[Mailman-Users] Can I enforce secure admin passwords?

[Mark Sapiro]

Stephen J. Turnbull wrote:
>
>I think the passwords are also stored in
>clear on the server (those of the list members are, since they appear
>in monthly reminders) but I could be wrong about that.


In Mailman 2.x, user passwords are stored in the clear, but list admin
and moderator and site passwords are stored encrypted. In Mailman 3,
all passwords will be stored as encrypted values and reminders will go
away. There will be an on demand reset mechanism for user passwords.


>It would be easy to add checks, I suppose, but you'd have to decide
>what checks you want.  I don't think it would be much more difficult
>to add the concept of a user-supplied checker.  Dealing with the link
>and storage security issues would be more complex.  You'll have to
>wait for Mark to speak up to find out if there are any plans in 2.2.


There is no plan to change the way passwords are stored for Mailman
2.2. It is not difficult to secure communications, i.e. to make
Mailman generated URLs be https and to redirect http to https in the
web server.

Adding a hook to a user supplied password checker could be done in 2.2.
I'll take a look at this idea. How about a default checker that just
checks for minimum length defined in Defaults.py/mm_cfg.py, but
overridable by the site. or maybe an mm_cfg.CheckPassword() function
defined in Defaults.py as

def CheckPassword(pwd):
    if len(pwd) > 0:
        return True
    else:
        return False

Then the site can redefine this in mm_cfg.py to do anything they want.

I think this should probably apply only to list and site passwords in
MM 2.2.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan