bugGNU Health - Bugs: bug #52020, Missing bcrypt dependency in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #52020: Missing bcrypt dependency in gnuhealth-setup

Submitted by:  Luis Falcon <meanmicio>
Submitted on:  Thu 14 Sep 2017 04:07:22 PM UTC  
 
Category: SecuritySeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Luis Falcon <meanmicio>
Open/Closed: ClosedRelease: 3.2.0
Module: gnuhealth-setup

Thu 14 Sep 2017 04:15:30 PM UTC, comment #1:

Fixed on changeset 2765:a7f3aa138162

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Thu 14 Sep 2017 04:07:22 PM UTC, original submission:

Mathias Behrle noticed that the standard installation for GNU Health (gnuhealth-setup), is missing the bcrypt package.

Although Tryton fallbacks to SHA1 algorithm for hashing the passwords if it does not find bcrypt, we recommend to use Bcrypt.

Bcrypt is a "slow" hash algorithm, thus, makes it harder (from the time point of view) to brute force attacks, and the penalty from the login user is not noticeable (specially across the network).

We will release a new version for gnuhealth-setup (3.2.1), which will include bcrypt in the dependency list.

In the meantime, just install the bcrypt package manually with the gnuhealth user

gnuhealth $ pip3 install --user bcrypt

Don't forget to restart (no need to update) the Tryton server.

PS: This applies just to the standard / vanilla GNU Health distribution. Those installations that use pypi packages have already the dependency in place.

Bests
Luis

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by meanmicio (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 14 Sep 2017 04:15:30 PM UTCmeanmicioStatusConfirmed=>Fixed
      Open/ClosedOpen=>Closed
      ReleaseNone=>3.2.0

    Back to the top


    Powered by Savane 3.1-cleanup1