Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1189238

Bug#1064617: Passwords should not be changed frequently

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Justin B Rye <justin.byam.rye@gmail.com> writes:

> Philip Hands wrote:
>> Justin B Rye <justin.byam.rye@gmail.com> writes:
>>> Philip Hands wrote:
>>>> Justin B Rye <justin.byam.rye@gmail.com> writes:> ...
>>>> The reason behind that structure was supposed to be that one definitely
>>>> needs _a_ password, but not necessarily a root password, so the password
>>>> advice applies to whichever password you'll decide to grant root access
>>>> to, which might not be set here.
>>>
>>> This template is specifically about the "Root password/passphrase";
>> 
>> Well, sort-of, except that the user's response (whether to leave this
>> blank or not) modifies what happens with the user account's permissions,
>> so it's also about explaining the way that logic works in the installer
>> and what that will do to the target system.
>>
>>> probably I should have quoted the patch I was looking at, which starts
>>> with "One needs a password/passphrase that grants access to the 'root'
>>> (system administrative) account" but goes on to say "Alternatively,
>>> you can lock root's password by leaving this setting empty".
>> 
>> I'm intimately familiar with the patches you're reading, so I feel like
>> this comment suggests that we may be talking past one another somehow.
>
> Yes, this is a common problem: you're so familiar with what we need
> it to say that you aren't noticing what the text currently does say.
> https://salsa.debian.org/installer-team/user-setup/-/commit/77c1517fade367bc465da2a5908c5ac47dd8bba7
>
>   Template: passwd/root-password
>   Type: password
>   # :sl1:
>   _Description: Root password/passphrase:
>    One needs a password/passphrase that grants
>    access to the 'root' (system administrative) account.
>    Be aware that a malicious or unqualified user
>    that obtains root access can have disastrous results,
>    so you should choose a password/passphrase that cannot be guessed.
>    It should not be a word found in dictionaries,
>    or something that could be easily associated with you.
>
> (Summary: You DO need a root password.)

No, as I said, what that's trying to say is that there needs to exist a
password that one way or the other will let one get access to the root
account (since otherwise one is not going to be able to admin the
machine), but that is not neccesarily the same thing as a "root
password", because the password being refered to might well be the
initial user's password, as long as they end up in the sudo group.

If it comes across as meaning that there needs to be a "root password",
then it's not succeeding in expressing the nuance of the situation
correctly, and we probably need to fix that (assuming that we can come
up with a better wording that still fits in the space available).

>    .
>    To allow direct password-based access to root,
>    you should set the 'root' password/passphrase here.
>    .
>    Alternatively, you can lock root's password
>    by leaving this setting empty, and
>    instead use the system's initial user account
>    (which will be set up in the next step)
>    to become root. This will be enabled for you
>    by adding that user to the 'sudo' group.
>    .
>    Note: what you type here will be hidden (unless you select to show it).
>
> (Summary: You DON'T need a root password.)
>
> Suggested rewrite (short version):
>
>  _Description: Root password/passphrase:
>   To allow direct password/passphrase-based access to the 'root'
>   (system administrative) account you can set it up here.
>   To protect your system you should not use one that can be guessed.
>   .
>   Alternatively, you can lock root's password
>    by leaving this setting empty, and
>    instead use the system's initial user account
>    (which will be set up in the next step)
>    to become root. This will be enabled for you
>    by adding that user to the 'sudo' group.
>    .
>    Note: what you type here will be hidden (unless you select to show it).

This is certainly better than good enough, so I'd be fine with this too.

Cheers, Phil.
-- 
Philip Hands -- https://hands.com/~phil

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1064617: Passwords should not be changed frequently Matthew Wilcox <willy@infradead.org> - 2024-02-25 01:50 +0100
  Bug#1064617: Passwords should not be changed frequently Pascal Hambourg <pascal@plouf.fr.eu.org> - 2024-02-25 23:50 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-02-29 21:10 +0100
      Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-02-29 23:20 +0100
        Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 00:40 +0100
          Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-01 07:00 +0100
            Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 15:50 +0100
            Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-01 21:00 +0100
              Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-01 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-02 21:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-02 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-03 00:50 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-04 06:30 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 10:50 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 16:10 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:40 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-04 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-04 22:10 +0100
  Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 16:20 +0100
    Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 18:00 +0100
      Bug#1064617: Passwords should not be changed frequently Cyril Brulebois <kibi@debian.org> - 2024-03-05 19:40 +0100
        Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-05 20:40 +0100
          Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 21:50 +0100
            Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 22:30 +0100
              Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-05 23:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 08:40 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 09:20 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 11:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-06 13:30 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-06 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-06 16:00 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-07 09:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-07 20:30 +0100
                Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-08 20:10 +0100
                Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-08 23:20 +0100
                Bug#1064617: Passwords should not be changed frequently Justin B Rye <justin.byam.rye@gmail.com> - 2024-03-09 14:00 +0100
                Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-09 16:40 +0100
        Bug#1064617: Passwords should not be changed frequently Philip Hands <phil@hands.com> - 2024-03-05 20:50 +0100
          Bug#1064617: Passwords should not be changed frequently Holger Wansing <hwansing@mailbox.org> - 2024-03-06 19:50 +0100
  Bug#1064617: Passwords should not be changed frequently Diederik de Haas <didi.debian@cknow.org> - 2024-03-05 19:40 +0100

csiph-web