XPost: linux.debian.bugs.dist

Justin B Rye <justin.byam.rye@gmail.com> writes:

Philip Hands wrote:

Justin B Rye <justin.byam.rye@gmail.com> writes:

Philip Hands wrote:

Justin B Rye <justin.byam.rye@gmail.com> writes:> ...
The reason behind that structure was supposed to be that one definitely >>>> needs _a_ password, but not necessarily a root password, so the password >>>> advice applies to whichever password you'll decide to grant root access >>>> to, which might not be set here.

This template is specifically about the "Root password/passphrase";

Well, sort-of, except that the user's response (whether to leave this
blank or not) modifies what happens with the user account's permissions,
so it's also about explaining the way that logic works in the installer
and what that will do to the target system.

probably I should have quoted the patch I was looking at, which starts
with "One needs a password/passphrase that grants access to the 'root'
(system administrative) account" but goes on to say "Alternatively,
you can lock root's password by leaving this setting empty".

I'm intimately familiar with the patches you're reading, so I feel like
this comment suggests that we may be talking past one another somehow.

Yes, this is a common problem: you're so familiar with what we need
it to say that you aren't noticing what the text currently does say. https://salsa.debian.org/installer-team/user-setup/-/commit/77c1517fade367bc465da2a5908c5ac47dd8bba7

Template: passwd/root-password
Type: password
# :sl1:
_Description: Root password/passphrase:
One needs a password/passphrase that grants
access to the 'root' (system administrative) account.
Be aware that a malicious or unqualified user
that obtains root access can have disastrous results,
so you should choose a password/passphrase that cannot be guessed.
It should not be a word found in dictionaries,
or something that could be easily associated with you.

(Summary: You DO need a root password.)

No, as I said, what that's trying to say is that there needs to exist a password that one way or the other will let one get access to the root
account (since otherwise one is not going to be able to admin the
machine), but that is not neccesarily the same thing as a "root
password", because the password being refered to might well be the
initial user's password, as long as they end up in the sudo group.

If it comes across as meaning that there needs to be a "root password",
then it's not succeeding in expressing the nuance of the situation
correctly, and we probably need to fix that (assuming that we can come
up with a better wording that still fits in the space available).

.
To allow direct password-based access to root,
you should set the 'root' password/passphrase here.
.
Alternatively, you can lock root's password
by leaving this setting empty, and
instead use the system's initial user account
(which will be set up in the next step)
to become root. This will be enabled for you
by adding that user to the 'sudo' group.
.
Note: what you type here will be hidden (unless you select to show it).

(Summary: You DON'T need a root password.)

Suggested rewrite (short version):

_Description: Root password/passphrase:
To allow direct password/passphrase-based access to the 'root'
(system administrative) account you can set it up here.
To protect your system you should not use one that can be guessed.
.
Alternatively, you can lock root's password
by leaving this setting empty, and
instead use the system's initial user account
(which will be set up in the next step)
to become root. This will be enabled for you
by adding that user to the 'sudo' group.
.
Note: what you type here will be hidden (unless you select to show it).

This is certainly better than good enough, so I'd be fine with this too.

Cheers, Phil.
--
Philip Hands -- https://hands.com/~phil

--=-=-Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3/FBWs4yJ/zyBwfW0EujoAEl1cAFAmXoQGIACgkQ0EujoAEl 1cDpRhAAsiNO5rnmrnNy9TW9TgSFGhKHIVC0n7Jl9pm+i9rxmazXgXivTkAphD1D 9rYkZ0TAIW8u3SSk2TMZfV39Gsr0LQNdqmm4BOzISGfctwnyxtbC652jCA/4jCb3 3bUNJMJgJvoHnW7tgsXpMFZ8xWx0d5OmrvCTsH+cJqcXjiE4chYvdKY58kPvw/f5 v/1zeTyHlq/q7CTE7bcKqnThlJSyuYu3beHTfdSoIKhQXqtoIzn1zwET6es8g4f/ g2TRPC88Yir7Puz2z/4fe9WNkXm8s1vzPLQSWsXdtxHQQDFTk+V1ygQwm7mWrZ7r +RAup2wcD61C7fiZnDG907/fHEmHc44B5a7ZAaMHdf6aE0us+MsjfJ4Zi3xBZi86 km1WM5NEMg3tzPtATH/Nio7uvtpqHn2oy0wXJ7Xr/NGVXu6ssBUtpRBqIXTurP2G k+OzSTcg4tX+DPHBQNBmJSqGFHcDXxGPLlWnZ/VFU2SbFmH9ChFc2EC9w1G6fnSD 3yioNhl8jsRWMRm193UG5b1aUgRNP2TSD8E1wcUIWbuF5kWyN+6frUB6bg+uJNRG tdFyNjDxz7evX3+3tUfq1//W1XxkM4azbAOuXS5lk7zQ9ewzQ5lsK/NdNw0Gsqze IL3jSWCtnfliQzfiHlMcscmlbkonqYJHhe3HZhBIpiGUIrmxvPA=o/cp
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gatewa