Current-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Which password cipher ?



On 12/1/10 10:05 AM, Antti Kantee wrote:
Because the standard solution around here is to not have a solution
and add flags and toggles and levers and knobs, i.e. outsource the
discussion.
My original question was more rhetorical than anything else ;P
Does sysinst even make it possible to select sha1?  Yes, let's just
drop the question from sysinst.
Yes it does; it actually offers 4 choices (last time I checked) and no explanation whatsoever (other than the 8-char limitation of DES) as to why you would want one or the other.

If we are to change the default, I presume the right way to do this would be to modify the default passwd.conf file in src/etc and drop all code that mucks with it from sysinst. See attached patch.
Index: etc/passwd.conf
===================================================================
RCS file: /cvsroot/src/etc/passwd.conf,v
retrieving revision 1.2
diff -u -p -r1.2 passwd.conf
--- etc/passwd.conf     15 Apr 2002 07:48:00 -0000      1.2
+++ etc/passwd.conf     1 Dec 2010 11:06:49 -0000
@@ -4,6 +4,6 @@
 #      password configuration file
 #
 
-#default:
-#      localcipher = md5
-#      ypcipher = old
+default:
+       localcipher = sha1
+       ypcipher = sha1
Index: distrib/utils/sysinst/defs.h
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/defs.h,v
retrieving revision 1.148
diff -u -p -r1.148 defs.h
--- distrib/utils/sysinst/defs.h        27 Jan 2010 11:02:03 -0000      1.148
+++ distrib/utils/sysinst/defs.h        1 Dec 2010 11:06:49 -0000
@@ -409,7 +409,6 @@ unsigned int    set_X11_selected(void);
 int    get_and_unpack_sets(int, msg, msg, msg);
 int    sanity_check(void);
 int    set_timezone(void);
-void   set_crypt_type(void);
 int    set_root_password(void);
 int    set_root_shell(void);
 void   scripting_fprintf(FILE *, const char *, ...);
Index: distrib/utils/sysinst/install.c
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/install.c,v
retrieving revision 1.43
diff -u -p -r1.43 install.c
--- distrib/utils/sysinst/install.c     19 Sep 2009 14:57:27 -0000      1.43
+++ distrib/utils/sysinst/install.c     1 Dec 2010 11:06:49 -0000
@@ -123,8 +123,6 @@ do_install(void)
 
        set_timezone();
 
-       set_crypt_type();
-
        set_root_password();
        set_root_shell();
        
Index: distrib/utils/sysinst/menus.mi
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/menus.mi,v
retrieving revision 1.38
diff -u -p -r1.38 menus.mi
--- distrib/utils/sysinst/menus.mi      30 Mar 2010 20:09:25 -0000      1.38
+++ distrib/utils/sysinst/menus.mi      1 Dec 2010 11:06:49 -0000
@@ -293,13 +293,6 @@ menu fdok, title MSG_What_do_you_want_to
        option MSG_Set_finished, exit, action { *(int *)arg = SET_OK; };
        option MSG_Abort_fetch, exit, action { *(int *)arg = SET_RETRY; };
 
-menu crypttype, title MSG_Password_cipher, y=15;
-       option MSG_SHA1, exit, action { yesno = 4; };
-       option MSG_DES, exit, action { yesno = 1; };
-       option MSG_MD5, exit, action { yesno = 2; };
-       option MSG_Blowfish_2_7_round, exit, action { yesno = 3; };
-       option MSG_do_not_change, exit, action { yesno = 0; };
-
 menu fd_type, title MSG_fd_type, y=16;
        option "msdos", exit, action { fd_type = "msdos"; };
        option "ffs",   exit, action { fd_type = "ffs"; };
Index: distrib/utils/sysinst/msg.mi.de
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/msg.mi.de,v
retrieving revision 1.52
diff -u -p -r1.52 msg.mi.de
--- distrib/utils/sysinst/msg.mi.de     30 Mar 2010 20:09:25 -0000      1.52
+++ distrib/utils/sysinst/msg.mi.de     1 Dec 2010 11:06:49 -0000
@@ -890,22 +890,6 @@ die Taste 'x' gefolgt von der Eingabetas
 message tz_back
 { Zurück zum Zeitzonenmenü.}
 
