GNU Health - Bugs: bug #52020, Missing bcrypt dependency in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #52020: Missing bcrypt dependency in gnuhealth-setup
Submitter: | Luis Falcon <meanmicio> | ||
Submitted: | Thu 14 Sep 2017 04:07:22 PM UTC | ||
Category: | Security | Severity: | 3 - Normal |
Item Group: | None | Status: | Fixed |
Privacy: | Public | Assigned to: | meanmicio |
Open/Closed: | Closed | Release: | 3.2.0 |
Module: | gnuhealth-setup | Component: | None |
Thu 14 Sep 2017 04:15:30 PM UTC, comment #1: |
Luis Falcon <meanmicio>![]() ![]() |
Thu 14 Sep 2017 04:07:22 PM UTC, original submission:
Mathias Behrle noticed that the standard installation for GNU Health (gnuhealth-setup), is missing the bcrypt package.
Although Tryton fallbacks to SHA1 algorithm for hashing the passwords if it does not find bcrypt, we recommend to use Bcrypt.
Bcrypt is a "slow" hash algorithm, thus, makes it harder (from the time point of view) to brute force attacks, and the penalty from the login user is not noticeable (specially across the network).
We will release a new version for gnuhealth-setup (3.2.1), which will include bcrypt in the dependency list.
In the meantime, just install the bcrypt package manually with the gnuhealth user
gnuhealth $ pip3 install --user bcrypt
Don't forget to restart (no need to update) the Tryton server.
PS: This applies just to the standard / vanilla GNU Health distribution. Those installations that use pypi packages have already the dependency in place.
Bests
|
Luis Falcon <meanmicio>![]() ![]() |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2017-09-14 | meanmicio | Status | Confirmed | ![]() |
Fixed |
Open/Closed | Open | ![]() |
Closed | ||
Release | None | ![]() |
3.2.0 |
Fixed on changeset 2765:a7f3aa138162