Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] MySQL and nessus...

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Sergey A Lipnevich <sergeyli AT pisem.net>
  • To: spencero AT mail.utexas.edu
  • Cc: SM-Discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] MySQL and nessus...
  • Date: Mon, 14 Oct 2002 09:41:26 -0400

You're right, that's my crude solution to such problems. The code to generate the password is in BUILD. I'll think of some "Vegas-lights" kind of message, but you're right that it's in the compile log so I believe every local user can get hold of it. Not nice, but better than nothing...

Spencer Ogden wrote:

FWIW I believe the webmin spell does this, set a random pass. Its not too friendly, last time I did it I don't think there was a message saying this is what had been done, and you had to look in the compilation log to see what the password had been set to.

Spencer

On Sunday 13 October 2002 07:18 pm, Dufflebunk wrote:

Set the password initialy to something random, and inform the SA to look
in a file for the password (/root/mysql.pw) or something? Of course the
file would be set root:root and r--------.

On Sun, 2002-10-13 at 20:02, Steven Pinkham wrote:

Hmm.. Not much I can think of off hand. You'd need some sort of logic
to test if this is an original install or not (I suppose checking for
the presence of whatever config file this spell would use, or some
other method), or just explain that it should be done and ask the user
if they would like to add/change the password. You obviously wouldn't
want to cache the input of the password, and you'd have to be careful
with how you handle it because passwords are more likely then other
data to have special characters embedded in them. A message should be
output no matter what. Educating the user is as important as closing
any particular bug. Having the spell prompt for the password as you
suggest would seem to be useful however. Comments?

Steve Pinkham

* Phil The Great <cerise AT deepthought.armory.com> [2002-10-13 19:44]:

Why shouldn't the spell prompt them?

-Phil/CERisE

On Sun, Oct 13, 2002 at 07:27:47PM -0400, Steven Pinkham wrote:

* Spencer Ogden <spencero AT mail.utexas.edu> [2002-10-13 18:10]:

Um... You should set a password? What else?

We should put a message in the POST_INSTALL telling people they
need to do this, if the install itself doesn't make it clear. If
a security step needs to happen and we can't automate it, the
spell should declare to the user what needs to be done. It would
be nice if we had a way to make sure messages are output at the
end of all installs, instead of just the current one. The way it
is now, important messages such as this would probably be missed
if you were installing more then one spell. The quick and easy
but ugly fix for this is to wait forever for some input to verify
that the user received the message.

Steve Pinkham


_______________________________________________
SM-Discuss mailing list
SM-Discuss AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/sm-discuss







Archive powered by MHonArc 2.6.24.

Top of Page