system cfg: default mkpasswd to SHA
PATCH 1/2 system cfg: default mkpasswd to SHA
This patch drops the comment about checking the C libraries version as they now all support it by default
glibc 2.7+
uclibc (bdd8362a88 package/uclibc: defconfig: enable sha-256...)
musl 1.1.14+This patch updates the help text and changes the default mkpasswd method to SHA256 from MD5
--- system/Config.in | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
system/Config.in +3 -11
@@ -61,7 +61,7 @@ endif choice bool "Passwords encoding" - default BR2_TARGET_GENERIC_PASSWD_MD5 + default BR2_TARGET_GENERIC_PASSWD_SHA256 help Choose the password encoding scheme to use when Buildroot needs to encode a password (eg. the root password, below).
@@ -81,20 +81,12 @@ config BR2_TARGET_GENERIC_PASSWD_MD5 config BR2_TARGET_GENERIC_PASSWD_SHA256 bool "sha-256" help - Use SHA256 to encode passwords. - - Very strong, but not ubiquitous, although available in glibc - for some time now. Choose only if you are sure your C library - understands SHA256 passwords. + Use SHA256 to encode passwords which is stronger then MD5. config BR2_TARGET_GENERIC_PASSWD_SHA512 bool "sha-512" help - Use SHA512 to encode passwords. - - Extremely strong, but not ubiquitous, although available in - glibc for some time now. Choose only if you are sure your C - library understands SHA512 passwords. + Use SHA512 to encode passwords which is stronger then SHA256 endchoice # Passwd encoding
Signature · 1 line
1.9.1
PATCH 2/2 system cfg: remove passwd MD5 format
As SHA256 is now default, removing weak MD5 option. C libraries now all support the SHA methods.
glibc 2.7+
uclibc (bdd8362a88 package/uclibc: defconfig: enable sha-256...)
musl 1.1.14+One issue this would prevent is a host tool issue with a FIPS enabled system where weak ciphers/methods are disabled. The crypt(3) call checks /proc/sys/crypto/fips_enabled and would result in mkpasswd returning "crypt failed." Rather then create a host dependency check this patch removes the potential issue.
--- Config.in.legacy | 8 ++++++++ system/Config.in | 10 ---------- 2 files changed, 8 insertions(+), 10 deletions(-)
Config.in.legacy +8 -0
@@ -143,6 +143,14 @@ comment "----------------------------------------------------" endif ############################################################################### + +config BR2_TARGET_GENERIC_PASSWD_MD5 + bool "target passwd md5 format support has been removed" + select BR2_LEGACY + help + The default has been moved to SHA256 and all C libraries + now support that method by default + comment "Legacy options removed in 2018.11" config BR2_TARGET_XLOADER
system/Config.in +0 -10
@@ -68,16 +68,6 @@ choice Note: this is used at build-time, and *not* at runtime. -config BR2_TARGET_GENERIC_PASSWD_MD5 - bool "md5" - help - Use MD5 to encode passwords. - - The default. Wildly available, and pretty good. - Although pretty strong, MD5 is now an old hash function, and - suffers from some weaknesses, which makes it susceptible to - brute-force attacks. - config BR2_TARGET_GENERIC_PASSWD_SHA256 bool "sha-256" help
Signature · 1 line
1.9.1
PATCH 2/2 system cfg: remove passwd MD5 format
Matt, All,
On 2018-12-05 10:33 -0600, Matt Weber spake thusly:
Quoted 6 lines
As SHA256 is now default, removing weak MD5 option. C libraries now all support the SHA methods.
glibc 2.7+ uclibc (bdd8362a88 package/uclibc: defconfig: enable sha-256...) musl 1.1.14+
Quoted 8 lines
One issue this would prevent is a host tool issue with a FIPS enabled system where weak ciphers/methods are disabled. The crypt(3) call checks
/proc/sys/crypto/fips_enabledand would result in mkpasswd returning "crypt failed." Rather then create a host dependency check this patch removes the potential issue.Cc Yann E. MORIN <[email protected]>Signed-off-by Matthew Weber <[email protected]>
Regards,
Yann E. MORIN.
