Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1188488
| From | Philip Hands <phil@hands.com> |
|---|---|
| Newsgroups | linux.debian.bugs.dist, linux.debian.maint.boot |
| Subject | Bug#1064617: Passwords should not be changed frequently |
| Date | 2024-02-29 21:10 +0100 |
| Message-ID | <IcUT7-dwMz-3@gated-at.bofh.it> (permalink) |
| References | <IbaSl-cqaY-3@gated-at.bofh.it> <IbaSl-cqaY-3@gated-at.bofh.it> <IbvtL-cCND-1@gated-at.bofh.it> <IbaSl-cqaY-3@gated-at.bofh.it> <IbvtL-cCND-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Cross-posted to 2 groups.
[Multipart message — attachments visible in raw view] - view raw
Pascal Hambourg <pascal@plouf.fr.eu.org> writes:
> On 25/02/2024 at 01:17, Matthew Wilcox wrote:
>>
>> I just did an installation with the 2024-02-24
>> debian-testing-amd64-netinst.iso image. I forget the exact wording
>> used, but when setting up a user, d-i printed advice that user passwords
>> should be changed frequently. This is no longer current good advice
>> (since 2017):
>
> This topic has some history, see
> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=656509>
> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=868869>
> <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998408>
> <https://salsa.debian.org/installer-team/user-setup/-/merge_requests/7>
It had not occured to me until Matthew's suggestion that we might simply
remove the obsolete advice, rather than trying to improve the wording.
In light of that, I've split the MR into 2 commits, the first of which
removes the old advice (which hopefully inflicts the smallest possible
load on our translators) and the second of which is an attempt to come
up with something better (criticism welcome, I've had multiple attempts
at this, so I imagine there's still room for improvement).
Depending upon whether we think it's worth using translators' time on
this subject, we can then select one or both commits, and finally close
these bugs.
You can see my latest attempt here:
https://openqa.debian.net/tests/238094#step/passwords/1
in which I'm recommending setting no password for root, which then gives
the initial user 'sudo' membership[1].
The slightly awkward thing about this recommendation is that it
encourages people to put themselves in the situation that:
https://salsa.debian.org/installer-team/user-setup/-/merge_requests/6
is trying to address, so if we make this recommendation, we should also
deal with that issue (which I think we should do anyway).
Cheers, Phil.
[1] This strikes me as decent advice for newbies, for whom this sort of
guidance is most necessary. The problem with asking a newbie for a
root password is that they're likely to choose a poor one. Even if
they later realise that they should have choosen better passwords,
they may well not at that point remember that they still have a
useless password for root that needs updating.
On the other hand, now that ssh defaults to not allowing password
based logins to root, perhaps the potential presence of a poor
password on a sudo enabled account should be of greater concern,
since that will still be open to remote logins, so I can see that
one could argue this either way.
--
Philip Hands -- https://hands.com/~phil
Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#1064617: Passwords should not be changed frequently Matthew Wilcox <willy@infradead.org> - 2024-02-25 01:50 +0100
Bug#1064617: Passwords should not be changed frequently Pascal Hambourg <pascal@plouf.fr.eu.org> - 2024-02-25 23:50 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-02-29 21:10 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-02-29 23:20 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 00:40 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-01 07:00 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 15:50 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-01 21:00 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 22:40 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-02 21:10 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-02 23:00 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-03 00:50 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-04 06:30 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 10:50 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 16:10 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:40 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 23:00 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:10 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 16:20 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 18:00 +0100
Bug#1064617: Passwords should not be changed frequently Cyril Brulebois <kibi@debian.org> - 2024-03-05 19:40 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 20:40 +0100
Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 21:50 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 22:30 +0100
Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 23:00 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 08:40 +0100
Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 09:20 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 11:20 +0100
Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 13:30 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-06 14:00 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 16:00 +0100
Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-07 09:00 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-07 20:30 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-08 20:10 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-08 23:20 +0100
Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-09 14:00 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-09 16:40 +0100
Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 20:50 +0100
Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-06 19:50 +0100
Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-05 19:40 +0100
csiph-web