Bug#117707: [Pkg-shadow-devel] Bug#117707: md5 passwd considered harmless

[Martin Quinson]

--/Zw+/jwnNHcBRYYu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

I just found #93156 (md5 default (was Re: Security trough paranoia)).

It was closed by Karl Ramm (kcr@debian.org) on Aug 22 2003 with the message:
| md5 passwords are now the default in the passwd package, so this is done;=
 I
| should've noticed this and closed it in the changelog.

So, this is another argument of doing the change in the template so that md5
passwd actually get the default setting :)


Argh! Argh! triple argh! The passwd.config reads:
#       db_get passwd/md5
#       if [ "$RET" =3D true ]; then
                USE_MD5=3D1
#       else
#               USE_MD5=3D''
#       fi
and another commented occurence of db_get passwd/md5.
				=09
This seems to be related to this changelog entry:
 shadow (1:4.0.3-19) unstable; urgency=3Dlow

  * "No really, assume md5 passwords". Closes: #223664

So, this template is not used anyway! Sigh. Should we drop the debconf
template or try to re-enable this (for example with low priority, and "true"
as default)? I tend for the second case.

Opinions? Mt.

On Mon, May 09, 2005 at 10:26:34AM +0200, Martin Quinson wrote:
> package passwd
> retitle 117707 [MARTIN] md5 passwd should be enabled by default
> thanks
>=20
> Hello,
>=20
> back in 2001, the bug submitter asked for the default settings of md5 and
> shadow on passwd to be set to "true". It looks like that the defaults are
> always the following:
>   md5->false
>   passwd->true
>=20
> Back in these days, it was said that the first setting was set that was f=
or
> compatibility with old systems. Rumor about parts of debian not working w=
ith
> md5 passwords also occur from time to time.
>=20
>=20
> My opinion is to change md5 to true. The template reads:
>  Md5 passwords are more secure and allow for passwords longer than 8
>  characters to be used. However, they can cause compatibility problems if
>  you are using NIS or sharing password files with older systems.
> so I think we don't even have to change this, it's already clear enough.
>=20
> If it breaks some other package, it's more than time to update the given
> package! Of course, I don't advice doing so for sarge, but for etch >:-)
>=20
>=20
> May I proceed or do someone speak against it?
> Mt.



--/Zw+/jwnNHcBRYYu
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFCfznQIiC/MeFF8zQRAjEQAJwNg6+MASonmKK8chuMDoFgYrdFowCgyLkG
+ZoynQRRX3B6eHmRroXTfcQ=
=w78d
-----END PGP SIGNATURE-----

--/Zw+/jwnNHcBRYYu--