bitcoin/bitcoin — pull request #799 by gmaxwell (2012-02-05 08:07:41+00:00)
Title: Have bitcoind recommend a secure RPC password. Increase invalid password delay.

Help users avoid insecure configurations a bit by recommending a
secure RPC password and increasing the incorrect password delay.

This may open up a RPC DOS for users with exposed RPC ports and
short passwords. Since users shouldn't have exposed RPC ports OR
short passwords, the DOS risk is preferable to the compromise
risk.

Also logs the client IP address for incorrect attempts.

With this patch running bitcoind when there is no configuration file now results in:
[gmaxwell@helmholtz src]$ ./bitcoind
Error: To use bitcoind, you must set a rpcpassword in the configuration file:
/home/gmaxwell/.bitcoin/bitcoin.conf
It is recommended you use the following random password:
rpcuser=bitcoinrpc
rpcpassword=HXt6c9zmw6jqW4jvh3pcHTGb7owrmNLUtaSVGvoT2Sho
(you do not need to remember this password)
If the file does not exist, create it with owner-readable-only file permissions.

Previously it just advised rpcpassword= which probably gets filled in with insecure normal password like values.

I think ideally bitcoin would just autocreate the file with a random authentication string like this— but I thought this change was more minimal. Thoughts?