GNOME Bugzilla – Bug 676396
users: Optionally use libpwquality for password handling
Last modified: 2012-05-23 14:44:46 UTC
Using a library for password generation and quality checking has the obvious benefit that we can have centralized policy for password quality.
Created attachment 214462 [details] [review] users: Optionally use libpwquality for password handling
Created attachment 214463 [details] [review] users: Pass more information to password checker Passing the username and the old password allows the password quality check find more bad passwords. Also, add a way to provide more information about what is bad about a password.
The patch here applies on top of bug 633601
*** Bug 676392 has been marked as a duplicate of this bug. ***
*** Bug 676393 has been marked as a duplicate of this bug. ***
*** Bug 676394 has been marked as a duplicate of this bug. ***
*** Bug 676395 has been marked as a duplicate of this bug. ***
I've sent a patch to tmraz btw - the next release of libpwquality will include a pc file
Review of attachment 214462 [details] [review]: Looks good. Any reason why we can't make it a hard requirement though?
Review of attachment 214463 [details] [review]: Looks good.
Is there any tarball directory? https://fedorahosted.org/libpwquality/ seems to only provide a Mercurial repository.
(In reply to comment #9) > Review of attachment 214462 [details] [review]: > > Looks good. Any reason why we can't make it a hard requirement though? We could, but libpwquality is a fairly new project, and looks like a fedora-only thing so far, and the security guys are not really good at selling their stuff, unfortunately. Making it initially optional will reduce the transition pain a bit.
(In reply to comment #11) > Is there any tarball directory? https://fedorahosted.org/libpwquality/ seems to > only provide a Mercurial repository. https://fedorahosted.org/releases/l/i/libpwquality/ seems to have tarballs
libpwquality is in jhbuild now, waiting on updated patch, and mail to d-d-l.
Created attachment 214758 [details] [review] separate out password handling
Created attachment 214759 [details] [review] use libpwquality
Created attachment 214760 [details] [review] pass more information to password checker
Review of attachment 214758 [details] [review]: .
Review of attachment 214759 [details] [review]: configure.ac only has some whitespace changes.
Review of attachment 214760 [details] [review]: .
Also mention that apg isn't required anymore, for the libpwquality patch.
Thanks, pushed with those changes