facebookarchive/fbctf

Don't Set MySQL Root Password

Open

#155 opened on Jun 29, 2016

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Hack (1,302 forks)auto 404
hacktoberfestplatformprovisioning

Repository metrics

Stars
 (6,553 stars)
PR merge metrics
 (PR metrics pending)

Description

When doing the configuration for production, the setup script sets the MYSQL Password and the 'ctf' user password.

The 'ctf' user by default has the password 'ctf', as well, which might be insecure.

Ideally, these credentials should be generated randomly and given to the setup to be used.

Contributor guide

Research direction
Examine the setup script (likely deploy/ or setup.sh) to identify where the MySQL root password and ctf user password are set, and implement random generation using a tool like openssl rand or equivalent. Ensure the random passwords are stored securely or output to the user.
Tech stack
php
Domain
backend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
MySQLBash
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80