Re: How to require stronger passwords for Roundup (1.5.1)

Georg Lehner <[email protected]> writes:

> On 27/01/17 15:21, Hancock, David (DHANCOCK) wrote:
>> Our Roundup users are currently logging in twice to get to the
>> tracker: once to an internal “wrapper” system with reasonable
>> requirements for password complexity, then a second time to Roundup
>> itself. I’d like to remove the wrapper requirement; it’s confusing
>> to users. But to do so I need to ensure a minimum level of
>> complexity for passwords. (Nothing too sophisticated, minimum length
>> of 10, at least one number or special character required.)
>>
> ...
>
> Have you thought about doing it the other way 'round?
>
> If the wrapper system forwards HTTP Basic Authentication Tokens,
> Roundup can use them directly for login.

This is what I do for other web services
(I'm not using roundup in production yet).

If you do this, strongly recommend something like (from apache2)

    AuthBasicFake "%{REMOTE_USER}" "<pre-shared key between apache and roundup>"

Since roundup is just trusting REMOTE_USER,
it doesn't need the user's real password,
and this means a compromised roundup can't see it.


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users