Stronger check for DM password during server install #443
Conversation
|
Function check_password_fips_nssdb_compatible looks like a great candidate for unit test. |
ipaserver/install/server/install.py
Outdated
| gotnumeric = any(c.isdigit() for c in password[:-1]) | ||
| gotupper = any(c.isupper() for c in password[1:]) | ||
| gotlower = any(c.islower() for c in password) | ||
| gotspecial = password.isalnum() |
There was a problem hiding this comment.
Thanks, was editing this right before pushing but forgot how to logic :)
| """ | ||
| Check whether the given password can be used for NSSDB setup in FIPS mode | ||
| """ | ||
| gotnumeric = any(c.isdigit() for c in password[:-1]) |
There was a problem hiding this comment.
Perhaps we could use a comment that the :-1 and 1: is a NSSDB-specific requirement.
|
IMHO you got it backwards - DM password may not comply to NSS requirements for passwords, therefore it must not be used as a password for any NSS database during server install. |
|
@HonzaCholasta: +1, you're right, I should investigate more on how to change this behavior, either we or Dogtag don't behave correctly here. |
|
Closing as REJECTED, this will be sorted out in another way. |
DM password is used as an NSS database password during server installation, therefore it must comply to NSS database requirements for password in FIPS.
https://fedorahosted.org/freeipa/ticket/5695