Bug 1299433 - No password validation for basic(default) authentication
No password validation for basic(default) authentication
Status: CLOSED DUPLICATE of bug 1264137
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Security (Show other bugs)
6.1.6
x86_64 Linux
unspecified Severity urgent (vote)
: Unspecified
: --
Assigned To: Katello Bug Bin
Kedar Bidarkar
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-01-18 06:24 EST by Oleksandr Shtaier
Modified: 2017-02-23 14:39 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-01-18 19:05:37 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Oleksandr Shtaier 2016-01-18 06:24:37 EST
Description of problem:
On one hand - that issue has more references to user management functionality, but as it is directly impact user password aspects, it was decided to treat mentioned problem as security one.

Reproduced from both UI and CLI stand points

Create User issues:
- There are no validation on length of the password
  - You can specify very long passwords that directly impact performance of application (for example, tried to create user with password that has length more than 30000 of symbols and put browser in non-responsive state for more than 30 seconds. Each following action will hang browser for more than 30 seconds). Of course, there are no limit
  - You can specify very small passwords (like 1 symbol).
- It is possible to use any character (even whitespace) in the password and in any sequence (like 'aaaaaaa'). Even more, password - 'aaaaaaaaaaaaaaaaaaaa' - treated as 'Very Strong' one!
- It is possible to use dictionary words

Update User issues:
Same as for create user
+
- It is possible to use empty password in update procedure.
For example, using hammer:
```
hammer -u xxxxx -p xxxxx user update --id 5 --password ''
User updated
```
- It is possible to use previous password(s).

Version-Release number of selected component (if applicable):
6.1.6 (but probably every version)

How reproducible:
Always

Steps to Reproduce:
1. Try to Create/Update user with different passwords

Actual results:
No password validation

Expected results:
At least basic rules are used:
Length 8-50 characters
At least one uppercase letter
At least one lowercase letter
At least one number
At least one special character ('~ ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | : ; " ' < > , . ? /')
No previous passwords (at least last one) cannot be used for update user procedure
Proper representation in UI (like what passwords is weak and what password is very strong)

Additional info:
Comment 2 Mike McCune 2016-01-18 19:05:37 EST

*** This bug has been marked as a duplicate of bug 1264137 ***

Note You need to log in before you can comment on or make changes to this bug.