Require root password on server startup and store hash rather than plain text for verification

[h00gs]

... root password on startup, store the hash of the root password (not the plain text) in the server config xml file, and require that it be changed from the default value. A passphrase is permitted and a startup option "-p" is provided which allows the user to run the server for the sole purpose of generating a password hash that can be pasted into the server config xml file for subsequent verification.

Minimal code changes, uses existing encryption calls. Does create a problem if you want to automatically spawn server instances.

[lvca]

Nice pull request, sorry to haven't merged before!

[lvca]

Nice pull request, sorry to haven't merged before!

[lvca]

Why you stored in xml config file "root" as default password? I would leave the current settings where if you install a new server you've an automatic generated password. Does this behavior remain if I avoid to put the root user?

•    <user resources="*" password="4813494D137E1631BBA301D5ACAB6E7BB7AA74CE1185D456565EF51D737677B2" 
  

[lvca]

Why you stored in xml config file "root" as default password? I would leave the current settings where if you install a new server you've an automatic generated password. Does this behavior remain if I avoid to put the root user?

•    <user resources="*" password="4813494D137E1631BBA301D5ACAB6E7BB7AA74CE1185D456565EF51D737677B2" 
  

[h00gs]

Hi Luca,

Thanks for considering the request. To be honest I can't remember why I
introduced the root password! Unfortunately I'm moving house tommorrow and
in Australia getting connected to the internet in such a case takes 2-4
weeks (even though the wire is in place), so I'll revisit what I was doing
there and get back to you in a few weeks.

Cheers
hoogs

On Tue, May 7, 2013 at 2:59 PM, Luca Garulli notifications@github.comwrote:

Why you stored in xml config file "root" as default password? I would
leave the current settings where if you install a new server you've an
automatic generated password. Does this behavior remain if I avoid to put
the root user?

• <user resources="*"
  password="4813494D137E1631BBA301D5ACAB6E7BB7AA74CE1185D456565EF51D737677B2"

—
Reply to this email directly or view it on GitHubhttps://github.com/nuvolabase/orientdb/pull/1428#issuecomment-17526389
.

[h00gs]

Hi Luca,

Thanks for considering the request. To be honest I can't remember why I
introduced the root password! Unfortunately I'm moving house tommorrow and
in Australia getting connected to the internet in such a case takes 2-4
weeks (even though the wire is in place), so I'll revisit what I was doing
there and get back to you in a few weeks.

Cheers
hoogs

On Tue, May 7, 2013 at 2:59 PM, Luca Garulli notifications@github.comwrote:

Why you stored in xml config file "root" as default password? I would
leave the current settings where if you install a new server you've an
automatic generated password. Does this behavior remain if I avoid to put
the root user?

• <user resources="*"
  password="4813494D137E1631BBA301D5ACAB6E7BB7AA74CE1185D456565EF51D737677B2"

—
Reply to this email directly or view it on GitHubhttps://github.com/nuvolabase/orientdb/pull/1428#issuecomment-17526389
.

[lvca]

Ok ;-)

Lvc@

On 10 May 2013 16:38, h00gs notifications@github.com wrote:

Hi Luca,

Thanks for considering the request. To be honest I can't remember why I
introduced the root password! Unfortunately I'm moving house tommorrow and
in Australia getting connected to the internet in such a case takes 2-4
weeks (even though the wire is in place), so I'll revisit what I was doing
there and get back to you in a few weeks.

Cheers
hoogs

On Tue, May 7, 2013 at 2:59 PM, Luca Garulli notifications@github.comwrote:

Why you stored in xml config file "root" as default password? I would
leave the current settings where if you install a new server you've an
automatic generated password. Does this behavior remain if I avoid to
put
the root user?

• <user resources="*"

password="4813494D137E1631BBA301D5ACAB6E7BB7AA74CE1185D456565EF51D737677B2"

—
Reply to this email directly or view it on GitHub<
https://github.com/nuvolabase/orientdb/pull/1428#issuecomment-17526389>
.

—
Reply to this email directly or view it on GitHubhttps://github.com/nuvolabase/orientdb/pull/1428#issuecomment-17723791
.

[lvca]

Ok ;-)

Lvc@

On 10 May 2013 16:38, h00gs notifications@github.com wrote:

Hi Luca,

Thanks for considering the request. To be honest I can't remember why I
introduced the root password! Unfortunately I'm moving house tommorrow and
in Australia getting connected to the internet in such a case takes 2-4
weeks (even though the wire is in place), so I'll revisit what I was doing
there and get back to you in a few weeks.

Cheers
hoogs

On Tue, May 7, 2013 at 2:59 PM, Luca Garulli notifications@github.comwrote:

Why you stored in xml config file "root" as default password? I would
leave the current settings where if you install a new server you've an
automatic generated password. Does this behavior remain if I avoid to
put
the root user?

• <user resources="*"

password="4813494D137E1631BBA301D5ACAB6E7BB7AA74CE1185D456565EF51D737677B2"

—
Reply to this email directly or view it on GitHub<
https://github.com/nuvolabase/orientdb/pull/1428#issuecomment-17526389>
.

—
Reply to this email directly or view it on GitHubhttps://github.com/nuvolabase/orientdb/pull/1428#issuecomment-17723791
.

[lvca]

Ok, I can wait for it ;-)

[lvca]

Ok, I can wait for it ;-)

[ruckc]

bump... Will this merge cleanly now or does it need to be revisited?

[ruckc]

bump... Will this merge cleanly now or does it need to be revisited?

[lvca]

This fix needs to be merged against new develop. @ruckc Would you like to do it?

[lvca]

This fix needs to be merged against new develop. @ruckc Would you like to do it?

[ruckc]

@lvca I think I can. I'm looking at it now. Though, I am trying to figure out the easiest way to handle automatic startup scripts if a password is required via stdin. Thinking it might be easiest to merge in the config.xml password hashing and leave the password required to launch out until OrientDB gets encrypted data at rest through #89.

[ruckc]

@lvca I think I can. I'm looking at it now. Though, I am trying to figure out the easiest way to handle automatic startup scripts if a password is required via stdin. Thinking it might be easiest to merge in the config.xml password hashing and leave the password required to launch out until OrientDB gets encrypted data at rest through #89.

[lvca]

This has been implemented in 2.2.

[lvca]

This has been implemented in 2.2.