Skip to content

[baseimage]: Improve password hashing for default user account #1748

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lguohan merged 2 commits into from
Jun 9, 2018
Merged

[baseimage]: Improve password hashing for default user account #1748

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5f06d1f
[slave.mk]: Fix displaying username and password in build summary
sergeypopovich-ord May 29, 2018
939dbeb
[baseimage]: Improve default user account handling
sergeypopovich-ord May 29, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 9 additions & 13 deletions build_debian.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,26 +3,22 @@
## an ONIE installer image.
##
## USAGE:
## ./build_debian USERNAME PASSWORD_ENCRYPTED
## PARAMETERS:
## USERNAME=username PASSWORD=password ./build_debian
## ENVIRONMENT:
## USERNAME
## The name of the default admin user
## PASSWORD_ENCRYPTED
## The encrypted password, expected by chpasswd command
## PASSWORD
## The password, expected by chpasswd command

## Default user
USERNAME=$1
[ -n "$USERNAME" ] || {
echo "Error: no or empty USERNAME argument"
echo "Error: no or empty USERNAME"
exit 1
}

## Password for the default user, customizable by environment variable
## By default it is an empty password
## You may get a crypted password by: perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"'
Copy link
Collaborator

@qiluo-msft qiluo-msft May 30, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

salt [](start = 76, length = 4)

Could you give an example?

  1. It uses DES to encrypt accounts password. Furthermore this
    effectively limits password length to 8 symbols, even if more
    provided with PASSWORD or DEFAULT_PASSWORD from rules/config #Closed

Copy link
Contributor Author

@serhepopovych serhepopovych May 30, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I have updated commit description message to contain more information on Before/After change. It should explain problem.

In short: you can try any image and login with only with first 8 symbols from password (e.g. for default image use YourPaSs instead of YourPaSsWoRd).

This works of course only if password for that account isn't changed since image was build (e.g. via passwd(1) or chpasswd(1) tools on running system).

PASSWORD_ENCRYPTED=$2
[ -n "$PASSWORD_ENCRYPTED" ] || {
echo "Error: no or empty PASSWORD_ENCRYPTED argument"
## Password for the default user
[ -n "$PASSWORD" ] || {
echo "Error: no or empty PASSWORD"
exit 1
}

Expand Down Expand Up @@ -178,7 +174,7 @@ sudo cp files/docker/docker.service.conf $_
## Note: user should be in the group with the same name, and also in sudo/docker group
sudo LANG=C chroot $FILESYSTEM_ROOT useradd -G sudo,docker $USERNAME -c "$DEFAULT_USERINFO" -m -s /bin/bash
## Create password for the default user
echo $USERNAME:$PASSWORD_ENCRYPTED | sudo LANG=C chroot $FILESYSTEM_ROOT chpasswd -e
echo "$USERNAME:$PASSWORD" | sudo LANG=C chroot $FILESYSTEM_ROOT chpasswd

## Pre-install hardware drivers
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install \
Expand Down
18 changes: 14 additions & 4 deletions slave.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,10 +76,14 @@ endif

ifeq ($(USERNAME),)
override USERNAME := $(DEFAULT_USERNAME)
else
$(warning USERNAME given on command line: could be visible to other users)
endif

ifeq ($(PASSWORD),)
override PASSWORD := $(DEFAULT_PASSWORD)
else
$(warning PASSWORD given on command line: could be visible to other users)
endif

ifeq ($(SONIC_BUILD_JOBS),)
Expand All @@ -100,8 +104,8 @@ $(info "CONFIGURED_PLATFORM" : "$(if $(PLATFORM),$(PLATFORM),$(CONFI
$(info "SONIC_CONFIG_PRINT_DEPENDENCIES" : "$(SONIC_CONFIG_PRINT_DEPENDENCIES)")
$(info "SONIC_BUILD_JOBS" : "$(SONIC_BUILD_JOBS)")
$(info "SONIC_CONFIG_MAKE_JOBS" : "$(SONIC_CONFIG_MAKE_JOBS)")
$(info "DEFAULT_USERNAME" : "$(DEFAULT_USERNAME)")
$(info "DEFAULT_PASSWORD" : "$(DEFAULT_PASSWORD)")
$(info "USERNAME" : "$(USERNAME)")
$(info "PASSWORD" : "$(PASSWORD)")
$(info "ENABLE_DHCP_GRAPH_SERVICE" : "$(ENABLE_DHCP_GRAPH_SERVICE)")
$(info "SHUTDOWN_BGP_ON_START" : "$(SHUTDOWN_BGP_ON_START)")
$(info "ENABLE_PFCWD_ON_START" : "$(ENABLE_PFCWD_ON_START)")
Expand Down Expand Up @@ -484,8 +488,14 @@ $(addprefix $(TARGET_PATH)/, $(SONIC_INSTALLERS)) : $(TARGET_PATH)/% : \

DIRTY_SUFFIX="$(shell date +%Y%m%d\.%H%M%S)"
export DIRTY_SUFFIX
./build_debian.sh "$(USERNAME)" "$(shell perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" $(LOG)
TARGET_MACHINE=$($*_MACHINE) IMAGE_TYPE=$($*_IMAGE_TYPE) ./build_image.sh $(LOG)

USERNAME="$(USERNAME)" \
PASSWORD="$(PASSWORD)" \
./build_debian.sh $(LOG)

TARGET_MACHINE=$($*_MACHINE) \
IMAGE_TYPE=$($*_IMAGE_TYPE) \
./build_image.sh $(LOG)

$(foreach docker, $($*_DOCKERS), \
rm -f $($(docker)_CONTAINER_NAME).sh
Expand Down