Topic: password problem (waiting for bugtracker password)

[KDB9000]

I checked my password strength to none and I have checked it and it is set to none. Yes i know the dangerous of setting it to none so please skip on telling me it isn't safe. That side, after I changed it to none and tried to change the password, it still acts like it is set to strong. Even after a restart and/or the use of the reconfigure button. I have checked it and it says that Users is set to none. I have looked and wasn't able to find a simlar problem and I am waiting for my password for the bugtracker so I can't post in there. Anyone have any ideas on how to fix this? (yes I want it set to normal or none)

[raem]

KDB9000

Unless there really is a bug, then you must have done something wrong eg check case & spelling carefully.

Here are the details
config setprop passwordstrength Admin normal
config setprop passwordstrength Users normal
config setprop passwordstrength Ibays normal
signal-event post-upgrade
signal-event reboot

It is also possible, but strongly discouraged, to disable password strength checking:

config setprop passwordstrength Admin none
config setprop passwordstrength Users none
config setprop passwordstrength Ibays none
signal-event post-upgrade
signal-event reboot

config show passwordstrength

passwordstrength=configuration
    Admin=strong
    Ibays=normal
    Users=normal

Choices are:

strong
normal
none

[KDB9000]

Took a while but I got it to work. Thank you.

[del]

Hi KDB9000,

Took a while but I got it to work. Thank you.

How did you get it to work I have tried on both a test server and my real server and it still gives me the same old messsage no matter what I set the password strength to  Even rebooting does nothing (except stop my asterisk server working, but that's another post ) Any help would be appreciated.

Regards,
Del

[KDB9000]

Del:

I can't explain how it started worked. After I added some RPMs from Dungog and had it reconfigure and got the panels to show up, it just started working. I would try installing some RPM panels or some RPMs and then let it restart and reconfigure. I was having trouble with Yum installing RPMs but after Yum started to work right in the web interface, then password stuff started working. The stuff they told me to do is what you should do and it needs to be done in the command level. All I can say is keep trying it and sooner or later it should work. And try installing an RPM with the Yum web interface. Good Luck.

BTW, where do you get Asterisk for SME? Dungog talks about it but i didn't see the RPM (in the free or in the members area).

[byte]

How did you get it to work I have tried on both a test server and my real server and it still gives me the same old messsage no matter what I set the password strength to  Even rebooting does nothing (except stop my asterisk server working, but that's another post ) Any help would be appreciated.

I have always just used...

configuration setprop passwordstrength Users normal

I have never found need to reboot server for this to take effect. These are always on clean installs.

[del]

Hi All,

Byte

I have always just used...

configuration setprop passwordstrength Users normal

I have never found need to reboot server for this to take effect. These are always on clean installs.

I have just tried on a clean install, same again, still complains about 7 digits, upper, lower case etc. so I am not sure what I am doing wrong.

KDB9000

BTW, where do you get Asterisk for SME? Dungog talks about it but i didn't see the RPM (in the free or in the members area).

Have a look herehttp://www.selintra.com/docs/cgi-bin/view/Main/DocChapter03

Simple to install and the sail panel makes it easy to configure, only problem I had was with my VoIP incoming number, there seems to be a lack of good ones here in the US:wink:  You may get a better choice where you are from (assuming it isn't the US) Good Luck. Thankks for your input, I will try the things you mentioned.

Regards,
Del

[raem]

byte & del

> I have always just used...
> configuration setprop passwordstrength Users normal

The command IS NOT
configuration setprop xxxx xxxxx xxxxx
IT IS
config setprop passwordstrength Users normal

the actual command is
/sbin/e-smith/db

This has been linked with a shortcut in sme7 to be
db

Type either of those and you will get the usage syntax parameters

You can then add the actual database that you want to run the db command on and the parameters
eg
db configuration setprop passwordstrength Admin none
db configuration setprop passwordstrength Users none
db configuration setprop passwordstrength Ibays none

sme7 has a further shortcut specifically for the configuration database as this one gets used a lot
config xxx xxx xxx xxx
which replaces
db configuration xxx xxx xxx xxx
eg
config setprop passwordstrength Admin none
config setprop passwordstrength Users none
config setprop passwordstrength Ibays none


> I have never found need to reboot server for this to take effect. These > are always on clean installs.

