Merge pull request #5077 from c-po/system-login-default-password

login: T8415: show Warning() if default password is used when adding user

1 files changed, 10 insertions, 8 deletions

diff --git a/src/conf_mode/system_login.py b/src/conf_mode/system_login.py
index 3cff7a806..270d7c2bf 100755
--- a/src/conf_mode/system_login.py
+++ b/src/conf_mode/system_login.py
@@ -33,6 +33,7 @@ from vyos.configverify import verify_vrf
 from vyos.defaults import SSH_DSA_DEPRECATION_WARNING
 from vyos.template import render
 from vyos.template import is_ipv4
+from vyos.utils.auth import DEFAULT_PASSWORD
 from vyos.utils.auth import EPasswdStrength
 from vyos.utils.auth import evaluate_strength
 from vyos.utils.auth import get_current_user
@@ -143,20 +144,21 @@ def verify(login):
                 if s_user.pw_name == user and s_user.pw_uid < MIN_USER_UID:
                     raise ConfigError(f'User "{user}" can not be created, conflict with local system account!')
 
+            plaintext_password = dict_search('authentication.plaintext_password', user_config)
+            if plaintext_password == DEFAULT_PASSWORD:
+                Warning(f'Default password used for user "{user}" - consider changing it')
+
             # T6353: Check password for complexity using cracklib.
             # A user password should be sufficiently complex
-            plaintext_password = dict_search(
-                path='authentication.plaintext_password',
-                dict_object=user_config
-            ) or None
-
             failed_check_status = [EPasswdStrength.WEAK, EPasswdStrength.ERROR]
-            if plaintext_password is not None:
+            if plaintext_password and len(plaintext_password) > 0:
                 result = evaluate_strength(plaintext_password)
                 if result['strength'] in failed_check_status:
-                    Warning(result['error'])
+                    tmp = result['error']
+                    Warning(f'User "{user}" - {tmp}')
 
-            for pubkey, pubkey_options in (dict_search('authentication.public_keys', user_config) or {}).items():
+            for pubkey, pubkey_options in dict_search('authentication.public_keys', user_config,
+                                                      default={}).items():
                 if 'type' not in pubkey_options:
                     raise ConfigError(f'Missing type for public-key "{pubkey}"!')
                 if 'key' not in pubkey_options: