stv0g/firstuseauthenticator
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #6 from Carreau/faq

Browse source 
FAQ+Security advice
This commit is contained in:
Yuvi Panda 2018-08-28 11:57:32 -07:00 • committed by GitHub
commit a6566c4199
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
README.md
View file

@ -38,3 +38,18 @@ they can log in. Users can be created via the admin panel or by setting
whitelist / admin list.
Defaults to True.
## FAQ ##
#### Why have a password DB and not use PAM ?
For security Reasons. Users are likely to set an, insecure password at
login time, and you do not want a brute-force/dictionary attack to manage to
login by attacking via ssh or another mean.
## Security
When using `FirstUseAuthenticator` it is advised to automatically prepend the
name of the user with a known-prefix (for example `jupyter`). This would prevent
for example, someone to log-in as `root`, as the created user would be
`jupyter-root`.