Bug 578175 - Installer does not validate the db password; install continues (somehow)
Summary: Installer does not validate the db password; install continues (somehow)
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: RHQ Project
Classification: Other
Component: Installer
Version: 1.4
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: RHQ Project Maintainer
QA Contact: Corey Welton
URL:
Whiteboard:
Depends On:
Blocks: jon-sprint7-bugs
TreeView+ depends on / blocked
 
Reported: 2010-03-30 13:42 UTC by Corey Welton
Modified: 2010-03-31 08:03 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-03-31 08:03:58 UTC
Embargoed:


Attachments (Terms of Use)

Description Corey Welton 2010-03-30 13:42:49 UTC
Description of problem:
If a user creates a db with a given password, and then enters a random string in the db password field, it is evident that the db password is not validated and something else is used.

Version-Release number of selected component (if applicable):


How reproducible:
Every time

Steps to Reproduce:
1.  Create a db in postgres: 'createdb -h 127.0.0.1 -p 5432 -U postgres -O rhqadmin rhq;'
2.  Unzip rhq archive and launch installer.
3.  On the installer page, enter the value 'asdfasdf' for db password, instead of 'rhq' as referenced above.
4. Click the 'Test Connection button'
5. Continue install.
  
Actual results:

* Connection Test does not fail
* Install continues.

Expected results:

* Connection test should fail and Install should not be able to continue.

Additional info:

Comment 1 Corey Welton 2010-03-30 13:53:23 UTC
Obviously (or not) the above was attempted with postgresql.  It might be good to test this against Oracle too

Comment 2 Heiko W. Rupp 2010-03-30 15:48:27 UTC
Actually this is not a bug in the installer, but in the posgres installation.

In pg_hba.conf when the METHOD is 'trust' all connections are accepted without a password.
In order to force the use of passwords, a method like 'password' or *better* 'md5' needs to be used

# TYPE  DATABASE    USER        CIDR-ADDRESS          METHOD
host    all         all         127.0.0.1/32          md5
host    all         all         172.31.7.0/24          md5

After sig-hupping the pg-server it will require passwords and one can see that "test connection" works correctly.


Note You need to log in before you can comment on or make changes to this bug.