Strengthen generateRandomString - #25
Conversation
|
Skipping CI for Draft Pull Request. |
|
/test all |
|
@lpiwowar: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Configure PostgreSQL to log all successful client connections (log_connectsions = on) and all events related to disconnections of the client (log_disconnections = on).
Previously, generateRandomString used crypto/rand bytes encoded with hex.EncodeToString, so every character in the output was limited to the 16 hex digits. This gave only 4 bits of entropy per character, making the generated passwords significantly weaker than their length would suggest. Replace hex encoding with an alphanumeric charset (a-z, A-Z, 0-9), which provides 62 possible values per character, enforce a minimum length of 16 characters, and guarantee that every generated password contains at least one lowercase letter, one uppercase letter, and one digit. This makes the password more secure against brute-force attacks. Update tests to cover the minimum-length error path and the new character-class requirements.
04e0fa1 to
891a67d
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: lpiwowar, umago The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
e770335
into
openstack-k8s-operators:main
2 participants
Previously,
generateRandomString()usedcrypto/randbytes encoded withhex.EncodeToString(), so every character in the output was limited to the 16 hex digits. This gave only 4 bits of entropy per character, making the generated passwords significantly weaker than their length would suggest.Replace hex encoding with an alphanumeric charset (a-z, A-Z, 0-9), which provides 62 possible values per character, enforce a minimum length of 16 characters, and guarantee that every generated password contains at least one lowercase letter, one uppercase letter, and one digit. This makes the password more secure against brute-force attacks.
Update tests to cover the minimum-length error path and the new character-class requirements.
Additionally, enable logging of successful and unsuccessful connections / disconnections to the PostgreSQL database to enable detection of malicious activity against the database.