Can use <space> as a password

[Dhiraj]

Hi Team,

I am not sure about this, but thought of reporting tho!.

warmachine@ftw:~$ uname -a
Linux ftw 4.13.0-39-generic #44~16.04.1-Ubuntu SMP Thu Apr 5 16:43:10 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

However, while creating a user `sudo adduser test` I can keep only <space's> has my password for test user.

Could someone please look into this and advise me for same. I believe password must be robust or only <spaces> should not be allowed.

Thank you
DM

[Seth Arnold (seth-arnold)]

Hello Dhiraj, thanks for the report. The passwd utility assumes root knows best and allows root to set any password to anything no matter how poor.

You can use the pam_cracklib(8) PAM module to enforce some minimum quality levels for your passwords when users set their own -- but of course frustrated users may pick bad passwords this module doesn't know how to discover.

Thanks

[Dhiraj (mishra-dhiraj95)]

Arrgh! I see however can we assign a CVE for this issue, I believe the issue still exists in the environment, I request for a CVE or please advise for same.

Cheers!

[Marc Deslauriers (mdeslaur)]

There is no CVE to assign, as there is no flaw here.

As an administrator, you are requesting that the password be a space, and the system allows it since the administrator knows best. This is expected behaviour. If you don't want the password to be a space, enter an adequate password.