#3554 user password
My operating system is ubuntu 9.04, webmin version is 1.490 And my browser is firefox 3.5.2.
I have found what I think is my first ever problem with webmin. Log in as an administrator and goto System > Users and Groups > Create a new user, password. There are 4 options and I will just deal with two of them, ‘Normal password’ and ‘Pre-encrypted password’.
From there titles you would EXPECT that if you entered a password in the Normal password field and saved, then what you entered is what you would see and if you entered a password in the ‘Pre-encrypted password’ then the password you entered would be encrypted after saving.
But what happens is entirely different if you only enter a password in the ‘Pre-encrypted password’ field and save then NO password is applied to the user. If you enter a password in the ‘Normal password’ field then the password you entered is encrypted and displayed (in its encrypted form) in the ‘Pre-encrypted password’ field after saving and the password you entered works.
For example
lets say you entered abc123 as your password in the ‘Normal password’ field. The password displayed in the ‘Pre-encrypted password’ field after saving would be ygxfds (not the actual encrypted password). When the user logs in the password they use to log in successfully is the abc123.
Now lets say for a different user you enter abc123 in the ‘Pre-encrypted password’ field after saving the user password is no password. So for this user to log in they enter there username and leave the password field blank and they gain access.
I am fairly sure this is not what was intended. So I am bringing it to your attention.
Actually, the way it is supposed to work is like this :
1) You can either enter a plain-text password in the "Normal password" field, which will then be encrypted when saved. This is what you want 99% of the time.
2) If you want to create a user whose password is already encrypted (perhaps because it was copied from another systrem), you enter it in the "Pre-encrypted password" field.
Either way, when you edit a user, you can only ever see the encrypted password.
Does that help?