Bug 2413086
| Summary: | WebUI: Password is too weak | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Lukas Ruzicka <lruzicka> | ||||||
| Component: | anaconda-webui | Assignee: | Katerina Koukiou <kkoukiou> | ||||||
| Status: | NEW --- | QA Contact: | |||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 43 | CC: | a.badger, abdo.h.eldaly, alpha, anaconda-maint, benji97, devthalles, j3susangar1ca, kkoukiou, kparal, lexden.s, mkolman, psklenar, robatino, rvykydal, schtone, seideys, w | ||||||
| Target Milestone: | --- | Keywords: | CommonBugs | ||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | https://discussion.fedoraproject.org/t/172029 | ||||||||
| Fixed In Version: | Doc Type: | --- | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | Type: | --- | |||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 2362357 | ||||||||
| Attachments: |
|
||||||||
|
Description
Lukas Ruzicka
2025-11-06 12:50:13 UTC
Created attachment 2112948 [details]
journal.log
Created attachment 2112949 [details]
anaconda_webui.log
Proposed as a Blocker for 44-beta by Fedora user lruzicka using the blocker tracking app because: I propose this as a blocker, because Anaconda crashes with weak passwords to encrypt the disk, which I believe violates https://fedoraproject.org/wiki/Fedora_44_Beta_Release_Criteria#Custom_partitioning Yesterday, I have spent some time to look closer into this problem with the following findings:
1) The problem can only be reproduced on KDE. You can always trigger the crash using `pwvonroot` and `pwvonroo` passwords, however `bwvonroot`, for example, does not trigger it, nor does it `rootice`. Originally, I thought that the string `root` causes the problem, but it has been confirmed that `root` itself as part of the password cannot trigger the situation.
2) Anaconda not only crashes on the disk encryption pane, but on every password field where the "correct" password is used.
3) The crash happens immediately after the user stops typing the first password. It does not let users to retype the password, nor it lets users to proceed to the Next pane.
4) Anaconda uses the Cockpit backend to provide passwords strength and Cockpit backend uses the `pwscore` program to evaluate the passwords. I have tried manually with pwscore with the following results:
* pwvonroot -> 15
* pwvonboot -> 18
* pwvonroo -> 0
* pwvonboo -> 3
* rootice -> Error in the password quality, password shorter than 8 digits
* weakpassword -> 62
* rootvonpw -> 15
I am not sure why 'pwvonboot' passes and 'pwvonroot' does not. Also, 'pwvonroo' crashes and 'pwvonboo' does not. 'rootvonpw' does not crash, 'pwroot' does not crash, 'rootpw' does not crash.
Also, the Accounts.jsx file includes a list of reserved words (https://raw.githubusercontent.com/rhinstaller/anaconda-webui/refs/heads/main/src/components/users/Accounts.jsx), but the ones I have tested, such as 'daemon', 'rootsync', etc. do not crash and can be used as passwords. I have also checked XFCE, LXDE, and LXQt and I can confirm that this is easily reproduced on all of them. It seems it might be the issue on all of spins, but on Fedora Workstation. I could not reproduce it on KDE Rawhide from 20251110. Documented as common issue: https://discussion.fedoraproject.org/t/172029 *** Bug 2389356 has been marked as a duplicate of this bug. *** *** Bug 2406958 has been marked as a duplicate of this bug. *** *** Bug 2417765 has been marked as a duplicate of this bug. *** *** Bug 2420040 has been marked as a duplicate of this bug. *** *** Bug 2411732 has been marked as a duplicate of this bug. *** *** Bug 2424130 has been marked as a duplicate of this bug. *** *** Bug 2425389 has been marked as a duplicate of this bug. *** |