fyi -
As I see it, we are discussing two different issues:
1) generating an admin password rather than having a default, and
2) the security of the admin password
For now, you increase the security of WebWare by an order of magnitude if
you only address (1). No argument that the password storage model needs
work, but to simply ensure that an attacker doesn't *by default* know
your admin password is fundamental.
You could query for a password, but I think Chuck wants to stay away
from an interactive install script, where replies are required.
As to the ease of memorizing the password, tell the user at install time
where it's located so he/she can change it. Who cares if it's easy to
remember? If the user doesn't like the generated password, they will
make one they do like.
I've had trouble using some printable characters in passwords, esp "#"
and "%", so I prefer not to use them in generation schemes.
Here's a quick-and-dirty password generator that will give you a mixed-case,
semi-pronounceable (consonant followed by vowel) word every time,
beginning with a digit, ending with a non-alphanumeric:
========begin==========
#!/usr/bin/python
from whrandom import randrange
def randCase(ltr):
import string
if randrange(0,99999999) % 2 == 0:
return ltr
else:
return(string.upper(ltr))
def randCH(chTbl=["a", "b", "c"]):
import re
n = len(chTbl)
v = chTbl[randrange(0,99999999) % n ]
if re.match(r'[a-zA-Z]+$',v):
return randCase(v)
else:
return v
def legPW(pwLen=8):
vTbl=["a", "e", "i", "o", "u"]
cTbl=["b", "c", "d", "f", "g", "h", "j", "k", "l",
"m", "n", "p", "q", "r" "s", "t", "v", "x", "z"]
xTbl=["!", "@", "$", "*", "(", ")", "+", "'", "~", "^"]
i = 1
# res=""
res="%i" % randrange(0,9)
i = i + 1
while i:
if i == pwLen:
break
res=res+randCH(vTbl)
i = i + 1
if i == pwLen:
break
res=res+randCH(cTbl)
i = i + 1
if i == pwLen:
break
res=res+randCH(xTbl)
return res
print legPW()
========begin==========
Next thing to do is to disallow access to the admin page from a
specific address after x failed attempts.
--
fdj
|