[pve-devel] [PATCH manager/widget-toolkit/access-control 0/3] enforce minimum of 8 characters on new passwords

[pve-devel] [PATCH manager/widget-toolkit/access-control 0/3] enforce minimum of 8 characters on new passwords

[Shannon Sterz]

this series pushes the minimum of 5 characters up to at least 8 for pve.
this puts our password policy in line with NIST's latest recommendation
[1].

[1]: https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver

pve-manager:

Shannon Sterz (1):
  ui: workspace/user view: change password minimum length to 8

 www/manager6/Workspace.js   | 1 +
 www/manager6/dc/UserEdit.js | 2 +-
 www/manager6/dc/UserView.js | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)


proxmox-widget-toolkit:

Shannon Sterz (1):
  password edit: add a minimum length parameter

 src/window/PasswordEdit.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)


pve-access-control:

Shannon Sterz (1):
  api: enforce a minimum length of 8 on new passwords

 src/PVE/API2/AccessControl.pm | 2 +-
 src/PVE/API2/User.pm          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)


Summary over all repositories:
  6 files changed, 12 insertions(+), 4 deletions(-)

--
Generated by git-murpp 0.5.0


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH manager 1/3] ui: workspace/user view: change password minimum length to 8

[Shannon Sterz]

this only impacts new passwords

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 www/manager6/Workspace.js   | 1 +
 www/manager6/dc/UserEdit.js | 2 +-
 www/manager6/dc/UserView.js | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/www/manager6/Workspace.js b/www/manager6/Workspace.js
index 52c66108c..ca451fc3e 100644
--- a/www/manager6/Workspace.js
+++ b/www/manager6/Workspace.js
@@ -383,6 +383,7 @@ Ext.define('PVE.StdWorkspace', {
 					var win = Ext.create('Proxmox.window.PasswordEdit', {
 					    userid: Proxmox.UserName,
 					    confirmCurrentPassword: Proxmox.UserName !== 'root@pam',
+					    minLength: 8,
 					});
 					win.show();
 				    },
diff --git a/www/manager6/dc/UserEdit.js b/www/manager6/dc/UserEdit.js
index ad52edf00..eee8bc2b2 100644
--- a/www/manager6/dc/UserEdit.js
+++ b/www/manager6/dc/UserEdit.js
@@ -36,7 +36,7 @@ Ext.define('PVE.dc.UserEdit', {
 	pwfield = Ext.createWidget('textfield', {
 	    inputType: 'password',
 	    fieldLabel: gettext('Password'),
-	    minLength: 5,
+	    minLength: 8,
 	    name: 'password',
 	    disabled: true,
 	    hidden: true,
diff --git a/www/manager6/dc/UserView.js b/www/manager6/dc/UserView.js
index 12c3e8546..82bd2ee7c 100644
--- a/www/manager6/dc/UserView.js
+++ b/www/manager6/dc/UserView.js
@@ -72,6 +72,7 @@ Ext.define('PVE.dc.UserView', {
 		    userid: rec.data.userid,
 		    confirmCurrentPassword: Proxmox.UserName !== 'root@pam',
 		    autoShow: true,
+		    minLength: 8,
 		    listeners: {
 			destroy: () => reload(),
 		    },
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH widget-toolkit 2/3] password edit: add a minimum length parameter

[Shannon Sterz]

so products can independently specify the minimum length of new
passwords

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/window/PasswordEdit.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/window/PasswordEdit.js b/src/window/PasswordEdit.js
index bc54b8d..e012a0d 100644
--- a/src/window/PasswordEdit.js
+++ b/src/window/PasswordEdit.js
@@ -12,6 +12,10 @@ Ext.define('Proxmox.window.PasswordEdit', {
 	labelWidth: 150,
     },
 
+    // specifies the minimum length of *new* passwords so this can be
+    // adapted by each product as limits are changed there.
+    minLength: 5,
+
     // allow products to opt-in as their API gains support for this.
     confirmCurrentPassword: false,
 
@@ -33,13 +37,15 @@ Ext.define('Proxmox.window.PasswordEdit', {
 	    xtype: 'textfield',
 	    inputType: 'password',
 	    fieldLabel: gettext('New Password'),
-	    minLength: 5,
 	    allowBlank: false,
 	    name: 'password',
 	    listeners: {
 		change: (field) => field.next().validate(),
 		blur: (field) => field.next().validate(),
 	    },
+	    cbind: {
+		minLength: '{minLength}',
+	    },
 	},
 	{
 	    xtype: 'textfield',
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] [PATCH access-control 3/3] api: enforce a minimum length of 8 on new passwords

[Shannon Sterz]

when creating new users or updating existing passwords this new
minimum is enforced which aligns with NIST's latest recommendations
[1].

[1]: https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/PVE/API2/AccessControl.pm | 2 +-
 src/PVE/API2/User.pm          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/PVE/API2/AccessControl.pm b/src/PVE/API2/AccessControl.pm
index c55a7b3..1e6e011 100644
--- a/src/PVE/API2/AccessControl.pm
+++ b/src/PVE/API2/AccessControl.pm
@@ -341,7 +341,7 @@ __PACKAGE__->register_method ({
 	    password => {
 		description => "The new password.",
 		type => 'string',
-		minLength => 5,
+		minLength => 8,
 		maxLength => 64,
 	    },
 	    'confirmation-password' => $PVE::API2::TFA::OPTIONAL_PASSWORD_SCHEMA,
diff --git a/src/PVE/API2/User.pm b/src/PVE/API2/User.pm
index 489d34f..535e58e 100644
--- a/src/PVE/API2/User.pm
+++ b/src/PVE/API2/User.pm
@@ -272,7 +272,7 @@ __PACKAGE__->register_method ({
 		description => "Initial password.",
 		type => 'string',
 		optional => 1,
-		minLength => 5,
+		minLength => 8,
 		maxLength => 64
 	    },
 	    groups => get_standard_option('group-list'),
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel