enhance root password (branch yem/passwd)

DES is long dead, it is insecure as hell, and virtually all known crypt(3) implementations now all support at least md5.

Besides, the character-space of DES-encoded passwords are a sub-set of the character-space for a clear-text password, so we can't easily differentiate between the two. Since we're going to change the root password prompt to support settign encoded passwords (as well as

clear-text passwords), we can't keep DES or we'd be unable to decide whether we'd need to encode the password or not.

Remove DES encoding altogether (and add a legacy entry). The default is still md5, and thus there's no backward-compatibility 'select' to add.

Signed-off-by "Yann E. MORIN" <[email protected]>

Cc Lorenzo Catucci <[email protected]>

---
 Config.in.legacy | 7 +++++++
 system/Config.in | 9 ---------
 2 files changed, 7 insertions(+), 9 deletions(-)

From: Lorenzo Catucci <[email protected]>

Currently, there is only three possibilities regarding the root account:
- it is enabled with no password (the default)
- it is enabled, using a clear-text, user-provided password
- it is disabled if the user sets the clear-text password to '*'

This is deemed insufficient in many cases, especially when the .config file has to be published (e.g. for the GPL compliance, or any other reason.).

Fix that in two ways:

- add a bolean option that allows/diesaloows root login altogether,

    which defaults to 'y' to keep backward compatibility;

- accept already-encoded passwords, which we recognise as starting with either of $1$, $5$ or $6$ (resp. for md5, sha256 or sha512). For backward-compatibility, we stil accept '*' to disable the account.

Currently, there is only three possibilities regarding the root account:
- it is enabled with no password (the default)
- it is enabled, using a clear-text, user-provided password
- it is disabled if the user sets the clear-text password to '*'

This is deemed insufficient in many cases, especially when the .config file has to be published (e.g. for the GPL compliance, or any other reason.).

Fix that in two ways:

- add a bolean option that allows/diesaloows root login altogether,

    which defaults to 'y' to keep backward compatibility;

- accept already-encoded passwords, which we recognise as starting with either of $1$, $5$ or $6$ (resp. for md5, sha256 or sha512). For backward-compatibility, we stil accept '*' to disable the

system/system.mk +9 -3

@@ -70,9 +70,25 @@ TARGET_FINALIZE_HOOKS += SET_NETWORK
 ifeq ($(BR2_ROOTFS_SKELETON_DEFAULT),y)
 
 define SYSTEM_ROOT_PASSWD
-	[ -n "$(TARGET_GENERIC_ROOT_PASSWD)" ] && \
-		TARGET_GENERIC_ROOT_PASSWD_HASH=$$($(MKPASSWD) -m "$(TARGET_GENERIC_PASSWD_METHOD)" "$(TARGET_GENERIC_ROOT_PASSWD)"); \
-	$(SED) "s,^root:[^:]*:,root:$$TARGET_GENERIC_ROOT_PASSWD_HASH:," $(TARGET_DIR)/etc/shadow
+	if [ "$(BR2_TARGET_ENABLE_ROOT_LOGIN)" = "y" ]; then \
+		case '$(TARGET_GENERIC_ROOT_PASSWD)' in \
+		("") \
+			ROOT_PASSWD=""; \
+		;; \
+		("$$1$$"*|"$$5$$"*|"$$6$$"*) \
+			ROOT_PASSWD='$(TARGET_GENERIC_ROOT_PASSWD)'; \
+		;; \
+		('*') \

Quoted 9 lines

Currently, there is only three possibilities regarding the root account:
- it is enabled with no password (the default)
- it is enabled, using a clear-text, user-provided password
- it is disabled if the user sets the clear-text password to '*'

This is deemed insufficient in many cases, especially when the .config file has to be published (e.g. for the GPL compliance, or any other reason.).

Quoted 3 lines

Fix that in two ways:

- add a bolean option that allows/diesaloows root login altogether,

disallows.

Quoted 5 lines

    which defaults to 'y' to keep backward compatibility;

- accept already-encoded passwords, which we recognise as starting with either of $1$, $5$ or $6$ (resp. for md5, sha256 or sha512). For backward-compatibility, we stil accept '*' to disable the

still.

Quoted 16 lines

system/system.mk +9 -3

@@ -70,9 +70,25 @@ TARGET_FINALIZE_HOOKS += SET_NETWORK
 ifeq ($(BR2_ROOTFS_SKELETON_DEFAULT),y)
 
 define SYSTEM_ROOT_PASSWD
-	[ -n "$(TARGET_GENERIC_ROOT_PASSWD)" ] && \
-		TARGET_GENERIC_ROOT_PASSWD_HASH=$$($(MKPASSWD) -m "$(TARGET_GENERIC_PASSWD_METHOD)" "$(TARGET_GENERIC_ROOT_PASSWD)"); \
-	$(SED) "s,^root:[^:]*:,root:$$TARGET_GENERIC_ROOT_PASSWD_HASH:," $(TARGET_DIR)/etc/shadow
+	if [ "$(BR2_TARGET_ENABLE_ROOT_LOGIN)" = "y" ]; then \
+		case '$(TARGET_GENERIC_ROOT_PASSWD)' in \
+		("") \
+			ROOT_PASSWD=""; \
+		;; \
+		("$$1$$"*|"$$5$$"*|"$$6$$"*) \
+			ROOT_PASSWD='$(TARGET_GENERIC_ROOT_PASSWD)'; \
+		;; \
+		('*') \

system/system.mk TARGET_FINALIZE_HOOKS += SET_NETWORK · line 91

Quoted 10 lines

system/system.mk +10 -0

+			ROOT_PASSWD='*'; \
+		;; \
+		(*) \
+			ROOT_PASSWD=$$($(MKPASSWD) -m "$(TARGET_GENERIC_PASSWD_METHOD)" "$(TARGET_GENERIC_ROOT_PASSWD)"); \
+		;; \
+		esac; \
+	else \
+		ROOT_PASSWD='*'; \
+	fi; \
+	$(SED) "s,^root:[^:]*:,root:$${ROOT_PASSWD}:," $(TARGET_DIR)/etc/shadow

Argh. Can we use make instead of turning Buildroot into a build system written in shell ?

ifeq ($(BR2_TARGET_ENABLE_ROOT_LOGIN),) SYSTEM_ROOT_PASSWORD = *
else
ifeq ($(TARGET_GENERIC_ROOT_PASSWORD),)
SYSTEM_ROOT_PASSWORD =
# I believe we could simplify this, and assume that if the password

 # starts with $$, we have an already encoded password.
 else ifeq ($(or $(filter $$1$$%,$(TARGET_GENERIC_ROOT_PASSWORD)),$(filter $$5$$%,$(TARGET_GENERIC_ROOT_PASSWORD)),$(filter $$6$$%,$(TARGET_GENERIC_ROOT_PASSWORD)))
  SYSTEM_ROOT_PASSWORD = $(TARGET_GENERIC_ROOT_PASSWORD))
 else ifeq ($(TARGET_GENERIC_ROOT_PASSWORD),*)
  SYSTEM_ROOT_PASSWORD = $(TARGET_GENERIC_ROOT_PASSWORD))
 else
  SYSTEM_ROOT_PASSWORD = $(shell $(MKPASSWD) -m "$(TARGET_GENERIC_PASSWD_METHOD)" "$(TARGET_GENERIC_ROOT_PASSWD)")
 endif
endif

(Completely untested, of course).