https://bugzilla.novell.com/show_bug.cgi?id=381420 User fnmueller@opensuse.org added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c2 Felix-Nicolai Müller changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fnmueller@opensuse.org --- Comment #2 from Felix-Nicolai Müller 2008-04-19 05:02:56 MST --- I believe sudo is more insecure than using su -c. Especially the Ubuntu way is not very secure as root passwords are stored for a while when using sudo and as the first user needs to put hin his own password to gain root access. It is still more secure than the now existing default behavior where anyone can log in as root. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User coolo@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c4 Stephan Kulow changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |INVALID --- Comment #4 from Stephan Kulow 2008-04-21 13:58:29 MST --- this is not a bug, it's a feature. You can easily disable the checkbox and get a root password dialog, but having to come up with two crappy passwords is in no way more secure than thinking of one hard to crack one. default sudo is by all means less secure. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User fnmueller@opensuse.org added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c6 Felix-Nicolai Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|INVALID | --- Comment #6 from Felix-Nicolai Müller 2008-04-21 14:09:32 MST --- I am therefore reopening this bug. This needs to be thought through imo. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User coolo@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c8 Stephan Kulow changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |casualprogrammer@yahoo.com --- Comment #8 from Stephan Kulow 2008-05-06 13:51:26 MST --- *** Bug 386491 has been marked as a duplicate of this bug. *** https://bugzilla.novell.com/show_bug.cgi?id=386491 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User jw@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c10 Juergen Weigert changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|INVALID | --- Comment #10 from Juergen Weigert 2008-05-15 13:19:19 MST --- I agree with Felix, and doubt that Coolo should get away with a simple 'please trust us' statement. User password is accepted even if it fails basic checks, like 'too short' or 'contains usrname'. I just tested username 'tux', password 'tux' and found that the checkbox remains enabled. Silently suggesting such a password as the root password is a bug. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User coolo@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c12 --- Comment #12 from Stephan Kulow 2008-05-15 13:28:37 MST --- Juergen, you're welcome to subscribe opensuse-factory: http://lists.opensuse.org/opensuse-factory/2008-04/msg00768.html -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c14 --- Comment #14 from Ludwig Nussel 2008-05-16 00:46:55 MST --- Well, such a simple password would be accepted as the root password as well. The message box is just informal. The machine cannot defend against smart people that intentionally choose an insecure configration. The idea (or hope) behind using only one password is that users choose one good password instead of two weak and easier to remember ones. The consensus based on subjective views in a discussion between the security team and coolo was that this configuration is fine. There is no further link between the user accound and root btw. The first user doesn't have move privileges than any other user. If you change either password the other remains untouched. So this new default doesn't affect the multi user capabilities of the system at all. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User coolo@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c16 Stephan Kulow changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |WONTFIX --- Comment #16 from Stephan Kulow 2008-05-16 04:59:52 MST --- ok, after some more discussions with Jiri and Ludwig about #10 the consense is clear: you get 2 to 3 popups on such bad passwords stating you're having a security problem. And we could create 8 more, it wouldn't matter - Jürgen decides to ignore the problem that he creates a security problem. And he ignores the text right below the password prompt too - so I think it's fine closing this as INVALID. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User stbinner@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c18 Stephan Binner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |franz.fuder@ifaz.de --- Comment #18 from Stephan Binner 2008-05-27 01:27:55 MDT --- *** Bug 394576 has been marked as a duplicate of this bug. *** https://bugzilla.novell.com/show_bug.cgi?id=394576 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=381420 User astro06@alice-dsl.de added comment https://bugzilla.novell.com/show_bug.cgi?id=381420#c20 Carsten Lohse changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |astro06@alice-dsl.de --- Comment #20 from Carsten Lohse 2008-10-21 00:21:01 MDT --- Is disabling this "feature not bug" still being considered? Please kick that completely, for having the same user- and root-password is a vulnerability. If someone really depends on that, he / she can still set it as pleased, there is no need for having this as a setting whose weakest default is enabled. Cruising in several forums I notice that especially n00bs *are* using the same pw, since they think it is okay - which it is definitely not. Also I can't see a single advantage of this setting. And um... don't even think about that 'sudo'-thingy. Please. :D -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.