RFC: The case for a default username/password

Aaron Weitekamp aweiteka at redhat.com
Tue Dec 4 13:26:11 UTC 2012


On 12/04/2012 06:31 AM, Tomas Sedovic wrote:
>
> I agree that having default username and password (especially with admin
> privileges) in the production setup is a dangerous thing. We should
> remove that and instead provide the admins with a simple way of setting
> these up (probably a query in the aeolus-configure script).
>
> The intent of the default username/password was indeed for dev/testing
> only and I would argue that we should still keep them there.
>
> This will make it easier for the new users trying things out and for us
> when we're helping them debug any setup issues.
>
> Since we have different set of tools for setting up the dev/prod
> environments this should not be a problem.
>
> What do you think?
>
> Thomas
I don't have an issue leaving it in place for devel/testing but I'm not 
sure what that would look like. Remove for productization? It seems 
simplest to just remove the default. Devel and test can specify the same 
defaults for convenience.

FWIW, Katello will be removing defaults.

FYI: https://bugzilla.redhat.com/show_bug.cgi?id=883038



More information about the aeolus-devel mailing list