Kézikönyv:$wgPasswordPolicy
User accounts, authentication: $wgPasswordPolicy | |
---|---|
A felhasználói jelszavak hosszával és biztonságával kapcsolatos beállítások. |
|
Bevezetve: | 1.26.0 (Gerrit change 206156; git #1a20dc) |
Eltávolítva: | használatban |
Megengedett értékek: | lásd alább |
Alapértelmezett érték: | lásd alább |
Egyéb beállítások: Betűrendben | Funkció szerint |
Részletek
General setup of policy checks
A jelszóirányelv a következőkből áll:
$wgPasswordPolicy = [
'policies' => [
'<group1>' => [
'<check1>' => '<value1>',
// ...
],
// ...
],
'checks' => [
'<check1>' => '<callable1>',
// ...
],
];
<group1>
stb.: felhasználói csoportok, valamint adefault
speciális csoport, amelynek megléte szükséges, attribútumai pedig mindenkire érvényesek.
<check1>
stb.: achecks
altömbben definiált ellenőrzési feltételek.
<value1>
etc. are policy values, passed to the appropriate callback defined in thechecks
subarray.
Ha az azonos feltétel egy több csoportban szereplő felhasználóra is vonatkozik, akkor a max()
-ben meghatározott értékkel lesz rá érvényes. Alternatively, <value1>
could be an array with the following fields:
value
: same as abovesuggestChangeOnLogin
: when set to true, users will be shown a password change form during login if the check failsforceChange
: likesuggestChangeOnLogin
but the form cannot be skipped.
<callable1>
stb.: PHP-hívóobjektumok, melyek három argumentumot fogadnak el: a meghatározott érték, a User elem, illetve visszatérési értékük a StatusValue.
Fatális státusz esetén a jelszó nem használható bejelentkezéshez sem; nem fatális esetben a megadott karaktersor nem fogadható el új jelszóként (fióklétrehozáskor vagy jelszó-változtatáskor), viszont bejelentkezéshez használható; a felhasználó ekkor egy átugorható jelszó-változtatási űrlapra lesz irányítva.
Default password policy checks
Alapértelmezett ellenőrzések (a includes/password/PasswordPolicyChecks.php
-ban listázva)
MinimalPasswordLength
– Minimum hosszMinimumPasswordLengthToLogin
– Az ennél rövidebb jelszavakkal akkor sem lehet bejelentkezni, ha egyébként helyesek.MaximalPasswordLength
– Maximum hosz. Megakadályozza a DoS-támadásokat pbkdf2-vel.PasswordCannotMatchUsername
– A jelszó nem egyezhet nem a felhasználónévvelPasswordCannotBeSubstringInUsername
– Your password must not appear within your username.PasswordCannotMatchBlacklist
– Feketelistára teszi azokat a jelszavakat, amelyeket korábban a MediaWiki tesztelésekor használtak.PasswordCannotBePopular
– Feketelistára teszi a gyakori jelszavakat. Az n megadásával tiltja az n leggyakoribb jelszót. Az összes, a vonatkozó fájlban szereplő jelszó tiltása aPHP_INT_MAX
konstanssal lehetséges. Lásd még: $wgPopularPasswordFile (a MediaWikihez mellékelt fájl, tízezer jelszóval).
Megjegyzés: (eltávolítva: 1.35) UsePasswordNotInCommonList
instead.PasswordNotInLargeBlacklist
– Az előzővel megegyezik, viszont a feketelistához a wikimedia/password-blacklist könyvtárat használja.
Megjegyzés: (elavultnak jelölve 1.35) UsePasswordNotInCommonList
instead.PasswordNotInCommonList
– Password not in best practices list of 100 000 commonly used passwords.
You should avoid redefining the default checks in $wgPasswordPolicy['checks']
, as such changes might break during MediaWiki upgrades.
Példák
Changing selected password policies
Minden felhasználót érintő irányelv megváltoztatása:
$wgPasswordPolicy['policies']['default']['MinimalPasswordLength'] = 10;
$wgPasswordPolicy['policies']['default']['MaximalPasswordLength'] = 128;
$wgPasswordPolicy['policies']['default']['PasswordCannotMatchUsername']['value'] = false;
Adminisztrátorokat érintő irányelv megváltoztatása:
$wgPasswordPolicy['policies']['sysop']['MinimumPasswordLengthToLogin'] = 10;
$wgPasswordPolicy['policies']['sysop']['MinimalPasswordLength'] = 20;
Disabling all password policies
For development machines, it might be helpful to disable all password policies, which can be done with the following line:
$wgPasswordPolicy = [ 'policies' => [ 'default' => [] ], 'checks' => [] ];
Alapértelmezés
MediaWiki-verzió: | ≥ 1.43 |
use MediaWiki\Password\PasswordPolicyChecks;
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'sysop' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'bot' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'default' => [
'MinimalPasswordLength' => [ 'value' => 8, 'suggestChangeOnLogin' => true ], // 1.40+
'PasswordCannotBeSubstringInUsername' => [ // 1.35+
'value' => true,
'suggestChangeOnLogin' => true
],
'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
],
],
'checks' => [
'MinimalPasswordLength' => [ PasswordPolicyChecks::class, 'checkMinimalPasswordLength' ],
'MinimumPasswordLengthToLogin' => [ PasswordPolicyChecks::class, 'checkMinimumPasswordLengthToLogin' ],
'PasswordCannotBeSubstringInUsername' => [ PasswordPolicyChecks::class, 'checkPasswordCannotBeSubstringInUsername' ],
'PasswordCannotMatchDefaults' => [ PasswordPolicyChecks::class, 'checkPasswordCannotMatchDefaults' ],
'MaximalPasswordLength' => [ PasswordPolicyChecks::class, 'checkMaximalPasswordLength' ],
'PasswordNotInCommonList' => [ PasswordPolicyChecks::class, 'checkPasswordNotInCommonList' ],
],
];
Older versions | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'sysop' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'bot' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'default' => [
'MinimalPasswordLength' => [ 'value' => 8, 'suggestChangeOnLogin' => true ], // 1.40+
'PasswordCannotBeSubstringInUsername' => [ // 1.35+
'value' => true,
'suggestChangeOnLogin' => true
],
'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotBeSubstringInUsername' =>
'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername', // 1.35+
'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults', // 1.35+
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList', // 1.35+
],
];
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'sysop' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'bot' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'default' => [
