microsoft / microsoft/sql-server-samples
SQLAssessment - Suggestion for a better message for the "WeakPassword" check
Nobody has claimed this yet.
- Dominant language
- PowerShell
- Stars
- 11.2k
- Forks
- 9.1k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 14
Description
The "Weak Password" check doesn't check only for weak passwords against a list of less known weak passwords but it will also be flagged if the
Enforce password policy or Enforce password expiration isn't checked (for enabled accounts).
That said, the description of this check (and the title too) should be refined to a more complete message.
https://github.com/microsoft/sql-server-samples/blob/master/samples/manage/sql-assessment-api/ruleset.json#L3501
I can have a login with a good password (length and complexity) but still, the message will be "Some SQL logins have weak passwords.". This brings confusion.
In this case, the reason can be one of the unchecked boxes.
Suggestion
Current:
"displayName": "SQL logins have weak passwords",
"description": "Some SQL logins have weak passwords. Make sure that you use a strong password for each of your SQL logins to decrease vulnerabilities.",
An idea:
"displayName": "SQL logins have weak passwords or missing policy/expiration",
"description": "Some SQL logins have weak passwords or don't have the policy/expiration check on. Make sure that you use a strong password for each of your SQL logins and change your passwords often to decrease vulnerabilities.",
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the SQLAssessment rule in ruleset.json around line 3501 and review its current displayName and description. Update the wording to reflect that the check can flag weak passwords or missing password policy/expiration settings; done means the message accurately describes both causes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- sql
- Domain
- databases
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100