I am planning to create a module that would use a system account similar to the Community user seen on Stack Exchange sites. As the system account would have permissions that normal users don't have, I would like to avoid somebody logs in with that account, and get permissions that a site maintainer would have.

Is using drupal_random_bytes() to create a password a good method, or is it too excessive, and I should use a different method? In any case, I was thinking of periodically changing the password; I guess this means I could use a faster way to generate the password, as long as the password is still random, and with at least X characters.


As you probably know, another option is to use user_password() to get the password string.

When Drupal hashes it, e.g during user_save(), with user_hash_password(), drupal_random_bytes() is used as part of the _password_generate_salt() calculation.

Just thought it worth mentioning.

You may also be interested in preventing login through the UI by that account with a user_login validation handler.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.