'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotBeSubstringInUsername' => [ // 1.35+
'value' => true,
'suggestChangeOnLogin' => true
],
'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotBeSubstringInUsername' =>
'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername', // 1.35+
'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults', // 1.35+
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList', // 1.35+
],
];
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'sysop' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'bot' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'default' => [
'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotBeSubstringInUsername' => [ // 1.35+
'value' => true,
'suggestChangeOnLogin' => true
],
'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
'PasswordCannotBeSubstringInUsername' =>
'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername', // 1.35+
'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults', // 1.35+
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList', // 1.35+
],
];
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'sysop' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'bot' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'default' => [
'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotBeSubstringInUsername' => [ // 1.35+
'value' => true,
'suggestChangeOnLogin' => true
],
'PasswordCannotMatchDefaults' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordNotInCommonList' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.35+
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
'PasswordCannotBeSubstringInUsername' =>
'PasswordPolicyChecks::checkPasswordCannotBeSubstringInUsername', // 1.35+
'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults', // 1.35
'PasswordCannotMatchDefaults' => 'PasswordPolicyChecks::checkPasswordCannotMatchDefaults', // 1.35+
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordNotInLargeBlacklist' => 'PasswordPolicyChecks::checkPasswordNotInCommonList', // 1.35
'PasswordNotInCommonList' => 'PasswordPolicyChecks::checkPasswordNotInCommonList', // 1.35+
],
];
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'sysop' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'bot' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
],
'default' => [
'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotMatchBlacklist' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.33+
'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordNotInLargeBlacklist' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.34+
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist', // 1.27+
'PasswordNotInLargeBlacklist' => 'PasswordPolicyChecks::checkPasswordNotInLargeBlacklist', // 1.33+
],
];
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
'PasswordNotInLargeBlacklist' => true, // 1.33
],
'sysop' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
'PasswordNotInLargeBlacklist' => true, // 1.33
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
'PasswordNotInLargeBlacklist' => true, // 1.33
],
'bot' => [
'MinimalPasswordLength' => 10, // 1.33+
'MinimumPasswordLengthToLogin' => 1,
'PasswordNotInLargeBlacklist' => true, // 1.33
],
'default' => [
'MinimalPasswordLength' => [ 'value' => 1, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotMatchUsername' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.33+
'PasswordCannotMatchBlacklist' => [ 'value' => true, 'suggestChangeOnLogin' => true ], // 1.33+
'MaximalPasswordLength' => [ 'value' => 4096, 'suggestChangeOnLogin' => true ], // 1.33+
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist', // 1.27+
'PasswordNotInLargeBlacklist' => 'PasswordPolicyChecks::checkPasswordNotInLargeBlacklist', // 1.33+
],
];
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotBePopular' => 25, // 1.27+
],
'sysop' => [
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotBePopular' => 25, // 1.27+
],
'interface-admin' => [ // 1.32+
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotBePopular' => 25,
],
'bot' => [
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
],
'default' => [
'MinimalPasswordLength' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotMatchBlacklist' => true,
'MaximalPasswordLength' => 4096,
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist' // 1.27+
],
];
$wgPasswordPolicy = [
'policies' => [
'bureaucrat' => [
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotBePopular' => 25, // 1.27+
],
'sysop' => [
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotBePopular' => 25, // 1.27+
],
'bot' => [
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
],
'default' => [
'MinimalPasswordLength' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotMatchBlacklist' => true,
'MaximalPasswordLength' => 4096,
],
],
'checks' => [
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
'PasswordCannotBePopular' => 'PasswordPolicyChecks::checkPopularPasswordBlacklist' // 1.27+
],
];
$wgPasswordPolicy = array(
'policies' => array(
'bureaucrat' => array(
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
),
'sysop' => array(
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
),
'bot' => array(
'MinimalPasswordLength' => 8,
'MinimumPasswordLengthToLogin' => 1,
'PasswordCannotMatchUsername' => true,
),
'default' => array(
'MinimalPasswordLength' => 1,
'PasswordCannotMatchUsername' => true,
'PasswordCannotMatchBlacklist' => true,
'MaximalPasswordLength' => 4096,
),
),
'checks' => array(
'MinimalPasswordLength' => 'PasswordPolicyChecks::checkMinimalPasswordLength',
'MinimumPasswordLengthToLogin' => 'PasswordPolicyChecks::checkMinimumPasswordLengthToLogin',
'PasswordCannotMatchUsername' => 'PasswordPolicyChecks::checkPasswordCannotMatchUsername',
'PasswordCannotMatchBlacklist' => 'PasswordPolicyChecks::checkPasswordCannotMatchBlacklist',
'MaximalPasswordLength' => 'PasswordPolicyChecks::checkMaximalPasswordLength',
),
);
|