pfSense » pfSense Plus

I would ask why make this change? I think the current warning is sufficient.

I would be okay with forcing a password change on the initial login, but I really would resent not being able to then choose a password of my choice including putting "pfsense" right back in there if I wanted to. And once that initial prompt and forced password change is shown, it should not be shown again even if the user purposefully put "pfsense" right back in there. I create a lot of test VMs in my lab environment and leave them with the default login for simplicity.

I personally really hate this type of mother henning in software. Let me as a user decide how I want to handle passwords in my systems.

Not only are there more and more stories about equipment being compromised due to default passwords and being wide open to the internet (not pfSense primarily, and definitely user error, but partially avoidable either way), there are also legal/regulatory reasons outside of our control.

We could allow someone to change it back to "pfsense" but that could still leave someone vulnerable.

These days with password managers and SSH keys the actual passwords rarely matter much since it's not typed by hand all that often in many cases.

Jim Pingle wrote in #note-2:

Not only are there more and more stories about equipment being compromised due to default passwords and being wide open to the internet (not pfSense primarily, and definitely user error, but partially avoidable either way), there are also legal/regulatory reasons outside of our control.

We could allow someone to change it back to "pfsense" but that could still leave someone vulnerable.

These days with password managers and SSH keys the actual passwords rarely matter much since it's not typed by hand all that often in many cases.

The legal/regulatory angle I understand having worked in the very tightly regulated nuclear power industry for my entire career.

I will get over it <grin>, but it is just a pet peeve of mine when software won't let me do something I consciously want to do for a particular situation or reason. Of course, I would never deploy something to production with a default password still set, much less then leave it open to the Internet. But I get that some folks might do that.

I will go back in my house now, get back in my chair, and continue watching reruns of The Andy Griffith Show. You kids can play on my lawn -- just don't make a mess. LOL!

That build doesn't have all of the final changes, it has to be a build from the 15th or later, which hasn't been successful yet.

Jim Pingle wrote in #note-10:

This is now in and complete.

tl;dr: Passwords are now a little more strict on both Plus and CE. Plus forces password changes if the password is set to default or the username.

Summary of changes:

• Plus/CE: Backend support added for password validation rules which control allowed values for passwords set on user accounts.

• Plus/CE: Most methods of changing the password now also display hints to the user about password requirements.
• Plus/CE: Passwords can no longer be set to the same value as the username
• Plus: Passwords can also not be set to the default value "pfsense"

All the above works as expected ^^^.

• Plus/CE: Setup wizard validates the password before proceeding

• Plus: Setup wizard requires the user to change the password and will not proceed until the password is changed to a valid value.

This is true. But, at the second step, the wizard prompts you to change the password. However, upon completing this step, the wizard doesn't proceed and instead remains on the System/User Password Manager page.

Tested against:

24.03-BETA (amd64)
built on Fri Mar 22 17:08:00 UTC 2024
FreeBSD 15.0-CURRENT

Danilo Zrenjanin wrote in #note-14:

• Plus: Setup wizard requires the user to change the password and will not proceed until the password is changed to a valid value.

This is true. But, at the second step, the wizard prompts you to change the password. However, upon completing this step, the wizard doesn't proceed and instead remains on the System/User Password Manager page.

I can't reproduce that here. I can set a new password and proceed past that screen. Is it displaying an error message of some sort when it won't proceed?

I think I was able to reproduce that issue finally. Starting from a fresh install or factory reset the user was being sent to the password reset page when it should have been continuing through the wizard instead. I committed a fix.

Another inconsistency is that when performing a clean install in the console, you will be prompted to change the default password before the console menu appears. Once you have changed the password, you will see the console menu. The next step is to access the GUI, which will automatically start the wizard. In the final step of the wizard, you will be prompted to change the password again, even if you already did so from the console.

The wizard should check and skip the last step (changing the password) if it's not set to the default value.

Tested against:

24.03-BETA (amd64)
built on Fri Mar 29 6:00:00 UTC 2024
FreeBSD 15.0-CURRENT

Danilo Zrenjanin wrote in #note-17:

Another inconsistency is that when performing a clean install in the console, you will be prompted to change the default password before the console menu appears. Once you have changed the password, you will see the console menu. The next step is to access the GUI, which will automatically start the wizard. In the final step of the wizard, you will be prompted to change the password again, even if you already did so from the console.

The wizard should check and skip the last step (changing the password) if it's not set to the default value.

The wizard has always prompted for changing the password no matter what. Some people like having the option if they are using the wizard again later.

You can skip by it so long as the password is not set to a problematic value.