Option to disable strong password policy enforcement

[djbobyd]

Hello,
I would very much like to have this feature disabled. It does not provide anything in my local network, except discomfort.
I see this issue is closed, but the problem is still there. Will you do something about it?

Originally posted by @djbobyd in #6846 (comment)

[unites]

I second this. In a small home lab deployment this is an annoyance. The ability to accept the "danger" and disable password complexity should be possible.

[janbro1]

Second this as well. This "feature" resulted in me being locked out for good.

[go2tom42]

Add me to this, In a small home lab deployment with no external access this is annoying AF

[lost-carrier]

Same here... local access only... some ENV parameter or so maybe...

[hexadecagram]

Good to see I'm not the only one that wants to be able to disable this. I'm all for strong passwords when they are relevant but if you REALLY want security, you don't use passwords at all. You use PKI and client certificates, which, I might add, would be a nice feature to have. ;-)

[DigibitDK]

Why should I pick a password for Portainer that is even stronger than the server-password im using? Makes no sense. Let me choose whatever I need for my system. Im gonna roll back to previous version until fixed.

[jamescarppe]

Hi all, thanks for the feedback on this. I'm discussing options internally with the team here and will let you know what the outcome of those conversations is.

[memjr]

I strongly second this!

Downgraded immediately.

[janbro1]

Hi all, thanks for the feedback on this. I'm discussing options internally with the team here and will let you know what the outcome of those conversations is.

Again, it resulted in me not being able to login to Portainer at all. There was definitely no typo in the password used. This is therefore more than an inconvenience.
I changed my password to strong and copy pasted it for changing it. I then used the same password to login and was denied!
I am super happy to have had a backup in place, that saved me.

[lemmy04]

seconded, very much.
Even more so, since the password rules that are enforced only provide a marginally stronger password.
For a "random string generator"-type attack against passwords, 12345678901234 is exactly the same difficulty to guess as M1r0sl4v12!!,, so if you really want to increase security, add 2FA and/or ssl client certificates, or at least arbitrary length passphrases with blanks.

[Nazar78]

Seconded this, make it an option but not rudely enforced.

[lordvandal]

Fully agree, please make it an option instead of enforcing it, as it's an extreme measure, which is exasperating, at least for me (and probably others too).

[23andreas]

I hope this gets removed as well. Very annoying.

[zachstultz]

Seconded, what a pointless restriction to force on local networks.

[lemmy04]

IMO it should be freely configurable - max and min length, number of required character classes, max age.

[r1ksk1]

Oh dear... back to a previous version for me - this is unworkable. Sure it's OK by default (although a pain), but not to be able to turn off is unworkable. Thanks.

[rrixon]

Reverted to previous version until this becomes optional - password strength is irrelevant when Portainer is simply making access to containers on a Raspberry Pi easier, behind a firewall in a home environment.

[huib-portainer]

Thanks for all your comments and feedback everyone.

It seems we have overdone the password policy in this case!
The driver for this change is that we have observed our users using very weak passwords in some instances, which can be an expensive mistake to make.

In light of the feedback that we've received, we are removing the restriction that is enforcing the mix of lower case, upper case, numeric and special characters; which means that any passphrase that is at least 12 characters long will be accepted in the 2.13.1 patch release.

[lemmy04]

...not good enough. make it configurable the way it should: let the administrator define what the policy should be.

[lemmy04]

this is what a password policy on freeipa offers to be configurable:

and for anyone who can't read german:

• maximum age in days
• minimum time between changes in hours
• length of the password history (how many different passwords do you have to go through before reuse is ok)
• number of different character classes you have to have in a password
• minimum length
• maximum number of errors before lockout
• time until error count resets
• time until lockout resets

and what you see there is what i will be using on my internal network once i switch everything to ipa, which basically means as long as the password is 8 characters long, anything goes, with 10 minute logout if you fail more than 6 times.

[lordvandal]

...not good enough. make it configurable the way it should: let the administrator define what the policy should be.

fully agree, 12 characters for a home environment is still too much

[janbro1]

Just plain curuosity, how did you even identify this as a topic, without actually reading our passwords?

But back to this topic, I would rather ask for the option of 2 factor, then to have 12 characters minimum. 'cause I agree if you are really using portainer outside of private use, it better be protected well. Even though I would never expose it directly to the Internet.

[lost-carrier]

@huib-portainer I'd add some option to just disable password checking policy in general - having it turned on as default could make sense. Fancy fine granular policy definitions would be nice, but are optional IMHO...