Quoted 48 lines
--- Config.in.legacy | 8 ++++++++ system/Config.in | 10 ---------- 2 files changed, 8 insertions(+), 10 deletions(-)Config.in.legacy +8
-0@@ -143,6 +143,14 @@ comment "----------------------------------------------------" endif ############################################################################### + +config BR2_TARGET_GENERIC_PASSWD_MD5 + bool "target passwd md5 format support has been removed" + select BR2_LEGACY + help + The default has been moved to SHA256 and all C libraries + now support that method by default + comment "Legacy options removed in 2018.11" config BR2_TARGET_XLOADERsystem/Config.in +0
-10@@ -68,16 +68,6 @@ choice Note: this is used at build-time, and *not* at runtime. -config BR2_TARGET_GENERIC_PASSWD_MD5 - bool "md5" - help - Use MD5 to encode passwords. - - The default. Wildly available, and pretty good. - Although pretty strong, MD5 is now an old hash function, and - suffers from some weaknesses, which makes it susceptible to - brute-force attacks. - config BR2_TARGET_GENERIC_PASSWD_SHA256 bool "sha-256" helpSignature · 1 line
1.9.1
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'
PATCH 2/2 system cfg: remove passwd MD5 format
In reply to Matt WeberQuoted 7 lines · Matt Weber
As SHA256 is now default, removing weak MD5 option. C libraries now all support the SHA methods.
glibc 2.7+ uclibc (bdd8362a88 package/uclibc: defconfig: enable sha-256...) musl 1.1.14+
Quoted 5 lines
One issue this would prevent is a host tool issue with a FIPS enabled system where weak ciphers/methods are disabled. The crypt(3) call checks
/proc/sys/crypto/fips_enabledand would result in mkpasswd returning "crypt failed." Rather then create a host dependency check this patch removes the potential issue.
A little more research has me changing the reasoning a bit. This actually makes more sense. Our host/bin/mkpasswd uses the host systems PAM "sufficient algorithm" rules when creating the password.
(https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2016-06-05/finding/V-38574)
It just so happens the system we were looking at this issue on was
also configured for other FIPS related desired cipher/hashes.
Quoted 51 lines
Cc Yann E. MORIN <[email protected]>Signed-off-by Matthew Weber <[email protected]>--- Config.in.legacy | 8 ++++++++ system/Config.in | 10 ---------- 2 files changed, 8 insertions(+), 10 deletions(-)Config.in.legacy +8
-0@@ -143,6 +143,14 @@ comment "----------------------------------------------------" endif ############################################################################### + +config BR2_TARGET_GENERIC_PASSWD_MD5 + bool "target passwd md5 format support has been removed" + select BR2_LEGACY + help + The default has been moved to SHA256 and all C libraries + now support that method by default + comment "Legacy options removed in 2018.11" config BR2_TARGET_XLOADERsystem/Config.in +0
-11@@ -68,16 +68,6 @@ choice Note: this is used at build-time, and *not* at runtime. -config BR2_TARGET_GENERIC_PASSWD_MD5 - bool "md5" - help - Use MD5 to encode passwords. - - The default. Wildly available, and pretty good. - Although pretty strong, MD5 is now an old hash function, and - suffers from some weaknesses, which makes it susceptible to - brute-force attacks. - config BR2_TARGET_GENERIC_PASSWD_SHA256 bool "sha-256" help --1.9.1
Signature · 19 lines
Matthew Weber | Pr. Software Engineer | Commercial Avionics COLLINS AEROSPACE 400 Collins Road NE, Cedar Rapids, Iowa 52498, USA Tel: +1 319 295 7349 | FAX: +1 319 263 6099 matthew.weber at collins.com | collinsaerospace.com CONFIDENTIALITY WARNING: This message may contain proprietary and/or privileged information of Collins Aerospace and its affiliated companies. If you are not the intended recipient, please 1) Do not disclose, copy, distribute or use this message or its contents. 2) Advise the sender by return email. 3) Delete all copies (including all attachments) from your computer. Your cooperation is greatly appreciated.
PATCH 2/2 system cfg: remove passwd MD5 format
All,
Quoted 16 lines · Matthew Weber
Quoted 7 lines · Matt Weber
As SHA256 is now default, removing weak MD5 option. C libraries now all support the SHA methods.
glibc 2.7+ uclibc (bdd8362a88 package/uclibc: defconfig: enable sha-256...) musl 1.1.14+Quoted 5 lines
One issue this would prevent is a host tool issue with a FIPS enabled system where weak ciphers/methods are disabled. The crypt(3) call checks
/proc/sys/crypto/fips_enabledand would result in mkpasswd returning "crypt failed." Rather then create a host dependency check this patch removes the potential issue.
Quoted 6 lines
A little more research has me changing the reasoning a bit. This actually makes more sense. Our host/bin/mkpasswd uses the host systems PAM "sufficient algorithm" rules when creating the password.
(https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2016-06-05/finding/V-38574)
It just so happens the system we were looking at this issue on was
also configured for other FIPS related desired cipher/hashes.
Oops that doesn't seem to be valid for mkpasswd. just passwd. I'll refresh my description when I split the first patch.
