO] Loading configuration..
[INFO] Starting/enabling salt...
[INFO] Starting/enabling postgres...
[INFO] Initializing database...
[INFO] You will now be prompted for login details for the administrative user account. This is the account you will use to log into the web interface once setup is complete.
Username (leave blank to use 'root'):
Email address: root@example.com
Password:
Password (again):
Superuser created successfully.
[INFO] Initializing web interface...
[INFO] Starting/enabling services...
```
This should be be checked though cracklib-check or similar. The underlying process doing this seems to be https://docs.djangoproject.com/en/1.9/ref/django-admin/#createsuperuser
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the calamari-ctl initialize entry point and trace the administrative-user creation through Django's createsuperuser process. Check how cracklib-check or a similar validator could be used there; done means weak or trivial passwords are rejected during initialization while acceptable passwords still create the account.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100