Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1188855

Bug#1064617: Passwords should not be changed frequently

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

Am 2. März 2024 21:07:34 MEZ schrieb Philip Hands <phil@hands.com>:
>
>This sentence is the thing that prompted me to change things in the
>first place, because it is not true. One does not _need_ to set a root
>password.

It should be understood as 
"If you want to enable login as root, you have to set a root password now."

And in expert mode it is in fact working this way:
At first, you are asked if you want to enable login as root. If you answer yes 
here, you are prompted to set a root password. 
And at that point it is indeed required to set a root password, since you 
chose to enable root login in the first question and the installer does not
allow an empty password for root.

To make it work in default install, we could change the question as
in above citation.

>I don't actually care very much whether we encourage sudo use. My
>wording ended up (after many variations) quite strongly encouraging it
>mostly as an antidote to the implication that comes from having a
>question dedicated to setting the root password, but I'd be happy with
>any wording that makes sure that people understand that both options are
>totally fine.

The sudo possibility is also mentioned:

'The root user should not have an empty password. If you leave this
empty, the root account will be disabled and the system's initial user
account will be given the power to become root using the "sudo"
command.'

I have rephrased that a bit, see below.

>The other thing that I was trying to ensure is that people are reassured
>that they'll get to specify a password that will get them root access even if
>they decide to leave the root password unset.  This is because I've seen
>people become quite uncertain about what to expect at this point in the
>install.
>
>I've found that it is not easy to come up with things that include much
>nuance about this, while still fitting in the space available, which is
>why I decided to try a more opinionated approach.
>
>One could soften what I wrote by replacing "generally recommended" with
>something like "often appropriate" -- how does that seem to people?

Your proposal too much focusses on the sudo way IMO.
We risk getting complains from people, who miss advise regarding the
enabled root login.

I have rephrased the dialog a bit, to make the sudo way more visible and
better understandable.

>One can of course tinker with this stuff indefinitely. I actually spent
>a fair amount of time wondering how best to describe not setting a root
>password for instance -- should one say "leave the password unset", "set
>an empty password", "enter no password", or something like "just hit
><RETURN>"? (and does that last one actually apply to all the available
>UIs?).
>
>The same goes for how you say that the password is not going to get
>shown (unless you ask for it to be shown), which in the GTK UI gets
>characters replaced with dots, IIRC in the text UI its with asterisks,
>and I'd guess it just gets completely hidden in the speech install.

I think that's not much of a problem. People are used to the situation,
that passwords are not shown, but replaced by asterisks or similar.
And we have the checkbox for showing it in clear text, that should be
enough.


Updated patch attached.


Holger

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1064617: Passwords should not be changed frequently Matthew Wilcox <willy@infradead.org> - 2024-02-25 01:50 +0100
  Bug#1064617: Passwords should not be changed frequently Pascal Hambourg <pascal@plouf.fr.eu.org> - 2024-02-25 23:50 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-02-29 21:10 +0100
      Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-02-29 23:20 +0100
        Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 00:40 +0100
          Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-01 07:00 +0100
            Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 15:50 +0100
            Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-01 21:00 +0100
              Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-02 21:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-02 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-03 00:50 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-04 06:30 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 10:50 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 16:10 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:10 +0100
  Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 16:20 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 18:00 +0100
      Bug#1064617: Passwords should not be changed frequently Cyril Brulebois <kibi@debian.org> - 2024-03-05 19:40 +0100
        Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 20:40 +0100
          Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 21:50 +0100
            Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 22:30 +0100
              Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 08:40 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 09:20 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 11:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 13:30 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-06 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 16:00 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-07 09:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-07 20:30 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-08 20:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-08 23:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-09 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-09 16:40 +0100
        Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 20:50 +0100
          Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-06 19:50 +0100
  Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-05 19:40 +0100

csiph-web