[GitHub] [cloudstack] weizhouapache commented on issue #6861: VM Password reset - Unable to set Password Complexity requirement for Special Characters

["weizhouapache (via GitHub)" <gi...@apache.org>]

weizhouapache commented on issue #6861:
URL: https://github.com/apache/cloudstack/issues/6861#issuecomment-1412535235

   > ACS's generated passwords are shown in the management server logs, they are also stored in plaintext on the database, in the `job_result` column of the `async_job` table; therefore, it is not a good practice to allow your users to keep these generated passwords, even if they are "strong" passwords. They (the passwords) are also stored in the VR in plain text, in the /var/cache/processed directory, in files with the pattern `vm_password.json.*`. Therefore, these passwords will always be subject to leak due to internal attacks (e.g. an admin that has access to the cloud infra)
   
   @JoaoJandre that's right. 
   However, we cannot manage the password policy in guest os (virtual machines).
   
   What cloudstack can manage are
   (1) the initial random password for new vms
   (2) the new random password when reset vm password and new password is not passed.
   (3) the user-defined new password when reset vm password
   
   @Pavan-Nambi 's PR #7134 seems to address (1) and (2), which is good.
   The PR can be improved to address (3) as well.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org