Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SQLAssessment - Suggestion for a better message for the "WeakPassword" check #1375

Open
ClaudioESSilva opened this issue Jan 15, 2025 · 0 comments

Comments

@ClaudioESSilva
Copy link

The "Weak Password" check doesn't check only for weak passwords against a list of less known weak passwords but it will also be flagged if the
Enforce password policy or Enforce password expiration isn't checked (for enabled accounts).

That said, the description of this check (and the title too) should be refined to a more complete message.
https://github.com/microsoft/sql-server-samples/blob/master/samples/manage/sql-assessment-api/ruleset.json#L3501

I can have a login with a good password (length and complexity) but still, the message will be "Some SQL logins have weak passwords.". This brings confusion.
In this case, the reason can be one of the unchecked boxes.

Suggestion

Current:

"displayName": "SQL logins have weak passwords",
"description": "Some SQL logins have weak passwords. Make sure that you use a strong password for each of your SQL logins to decrease vulnerabilities.",

An idea:

"displayName": "SQL logins have weak passwords or missing policy/expiration",
"description": "Some SQL logins have weak passwords or don't have the policy/expiration check on. Make sure that you use a strong password for each of your SQL logins and change your passwords often to decrease vulnerabilities.",
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant