Justin B Rye <justin.byam.rye@gmail.com> writes: > Philip Hands wrote: >> Justin B Rye <justin.byam.rye@gmail.com> writes: >>> Philip Hands wrote: >>>> Justin B Rye <justin.byam.rye@gmail.com> writes:> ... >>>> The reason behind that structure was supposed to be that one definitely >>>> needs _a_ password, but not necessarily a root password, so the password >>>> advice applies to whichever password you'll decide to grant root access >>>> to, which might not be set here. >>> >>> This template is specifically about the "Root password/passphrase"; >> >> Well, sort-of, except that the user's response (whether to leave this >> blank or not) modifies what happens with the user account's permissions, >> so it's also about explaining the way that logic works in the installer >> and what that will do to the target system. >> >>> probably I should have quoted the patch I was looking at, which starts >>> with "One needs a password/passphrase that grants access to the 'root' >>> (system administrative) account" but goes on to say "Alternatively, >>> you can lock root's password by leaving this setting empty". >> >> I'm intimately familiar with the patches you're reading, so I feel like >> this comment suggests that we may be talking past one another somehow. > > Yes, this is a common problem: you're so familiar with what we need > it to say that you aren't noticing what the text currently does say. > https://salsa.debian.org/installer-team/user-setup/-/commit/77c1517fade367bc465da2a5908c5ac47dd8bba7 > > Template: passwd/root-password > Type: password > # :sl1: > _Description: Root password/passphrase: > One needs a password/passphrase that grants > access to the 'root' (system administrative) account. > Be aware that a malicious or unqualified user > that obtains root access can have disastrous results, > so you should choose a password/passphrase that cannot be guessed. > It should not be a word found in dictionaries, > or something that could be easily associated with you. > > (Summary: You DO need a root password.) No, as I said, what that's trying to say is that there needs to exist a password that one way or the other will let one get access to the root account (since otherwise one is not going to be able to admin the machine), but that is not neccesarily the same thing as a "root password", because the password being refered to might well be the initial user's password, as long as they end up in the sudo group. If it comes across as meaning that there needs to be a "root password", then it's not succeeding in expressing the nuance of the situation correctly, and we probably need to fix that (assuming that we can come up with a better wording that still fits in the space available). > . > To allow direct password-based access to root, > you should set the 'root' password/passphrase here. > . > Alternatively, you can lock root's password > by leaving this setting empty, and > instead use the system's initial user account > (which will be set up in the next step) > to become root. This will be enabled for you > by adding that user to the 'sudo' group. > . > Note: what you type here will be hidden (unless you select to show it). > > (Summary: You DON'T need a root password.) > > Suggested rewrite (short version): > > _Description: Root password/passphrase: > To allow direct password/passphrase-based access to the 'root' > (system administrative) account you can set it up here. > To protect your system you should not use one that can be guessed. > . > Alternatively, you can lock root's password > by leaving this setting empty, and > instead use the system's initial user account > (which will be set up in the next step) > to become root. This will be enabled for you > by adding that user to the 'sudo' group. > . > Note: what you type here will be hidden (unless you select to show it). This is certainly better than good enough, so I'd be fine with this too. Cheers, Phil. -- Philip Hands -- https://hands.com/~phil
Attachment:
signature.asc
Description: PGP signature