Help users avoid insecure configurations a bit by recommending a secure RPC password and increasing the incorrect password delay.
This may open up a RPC DOS for users with exposed RPC ports and short passwords. Since users shouldn't have exposed RPC ports OR short passwords, the DOS risk is preferable to the compromise risk.
Also logs the client IP address for incorrect attempts.
With this patch running bitcoind when there is no configuration file now results in: [gmaxwell@helmholtz src]$ ./bitcoind Error: To use bitcoind, you must set a rpcpassword in the configuration file: /home/gmaxwell/.bitcoin/bitcoin.conf It is recommended you use the following random password: rpcuser=bitcoinrpc rpcpassword=HXt6c9zmw6jqW4jvh3pcHTGb7owrmNLUtaSVGvoT2Sho (you do not need to remember this password) If the file does not exist, create it with owner-readable-only file permissions.
Previously it just advised rpcpassword= which probably gets filled in with insecure normal password like values.
I think ideally bitcoin would just autocreate the file with a random authentication string like this— but I thought this change was more minimal. Thoughts?
