evolvedbinary
Admin password blank by default, must be proactively set
The admin password has to be set manually in the user manager upon a fresh install, otherwise it is blank. This encourages bad security practice among DBAs and could increase the likelihood and severity of breaches if deployed at scale.
Possible solution: screen at setup similar to eXist's for setting the admin password.
Hi @IanDavey, thanks for your issue report. I agree that having a default empty password is not great.
There are some platforms (Linux/Unix) where the installation is unattended as we install a .deb or .rpm package. Ideally I would like a similar mechanism for setting an initial password on all platforms.
I have been thinking about, having an initial configuration webpage which is shown after the database is installed. It would show this after installation, and require you to set a password and maybe a couple other things, before starting the server properly for the first time.
How does that sound?
Similar to the current page that lets you select VM properties? That sounds good to me.
@IanDavey The current VM properties stuff on Windows is a JavaFX panel which is launched from the system tray. This would instead be a webpage which you see the first time you visit http://localhost:4059
I have scheduled this for Alpha 3 - https://github.com/evolvedbinary/fusiondb-server/wiki/Road-Map