User Password Check

Synopsis

This Drupal module adds a new command to Drush to check for weak credentials and compare against a password list file (or several).

Requirements

Drush 6.x

Roadmap

• Drush 7 Support
• Better performance
• Drupal backend

Known problems

The verification doesn't play nice with big password lists against a big users table (A.K.A. takes too much time).

Dependencies

Drush 6.x

Usage

Enable the module via Drupal backend (admin/modules) or via the drush command drush en user_password_check

Then:

drush user-password-check 5,user3 --uid=2,3 --name=someguy,somegal  --mail=billgates@microsoft.com

Check the users with name, id, or email 5 or user3, uids 2 and 3, names someguy and somegal, and email address of billgates@microsoft.com

It will print a warning if those users contain the user/password combination user/user. e.g. user3/user3, someguy/someguy, and so on.

To actually block a user with weak credentials:

drush user-password-check admin --block-user

To block the user admin if the password is also admin or its password is in one of the provided files:

drush user-password-check admin --block-user --password-files=file1.txt,file2.txt,...

Alias for this command is upchk

drush upchk admin