Bug 52052 – univention-heimdal/check_cracklib.py doesn't support checking if password contains user/displayname

Bug 52052 - univention-heimdal/check_cracklib.py doesn't support checking if password contains user/displayname


Summary:	univention-heimdal/check_cracklib.py doesn't support checking if password con...

Status:	VERIFIED DUPLICATE of bug 52061

Product:	UCS
Classification:	Unclassified
Component:	Kerberos
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:	51994
Blocks:
	Show dependency tree / graph

Reported:	2020-09-17 19:41 CEST by Arvid Requate
Modified:	2021-01-27 15:06 CET (History)
CC List:	3 users (show)

See Also:
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2020-09-17 19:41:41 CEST

/usr/share/univention-heimdal/check_cracklib.py from univention-heimdal passes the  principalName to univention.password.Check. With the change from Bug #51994 and with a UCR variable setting of password/quality/mspolicy of 'true' or 'sufficient' this only checks if full principalName is part of the new password (case insensitive check).

It should pass username and displayName instead, because that's what should not be part of the password according to the MS standard password complexity criteria.

Currently this only affects domains without Samba/AD, because only univention-heimdal-kdc configures the Debian heimdal-kdc to call this script (if UCR variable kerberos/password/quality/check is active, which is the default).

Comment 1 Arvid Requate

2020-10-08 19:40:09 CEST


*** This bug has been marked as a duplicate of bug 52061 ***