Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] MySQL and nessus...

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Dufflebunk <dufflebunk AT dufflebunk.homeip.net>
  • To: Steven Pinkham <sepinkham AT attbi.com>
  • Cc: Phil The Great <cerise AT deepthought.armory.com>, SM-Discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] MySQL and nessus...
  • Date: 13 Oct 2002 20:18:07 -0400

Set the password initialy to something random, and inform the SA to look
in a file for the password (/root/mysql.pw) or something? Of course the
file would be set root:root and r--------.

On Sun, 2002-10-13 at 20:02, Steven Pinkham wrote:
> Hmm.. Not much I can think of off hand. You'd need some sort of logic to
> test if this is an original install or not (I suppose checking for the
> presence of whatever config file this spell would use, or some other
> method), or just explain that it should be done and ask the user if they
> would like to add/change the password. You obviously wouldn't want to
> cache the input of the password, and you'd have to be careful with how you
> handle it because passwords are more likely then other data to have special
> characters embedded in them.
> A message should be output no matter what. Educating the user is as
> important as closing any particular bug. Having the spell prompt for the
> password as you suggest would seem to be useful however. Comments?
>
> Steve Pinkham
> * Phil The Great <cerise AT deepthought.armory.com> [2002-10-13 19:44]:
> > Why shouldn't the spell prompt them?
> >
> > -Phil/CERisE
> >
> > On Sun, Oct 13, 2002 at 07:27:47PM -0400, Steven Pinkham wrote:
> > > * Spencer Ogden <spencero AT mail.utexas.edu> [2002-10-13 18:10]:
> > > > Um... You should set a password? What else?
> > > >
> > >
> > > We should put a message in the POST_INSTALL telling people they need to
> > > do this, if the install itself doesn't make it clear. If a security
> > > step needs to happen and we can't automate it, the spell should declare
> > > to the user what needs to be done.
> > > It would be nice if we had a way to make sure messages are output at
> > > the end of all installs, instead of just the current one. The way it
> > > is now, important messages such as this would probably be missed if you
> > > were installing more then one spell. The quick and easy but ugly fix
> > > for this is to wait forever for some input to verify that the user
> > > received the message.
> > >
> > > Steve Pinkham
> >
> >
--


Quidquid latine dictum sit, altum sonatur.
-----------------
PGP public key at
http://wwwkeys.pgp.net:11371/pks/lookup?op=get&search=0x3327A9A5
F1

Attachment: signature.asc
Description: This is a digitally signed message part




Archive powered by MHonArc 2.6.24.

Top of Page