microsoft / microsoft/sql-server-samples

SQLAssessment - Suggestion for a better message for the "WeakPassword" check

Open
#1,375 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PowerShell
Stars
11.2k
Forks
9.1k
Avg merge
2d 7h
Merged PRs (30d)
14

Description

The "Weak Password" check doesn't check only for weak passwords against a list of less known weak passwords but it will also be flagged if the
Enforce password policy or Enforce password expiration isn't checked (for enabled accounts).

That said, the description of this check (and the title too) should be refined to a more complete message.
https://github.com/microsoft/sql-server-samples/blob/master/samples/manage/sql-assessment-api/ruleset.json#L3501

I can have a login with a good password (length and complexity) but still, the message will be "Some SQL logins have weak passwords.". This brings confusion.
In this case, the reason can be one of the unchecked boxes.

Suggestion

Current:

"displayName": "SQL logins have weak passwords",
"description": "Some SQL logins have weak passwords. Make sure that you use a strong password for each of your SQL logins to decrease vulnerabilities.",

An idea:

"displayName": "SQL logins have weak passwords or missing policy/expiration",
"description": "Some SQL logins have weak passwords or don't have the policy/expiration check on. Make sure that you use a strong password for each of your SQL logins and change your passwords often to decrease vulnerabilities.",

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the SQLAssessment rule in ruleset.json around line 3501 and review its current displayName and description. Update the wording to reflect that the check can flag weak passwords or missing password policy/expiration settings; done means the message accurately describes both causes.

Written by the indexing model from the issue text.

Assessment

Tech stack
sql
Domain
databases
Issue type
Documentation
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.