Quoted 75 lines
Quoted 50 lines
Cc Yann E. MORIN <[email protected]>Signed-off-by Matthew Weber <[email protected]>--- Config.in.legacy | 8 ++++++++ system/Config.in | 10 ---------- 2 files changed, 8 insertions(+), 10 deletions(-)Config.in.legacy +8
-0@@ -143,6 +143,14 @@ comment "----------------------------------------------------" endif ############################################################################### + +config BR2_TARGET_GENERIC_PASSWD_MD5 + bool "target passwd md5 format support has been removed" + select BR2_LEGACY + help + The default has been moved to SHA256 and all C libraries + now support that method by default + comment "Legacy options removed in 2018.11" config BR2_TARGET_XLOADERsystem/Config.in +0
-11@@ -68,16 +68,6 @@ choice Note: this is used at build-time, and *not* at runtime. -config BR2_TARGET_GENERIC_PASSWD_MD5 - bool "md5" - help - Use MD5 to encode passwords. - - The default. Wildly available, and pretty good. - Although pretty strong, MD5 is now an old hash function, and - suffers from some weaknesses, which makes it susceptible to - brute-force attacks. - config BR2_TARGET_GENERIC_PASSWD_SHA256 bool "sha-256" help --Quoted 2 lines
1.9.1
--
Matthew Weber | Pr. Software Engineer | Commercial Avionics
COLLINS AEROSPACE
400 Collins Road NE, Cedar Rapids, Iowa 52498, USA
Tel: +1 319 295 7349 | FAX: +1 319 263 6099
matthew.weber at collins.com | collinsaerospace.com
CONFIDENTIALITY WARNING: This message may contain proprietary and/or privileged information of Collins Aerospace and its affiliated companies. If you are not the intended recipient, please 1) Do not disclose, copy, distribute or use this message or its contents. 2) Advise the sender by return email. 3) Delete all copies (including all attachments) from your computer. Your cooperation is greatly appreciated.
Signature · 19 lines
Matthew Weber | Pr. Software Engineer | Commercial Avionics COLLINS AEROSPACE 400 Collins Road NE, Cedar Rapids, Iowa 52498, USA Tel: +1 319 295 7349 | FAX: +1 319 263 6099 matthew.weber at collins.com | collinsaerospace.com CONFIDENTIALITY WARNING: This message may contain proprietary and/or privileged information of Collins Aerospace and its affiliated companies. If you are not the intended recipient, please 1) Do not disclose, copy, distribute or use this message or its contents. 2) Advise the sender by return email. 3) Delete all copies (including all attachments) from your computer. Your cooperation is greatly appreciated.
PATCH 1/2 system cfg: default mkpasswd to SHA
In reply to Matt WeberMatt, All,
On 2018-12-05 10:33 -0600, Matt Weber spake thusly:
Quoted 8 lines
This patch drops the comment about checking the C libraries version as they now all support it by default
glibc 2.7+ uclibc (bdd8362a88 package/uclibc: defconfig: enable sha-256...) musl 1.1.14+This patch updates the help text and changes the default mkpasswd method to SHA256 from MD5
Really, this patch does two things:
- update my now-wrong comments,
- switch to using sha256 as the default;
so it should be two patches.
Besides, more comments, below...
Quoted 20 lines
Cc Yann E. MORIN <[email protected]>Signed-off-by Matthew Weber <[email protected]>--- system/Config.in | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)system/Config.in +1
-1@@ -61,7 +61,7 @@ endif choice bool "Passwords encoding" - default BR2_TARGET_GENERIC_PASSWD_MD5 + default BR2_TARGET_GENERIC_PASSWD_SHA256 help Choose the password encoding scheme to use when Buildroot needs to encode a password (eg. the root password, below).
system/Config.in config BR2_TARGET_GENERIC_PASSWD_MD5 · line 84
Quoted 9 lines
system/Config.in +1
-5@@ -81,20 +81,12 @@ config BR2_TARGET_GENERIC_PASSWD_MD5 config BR2_TARGET_GENERIC_PASSWD_SHA256 bool "sha-256" help - Use SHA256 to encode passwords. - - Very strong, but not ubiquitous, although available in glibc - for some time now. Choose only if you are sure your C library - understands SHA256 passwords. + Use SHA256 to encode passwords which is stronger then MD5.
s/then/than/
system/Config.in config BR2_TARGET_GENERIC_PASSWD_MD5 · line 89
Quoted 9 lines
system/Config.in +1
-5config BR2_TARGET_GENERIC_PASSWD_SHA512 bool "sha-512" help - Use SHA512 to encode passwords. - - Extremely strong, but not ubiquitous, although available in - glibc for some time now. Choose only if you are sure your C - library understands SHA512 passwords. + Use SHA512 to encode passwords which is stronger then SHA256
s/then/than/
With that fix, and the patch split in two, you can add, to each, my:
Reviewed-by: "Yann E. MORIN" <[email protected]>
Regards,
Yann E. MORIN.
Quoted 5 lines
system/Config.in +0
-0endchoice # Passwd encodingSignature · 1 line
1.9.1
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'