There is usually some system event that needs to run to bring into effect the changes, and in doing so the templates will apply the database details  and ultimately modify the config file for that service.
It may be modifying a user or a ibay
eg /etc/e-smith/events/ibay-modify
or
/etc/e-smith/events/user-modify
and perhaps you have inadvertantly also made a change like that, which caused the passwordstrength changes to become effective.

The
signal-event post-upgrade
signal-event reboot
is really the big guns approach, which will for sure will run all system events & routines that will bring into effect any change that has been made.
If you don't specifically know which event to run, then running the post-upgrade and reboot will achieve the end result.

Note that a reboot on its own will not usually achieve the same effect as the templates do not get expanded (which the post-upgrade will do).

[del]

Hi Ray,

I'm sorry, but I must be missing something here
I did this:
config setprop passwordstrength Users normal
/sbin/e-smith/signal-event post-upgrade
/sbin/e-smith/signal-event reboot

But it still complains about the seven digits etc.

If I do this:
passwordstrength=configuration
I get this:
    Admin=strong
    Ibays=strong
    Users=normal
Just can't figure it out

Regards,
Del

[raem]

del

> configuration setprop passwordstrength Users normal
> ...still complains about 7 digits, upper, lower case etc.

I think your issue is with the strength setting, do this instead

config setprop passwordstrength Users none

It doesn't mean no password, it just means no password strength checking, so you can enter any (weak) password you want to.

I tried that exact command just now and it does work, it will allow a simple password to be set.
I also just ran that command and then reset the password for a user and no other configuration commands were needed (no post-ugrade, reboot etc), so the processes must just read that db setting "on the fly".

[raem]

del & others

re passwordstrength setting possibilities

From https://sourceforge.net/tracker/?func=detail&atid=615772&&aid=1228269&group_id=96750

The strong setting means the new password is passed through cryptlib.  The normal setting does some checks as per the error messages re upper case, lower case, number, non alpha & 7 char.
The none setting checks nothing and allows any password.


Everyone is really far better off to have at least the "normal" password strength setting. To have a lesser strength is only opening your server to easy hacking.

From the sme7 FAQ

Password Strength

Users are complaining the password strength checking is too strong. How do I change it?
First a warning - Far too many systems out there have weak passwords and they will be broken into. Educating your users on the necessity of strong passwords is the best option. If that fails, here is how you change the password strength checking from 'strong' to 'normal', which was the setting in previous versions of SME. Be careful to use the exact capitalization.

config setprop passwordstrength Users normal
config setprop passwordstrength Ibays normal

It is also possible, but strongly discouraged, to disable password strength checking:

config setprop passwordstrength Users none
config setprop passwordstrength Ibays none

[raem]

del & others

See also this bug for background re strong & normal settings

http://bugs.contribs.org/show_bug.cgi?id=161

To quote a little of it:

passwordstrength=configuration
    Admin=strong
    Ibays=strong
    Users=strong
Tested a few password, all indication are that passwords must meet both
Cracklib and the standard password mantra: Upper Case AND Lower Case AND Digits AND Special characters AND at least seven characters long

'none' always passes.
Anything else must pass our standard mantra
'strong' must also pass Cracklib

e-smith-formmagick:
* Thu Dec 15 2005 Gordon Rowell <gordonr@gormand.com.au> 1.3.2-03
- 'strong' passwords must meet both Cracklib and the standard password
   mantra: Upper Case AND Lower Case AND Digits AND Special characters
   AND at least seven characters long [SME: 161]

[del]

Hi Ray,

Thanks, that worked
I did think that none would mean that the user wouldn't need a password at all  But now that you explained that none means no checking I understand where it is coming from. IMO the silly thing about all this is I didn't need a "strong" password for admin when I installed SME 7 on my test server, it suggested I changed it but I got the option to say no
Well I'm happy now thanks to you.

Regards,
Del

[byte]

byte & del

> I have always just used...
> configuration setprop passwordstrength Users normal

The command IS NOT
configuration setprop xxxx xxxxx xxxxx
IT IS
config setprop passwordstrength Users normal

the actual command is
/sbin/e-smith/db

This has been linked with a shortcut in sme7 to be
db

Type either of those and you will get the usage syntax parameters

You can then add the actual database that you want to run the db command on and the parameters
eg
db configuration setprop passwordstrength Admin none
db configuration setprop passwordstrength Users none
db configuration setprop passwordstrength Ibays none

Whoops my had a typo

[raem]

byte

> Whoops my had a typo

I guessed that may have been the case, but I spelt it out clearly for the benefit of others.