[pkg-bacula-devel] [pkg-bacula-commits] [SCM] Bacula, a network backup, recovery and verification program branch, master, updated. debian/5.2.6+dfsg-2-3-ga406ac4

[Luca Capello]

Hi there!

On Tue, 03 Jul 2012 11:15:33 -0600, Alexander Golovko wrote:
> The following commit has been merged in the master branch:
> commit a406ac4efc3f09c5a0255e53cd84bad1263826ba
> Author: Alexander Golovko <alexandro at ankalagon.ru>
> Date:   Tue Jul 3 18:09:08 2012 +0400
>
>     fix bad bacula-director passwords in old packages
>     
>     Squeeze packages shipped with bad non-unique passwords.
>     We must force password changing for prevent unauthorized access to
>     bacula-director service.
[...]
> +check_and_fix_unsafe_director_password()
> +{
> +  local PACKAGE REGEX
> +
> +  PACKAGE="$1"
> +
> +  #
> +  # There is a list of hardcoded bacula-dir passwords we need to change.
> +  # It is a passwords from versions 5.0.2-1, 5.0.2-1~bpo50+1, 5.0.2-2,
> +  # 5.0.2-2.1, 5.0.2-2.2, 5.0.2-2.2+b1, 5.0.2-3, 5.0.3-1, 5.0.3-1+b1,
> +  # 5.0.3+dfsg-0.1

I still do not get this, sorry.  Maybe it is just because here at
DebConf12 I do not get so much sleep lately, but I tested at least twice
and in no cases the passwords for bacula-dir were hardcoded:

  <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602191#41>

=====
(base-squeeze)root at gismo:/# apt-get install bacula-server
[...]
(base-squeeze)root at gismo:/# dpkg-query -W bacula-\*
bacula-common   5.0.2-2.2+b1
bacula-common-mysql
bacula-common-pgsql
bacula-common-sqlite3   5.0.2-2.2+b1
bacula-director
bacula-director-common  5.0.2-2.2+b1
bacula-director-sqlite3 5.0.2-2.2+b1
bacula-doc
bacula-fd
bacula-sd       5.0.2-2.2+b1
bacula-sd-sqlite3       5.0.2-2.2+b1
bacula-sd-tools
bacula-server   5.0.2-2.2
(base-squeeze)root at gismo:/# grep Password
/usr/share/bacula-common/common-functions 
genRandomPassword()
readOrCreatePasswords()
        DIRPASSWD=`genRandomPassword`
        DIRMPASSWD=`genRandomPassword`
        SDPASSWD=`genRandomPassword`
        SDMPASSWD=`genRandomPassword`
        FDPASSWD=`genRandomPassword`
        FDMPASSWD=`genRandomPassword`
(base-squeeze)root at gismo:/#
=====

Can you elaborate where the real problem is?

> --- /dev/null
> +++ b/debian/po/templates.pot

With this you will get the debian-i18n people very angry, especially at
this point in the release cycle ;-)

Thx, bye,
Gismo / Luca
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 835 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-bacula-devel/attachments/20120703/87ef8ff9/attachment.pgp>