Just plain curuosity, how did you even identify this as a topic, without actually reading our passwords?

Yep, that I wondered as well...

[rrixon]

I'm sure my Raspberry Pi will sleep well at night knowing you're worrying about safety for it too - but insisting on a 12 character password will ensure that I simply save that detail in my browser (as I currently do not), making it shared and therefore weaker. Please provide the option to remove this new password policy, and/or provide us with a mechanism to set strength requirements for ourselves.

[jamescarppe]

I don't know about anyone else, but I have my lastpass setup to generate all my random passwords to 50 characters. So the limit of 18 for me it quite honestly limiting if you ask me.

The slider sets the minimum password length required. You can of course use a password much longer than this.

I will pass the feedback on the interface method on to the UX team, however.

[jamescarppe]

if you go that low ("1") can you go a step further to "0" and disable completely authentication, for guys like me which have other authentication mechanisms running in front of portainer like 2FA

We provide the ability to use external authentication providers already which bypasses the built-in authentication, and we are actively looking at adding other providers in the future (for example Authelia). I'd suggest starting a separate Github issue around this so we can gather that feedback separately from this rather long thread.

[ccoupe]

Oh well, I don't want to run all those damn docker things at home if it's going to be this much trouble.

[memjr]

Oh well, I don't want to run all those damn docker things at home if it's going to be this much trouble.

You still can. If you don't want to downgraded to 2.11.1 until they fix it, there are other products out there that to the same thing as Portainer. One of them, already mentioned above, is Yatch https://yacht.sh/

[Xiao4]

One of them, already mentioned above, is Yatch https://yacht.sh/

Thank you, I'll go with this one.

[lordvandal]

Portainer CE-2.14.0 is here.

• The only remaining open issue in this version is the one from this very thread Introduce the ability for an admin to configure the password length #7055
• Password is still required by policy
• The minimum password length is still 1 (one) character

All this makes me feel very, very disappointed... 😞
I really do like Portainer, however this stubborn refusal of allowing the users to disable authentication is too much for me.
It seems that it's time to move on 😢 💔

[slaygirlz]

Portainer CE-2.14.0 is here.

• The only remaining open issue in this version is the one from this very thread Introduce the ability for an admin to configure the password length #7055
• Password is still required by policy
• The minimum password length is still 1 (one) character

All this makes me feel very, very disappointed... 😞 I really do like Portainer, however this stubborn refusal of allowing the users to disable authentication is too much for me. It seems that it's time to move on 😢 💔

wait someone say they going to do something about it at the end of the mouth hopefully

[jamescarppe]

This thread has been about disabling the enforcement of the strong password policy, which 2.14 has done. It has not been about disabling password authentication entirely - this should be opened as a separate feature request if it is desired.

As the issue this thread is about has been alleviated in the 2.14 release, I am closing the thread.

[TWART016]

How can I set the password length before portainer installation? With an environment variable?

[Bluscream]

Ehm, how do i actually use this now? It asks for 12 character password on install.

[rdwebdesign]

The simplest way is to use a 12 character initial password. After the initial setup is complete, just change the password length and set the correct password.

[Bluscream]

Thanks, i did that

[brando56894]

12 characters doesn't automatically make a strong passwords. The password @$$ is a lot stronger and harder to brute force than 123456789abc

[apfffr]

so what about this? seems to be an issue for years. just installed portainer and have to use a useless long passwort. what is this shit?

[ccoupe]

@apfffr - It has been fixed. There is a setting for number of characters to use. Change that for fit your desires. Create a user and assign a password.

[phitran]

If you are setting up your user/password during a new installation, you will need a 12-character password. Then, you can enter the settings to set the character length and set a new password.

[DocBrown101]

If you are setting up your user/password during a new installation, you will need a 12-character password. Then, you can enter the settings to set the character length and set a new password.

If you summarize it so simply, it sounds even more stupid :(

[memjr]

Almost 2 years later and people still crying abou this...

Set a password, change the preferences, done.

Unsubscribed.

[jtanaka]

I found it troublesome to come up with a 12-character password for temporary use. I initially repeated the password like passwordpassword, and then changed it to password.

[Arrmm]

Almost 2 years later and people still crying abou this...

Set a password, change the preferences, done.

Unsubscribed.

