Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fedora-toolbox image doesn't have cracklib-dicts #1351

Closed
ibotty opened this issue Aug 16, 2023 · 5 comments
Closed

fedora-toolbox image doesn't have cracklib-dicts #1351

ibotty opened this issue Aug 16, 2023 · 5 comments
Labels
1. Bug Something isn't working

Comments

@ibotty
Copy link

ibotty commented Aug 16, 2023

Describe the bug
A clear and concise description of what the bug is. If possible, re-run the command(s) with --log-level debug and put the output here.

Steps how to reproduce the behaviour

> pwmake 64
/usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
/usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
/usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
Error: Password generation failed - required entropy too low for settings

Expected behaviour

> pwmake 64
N3j=uD!ipDAMf

Output of toolbox --version (v0.0.90+)
toolbox version 0.0.99.4

Toolbox package info (rpm -q toolbox)
toolbox-0.0.99.4-1.fc38.x86_64

Output of podman version

Client:       Podman Engine
Version:      4.6.0
API Version:  4.6.0
Go Version:   go1.20.6
Built:        Fri Jul 21 14:23:26 2023
OS/Arch:      linux/amd64

Podman package info (rpm -q podman)
podman-4.6.0-1.fc38.x86_64

Info about your OS
Fedora Silverblue 38
@ibotty ibotty added the 1. Bug Something isn't working label Aug 16, 2023
@debarshiray
Copy link
Member 

> pwmake 64
/usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
/usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
/usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
Error: Password generation failed - required entropy too low for settings

The message required entropy too low is misleading.

The actual problem is the absence of the CrackLib dictionaries (on Fedora that's the cracklib-dicts RPM). Those No such file or directory messages are coming from PWOpen() inside CrackLib. It tries to open the missing dictionary, fails, calls perror(3) with errno(3) set to ENOENT, and that prints No such file or directory.

Now the question is, why are the CrackLib dictionaries missing? We could also try to improve the error handling in libpwquality.

debarshiray added a commit to debarshiray/libpwquality that referenced this issue Feb 1, 2024
@debarshiray
pwquality_generate(): Don't report CrackLib errors as 'low entropy'
6028dbf 
If the CrackLib dictionaries were missing, pwmake(1) would complain that
the entropy is too low:
  $ pwmake 64
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  Error: Password generation failed - required entropy too low for
    settings

... and confuse users [1].

This changes it to report something closer to the truth:
  $ pwmake 64
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  Error: The password fails the dictionary check

... so that users can help themselves by installing the CrackLib
dictionaries.

[1] containers/toolbox#1351
@debarshiray debarshiray mentioned this issue Feb 1, 2024
Merged
@debarshiray
Copy link
Member

Here's a pull request to improve the error handling in libpwquality:
libpwquality/libpwquality#85

@debarshiray
Copy link
Member

Renaming the issue to highlight the problem closer to Toolbx's sphere of influence. ie., the fedora-toolbox image doesn't have the cracklib-dicts RPM.

@debarshiray debarshiray changed the title not enough randomness in container fedora-toolbox image doesn't have cracklib-dicts Feb 1, 2024
t8m pushed a commit to libpwquality/libpwquality that referenced this issue Feb 1, 2024
@debarshiray @t8m
pwquality_generate(): Don't report CrackLib errors as 'low entropy'
aeff47d 
If the CrackLib dictionaries were missing, pwmake(1) would complain that
the entropy is too low:
  $ pwmake 64
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  Error: Password generation failed - required entropy too low for
    settings

... and confuse users [1].

This changes it to report something closer to the truth:
  $ pwmake 64
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  /usr/share/cracklib/pw_dict.pwd.gz: No such file or directory
  Error: The password fails the dictionary check

... so that users can help themselves by installing the CrackLib
dictionaries.

[1] containers/toolbox#1351
debarshiray added a commit to debarshiray/toolbox that referenced this issue Feb 1, 2024
@debarshiray
images/fedora: Add cracklib-dicts to Fedora 38 and 39
7038491 
Currently, the libpwquality package mentions cracklib-dicts as a weak
dependency [1,2].  However, the libpwquality package is part of the
fedora base image, which doesn't include weak dependencies [3], and that
leads to cracklib-dicts going missing.

The absence of the cracklib-dicts package causes various operations that
go through libpwquality (eg., pwmake(1)) to fail [1], and sometimes in
confusing ways [4].

[1] Fedora libpwquality commit f84a5e3ba6c166e5
    https://src.fedoraproject.org/rpms/libpwquality/c/f84a5e3ba6c166e5
    https://bugzilla.redhat.com/show_bug.cgi?id=2158891

[2] Fedora libpwquality commit 303154338d6d3650
    https://src.fedoraproject.org/rpms/libpwquality/c/303154338d6d3650
    https://bugzilla.redhat.com/show_bug.cgi?id=2006063

[3] fedora-kickstarts commit 1c39c0adb0d44866
    https://pagure.io/fedora-kickstarts/c/1c39c0adb0d44866
    https://pagure.io/fedora-kickstarts/pull-request/551
    https://pagure.io/releng/issue/8530

[4] libpwquality/libpwquality#85

containers#1351
@debarshiray debarshiray mentioned this issue Feb 1, 2024
Merged
debarshiray added a commit to debarshiray/toolbox that referenced this issue Feb 1, 2024
@debarshiray
images/fedora/f38: Update missing-docs
4ca0123 
Otherwise the image fails to build with:
  $ podman build images/fedora/f38
  ...
  Packages with missing files:
  libcomps
  ...

containers#1351
@debarshiray
Copy link
Member

Turns out that the fedora-toolbox images for Fedora >= 39 already have cracklib-dicts. Only the one for Fedora 38 didn't have it. I have now fixed that:
#1444
https://bodhi.fedoraproject.org/updates/FEDORA-CONTAINER-2024-7eb1f9483f

@debarshiray
Copy link
Member

Thanks for your feedback!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
1. Bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ibotty @debarshiray