Weak password module is e-mailing passwords

I saw something about this before but it finally clicked (I couldn't figure out why people said they were getting email send when the module does not send email).

the freepbx-cron-schedule.php, which does things like send out the notification for updates, also sends out any notification that is marked as a security notification. This leads to some questions:

• Are you getting the email resent every night, or just once?
• Should we send Security Notifications?
• If yes to the above, then should the weak password be tagged as a different type of notification then security?

My opinion is that it should be a security warning that is emailed once, though, I could see how emailing the details of the issue (e.g. the passwords that are insecure) could be problematic as in a worse security situation. The current mechanism just sends all the details in the notification. The original intent was to send a warning if we saw some security issues but didn't expect that the very notification would have sensitive information in its content.

So ... feedback?

Thanks Philippe,

I have only received it the one time. It is not being sent each night. I think you should send security notifications, but weak passwords is a challenge. I think it is fair, even a neat feature for the PBX to send a notice about passwords being weak. Just don't include the password. I also had that module flag one of my passwords as weak for having double letters in an otherwise very complex password. It flagged it as weak but it wasn't.

It did send it via regular e-mail. That question was asked in the forums.

John,

well the dillema is this, the mechanism sends any update that is a security warning, if it is posted in the notification box, that exact message is sent. We could make it another type, or we could do the 'much harder' thing of modifying the notification mechanism to add a tag of whether or not the message should be sent. The latter case is much more work effecting many more places and is thus less likely to occur.

As far as the complex password that it flagged as bad, if you could file a separate bug on that, giving the password (well an equivalent one that you don't plan on using) that is creating the error, that would be helpful and we can look at the regex that is deciding that is bad. (Or better yet, if you want to have a look at the code and propose a patch, that will also be well received...)

Philippe,

Could the weak password module be modified to not include the weak password anywhere? That way, the notification would appear on the screen, but the password would not. That should also eliminate it from the security e-mail.

I am not terribly familiar with FreePBX code and its layout, but I will take a look a the weak password module and see if I see a workaround. It won't happen until tomorrow, however.

Jmullinix,

sure it could be removed and then would not appear in the notification. However, I don't like that solution. I think it is very useful to be put in the dashboard notification and not require you to go to the module page to see the weak passwords. Of course that creates another dilema. We probably want that message to contain the weakpassword info while the email not to but still be sent telling you that you have an issue.

I guess another argument could be made that, if you have weak passwords and it is emailed to you, then you probably want to fix the issue quickly thus the email does not matter so much (as it is, a lot of sites will email you a forgotten password if you ask, though that is not the most secure as well). If it turns out that the weak password is from a carrier out of your control, and you care (since you are running the module) then it would be further motivation to get the carrier to get a decent password or find service elsewhere...?

I'm of the opinion that knowing what the weak password is doesn't provide any benefit. If the module explains what is wrong with the password (ie; Extension: 555 => Secret less than 6 digits), that is enough information to know that you need to set a new password.

cards1007,

I think you put the right perspective on it. Nothing like a simply solution. If one of the devs out there feels like modifying this to do that or someone wants to submit the patch file, I'll be happy to make the change and get it in.

done in r7968

(In [7969]) Merged revisions 7967-7968 via svnmerge from http://svn.freepbx.org/modules/branches/2.5

........

r7967 | jjshoe | 2009-08-03 12:19:34 -0700 (Mon, 03 Aug 2009) | 2 lines

fixes #3611, fixes #3435, fixes #3317, fixes #3307 Fixed pattern matching to prevent deadly parked call loop

........

r7968 | jjshoe | 2009-08-03 12:28:18 -0700 (Mon, 03 Aug 2009) | 4 lines

fixes #3735 Don't send the actual secret in the email

Also warn if a secret is blank.

........