I just installed a new 7.50 instance using the iso downloaded from ftp site.
A config backup from another 7.50 instance was used and I rebooted the machine after the restore. I then tried logging in to console just to see if password still works (I know root and loginuser passwd are not part of restore and they should not work). When I tried the user root, system prompted me "password change request initiated..." and asked me for old password and new password.
What surprised me was that the system happily took blank password (I didn't type anything but press enter) and allowed me in. I logged out and tried logging in as root and blank password just to confirm and it worked. I think the console login password change process is broken and it doesn't check user input (at least it doesn't make sure blank password isn't allowed).
Guest User!
You are not Sophos Staff.