Yeah now that I know I can change it, setting a one-time 12 characters temporary password is not a big deal. Hell, you can even set it as 12345689012 or aaaaaaaaaaaa and then adjust the password rules before you change it to your favorite.

[le-quentin]

The thing is, 2 years later or not, this is still a weird design choice, with all due respect. And the proposed workaround is not satisfying to me: it looks weird in my deploy scripts, and it's simply unnecessary pain.

I'm currently in the process of setting up a staging environment for my homelab. This staging environment is ephemeral and inaccessible from the outside world. I don't need a strong password there. Heck, I don't even need a password at all. I just want to set a simple one like '1234' to be iso with prod while still typing it quickly.

When using the cloud hosted offers of Portainer this probably makes a lot of sense. But when you're hosting by yourself you know what your use case is, and only you can decide which policy is relevant for which scenario. See my use case just above: I hate having Portainer think in my place here, that's not why I self host open source services. I expect this kind of "protecting you from yourself" behaviour from proprietary solutions, that's a given, but I'm really sad to see it in the open source world, especially still ongoing years after the issue was raised.

Why not just use an env var, a runtime parameter or whatever else to allow disabling this policy? Why would devs @ Portainer think allowing to just tweak the password length requirement after first login (making it useless in an automated deploy environment) is a better solution? Why spending time to develop features that decrease the number of ways we can use Portainer? I'm really confused.

[memjr]

Why not just use an env var, a runtime parameter or whatever else to allow disabling this policy? Why would devs @ Portainer think allowing to just tweak the password length requirement after first login (making it useless in an automated deploy environment) is a better solution? Why spending time to develop features that decrease the number of ways we can use Portainer? I'm really confused.

Because: their project, their way.

It was annoying for sure, but 2 years later and it's still the same. I'm pretty sure they're not going to change it back.

Options:

1. use is as it is
2. find an alternative product
3. it runs as a container itself, spin one up, configure it to your liking, then clone it again and again as needed.
4. clone the repo, make the change and enjoy, possibly even making it available to others who don't like it either

I also did not like it, but it is what it is and I moved on.

[le-quentin]

Because: their project, their way.

This is a truism. Of course. I think we can still emit criticism though (and I did my best to make mine constructive, I don't think it's just me venting).

It was annoying for sure, but 2 years later and it's still the same. I'm pretty sure they're not going to change it back.

We don't know, man. Their project, their schedule. :D Could be a matter of number of people complaining, could be a matter of dev bandwidth, could be a matter of reasons to make the change... In any case, left this message in a bottle because I felt like it.

Options:

I considered many of those options, for now I'm doing 1. + registering the staging password in my browser, as stupid as it is; 2. is a little overkill and 4. too much maintenance for such a trivial problem (I don't think this deserves the maintenance effort, because yes there is a space between "it's worth me criticizing it" and "it's worth forking and maintaining the fork" 😄 ).

Option 3 is actually interesting, I didn't consider it. But at first glance it seems a little flaky/too complicated to me: containers being ephemeral by nature, if the image doesn't give you a customisation option at startup, it means you gotta mount the customisation data each time, or modify the image directly with commands configuring the data; in both cases you meddle with the private implementation, and again, it means maintenance costs. But maybe I'm missing something in your suggestion.

Anyway, yes, this was just my 2 cents, I know very well they don't have to act on it. Thank you for the suggestions though.

[VincentJGeisler]

this entire thread is a monument to the arrogance of coders. The community has asked they change something back, and the devs are plugging their ears screaming

Sounds like a community fork is in order.

[memjr]

this entire thread is a monument to the arrogance of coders. The community has asked they change something back, and the devs are plugging their ears screaming

Sounds like a community fork is in order.

Godspeed!

[VincentJGeisler]

annnd done..

for those who want to run with any password length. I give you the portainer-genx fork

install instructions

docker volume create portainer_data

docker run -d -p 8000:8000 -p 9443:9443 --name portainer-genx --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_genx_data:/data phoenixalight/portainer-genx:latest

problem solved, community heard and respected. how hard was that?

[daniel-niknam]

I'm unsure when this feature was developed, but I can now set the password length in the "Settings > Authentication" page. (reference)

Still, I can't find a way to override the "12" character validations, but after logging in with a strong password, I was able to update the validation. I'm not very familiar with Portainer, but I think this means I wouldn't be able to take advantage of the "environment" feature because this is a global setting. It wouldn't be safe to run the same settings on production. Setting up an SSO like Authentik sounds like a better choice for prod, anyway.