-message choose_crypt
-{Bitte wählen Sie den gewünschten Ver-/Entschlüsselungsalgorithmus (Cipher)
-für Benutzerpassworte. NetBSD kann DES, MD5, Blowfish oder SHA1 benutzen.
-
-Das traditionelle DES-System ist mit den meisten anderen UNIX-ähnlichen
-Betriebssystemen kompatibel, allerdings werden nur die ersten 8 Zeichen eines
-jeden Passworts berücksichtigt. Das MD5, Blowfish und SHA1 System erlaubt
-längere Passwörter, was unter Umständen als sicherer interpretiert werden kann.
-
-Wenn Sie ein Netzwerk haben und planen, NIS zu nutzen, berücksichtigen
-Sie hier bitte auch die Möglichkeiten der anderen Maschinen im Netzwerk.
-
-Wenn Sie NetBSD aktualisieren und die bestehende Konfiguration nicht
-verändern möchten, so wählen Sie "Beibehalten".
-}
-
 message swapactive
 {Das Laufwerk, das Sie ausgewählt haben, verfügt über eine Swappartition, die
 gegenwärtig auch benutzt wird.
@@ -998,12 +982,6 @@ message Skip_set {Paket überspringen}
 message Skip_group {Paketgruppe überspringen}
 message Abandon {Installation abbrechen}
 message Abort_fetch {Holen abbrechen}
-message Password_cipher {Passwort Verschlüsselungsverfahren}
-message DES {DES}
-message MD5 {MD5}
-message Blowfish_2_7_round {Blowfish mit 2^7 Wiederholungen}
-message SHA1 {SHA1}
-message do_not_change {Beibehalten}
 message Device {Gerät}
 message File_system {Dateisystem}
 message Select_IPv6_DNS_server {  Auswählen eines IPv6 DNS Servers}
Index: distrib/utils/sysinst/msg.mi.en
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/msg.mi.en,v
retrieving revision 1.160
diff -u -p -r1.160 msg.mi.en
--- distrib/utils/sysinst/msg.mi.en     30 Mar 2010 20:09:25 -0000      1.160
+++ distrib/utils/sysinst/msg.mi.en     1 Dec 2010 11:06:50 -0000
@@ -831,22 +831,6 @@ Press 'x' followed by RETURN to quit the
 message tz_back
 { Back to main timezone list}
 
-message choose_crypt
-{Please choose the password cipher to use. NetBSD can be configured to use
-either the DES, MD5, Blowfish or SHA1 schemes.
-
-The traditional DES scheme is compatible with most other Unix-like operating
-systems, but only the first 8 characters of any password will be recognised.
-The MD5, Blowfish and SHA1 schemes allow for longer passwords, and some would
-argue that it's more secure.
-
-If you have a network and intend to use NIS, please bear in mind the
-capabilities of other machines on your network.
-
-If you are upgrading and would like to keep configuration unchanged,
-choose the last option "do not change".
-}
-
 message swapactive
 {The disk that you selected has a swap partition that may currently be
 in use if your system is low on memory. Because you are going to
@@ -940,12 +924,6 @@ message Skip_set {Skip set}
 message Skip_group {Skip set group}
 message Abandon {Abandon installation}
 message Abort_fetch {Abort fetch}
-message Password_cipher {Password cipher}
-message DES {DES}
-message MD5 {MD5}
-message Blowfish_2_7_round {Blowfish 2^7 round}
-message SHA1 {SHA1}
-message do_not_change {do not change}
 message Device {Device}
 message File_system {File system}
 message Select_IPv6_DNS_server {  Select IPv6 DNS server}
Index: distrib/utils/sysinst/msg.mi.es
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/msg.mi.es,v
retrieving revision 1.29
diff -u -p -r1.29 msg.mi.es
--- distrib/utils/sysinst/msg.mi.es     30 Mar 2010 20:09:25 -0000      1.29
+++ distrib/utils/sysinst/msg.mi.es     1 Dec 2010 11:06:50 -0000
@@ -855,23 +855,6 @@ zona horaria.
 message tz_back
 { Volver a la lista principal de zonas horarias}
 
-message choose_crypt
-{Por favor, seleccione el algoritmo de cifrado de contraseñas a usar.
-NetBSD puede ser configurado para usar los esquemas DES, MD5 o Blowfish.
-
-El esquema tradicional DES es compatible con la mayoría de los demás
-sistemas operativos de tipo Unix, pero sólo se reconocerán los primeros 8
-carácteres de cualquier contraseña.
-Los esquemas MD5 y Blowfish permiten contraseñas más largas, y algunos
-aseguran que es más seguro.
-
-Si tiene una red y pretende usar NIS, por favor considere las capacidades
-de otras máquinas en su red.
-
-Si está actualizando y le gustaria mantener la configuración sin cambios,
-escoja la última opción «no cambiar».
-}
-
 message swapactive
 {El disco que ha seleccionado tiene una partición de intercambio (swap) que
 puede que esté en uso actualmente si su sistema tiene poca memoria.  Como 
@@ -966,12 +949,6 @@ message Skip_set {Omitir conjunto}
 message Skip_group {Omitir grupo de conjuntos}
 message Abandon {Abandonar instalación}
 message Abort_fetch {Abortar lectura}
-message Password_cipher {Cifrado de las contraseñas}
-message DES {DES}
-message MD5 {MD5}
-message Blowfish_2_7_round {Blowfish 2^7 round}
-message SHA1 {SHA1}
-message do_not_change {no cambiar}
 message Device {Dispositivo}
 message File_system {Sistema de archivos}
 message Select_IPv6_DNS_server {  Seleccione servidor DNS de IPv6}
Index: distrib/utils/sysinst/msg.mi.fr
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/msg.mi.fr,v
retrieving revision 1.110
diff -u -p -r1.110 msg.mi.fr
--- distrib/utils/sysinst/msg.mi.fr     30 Mar 2010 20:09:25 -0000      1.110
+++ distrib/utils/sysinst/msg.mi.fr     1 Dec 2010 11:06:50 -0000
@@ -912,23 +912,6 @@ Appuyez sur "x" puis Entrée pour valider
 message tz_back
 { Retour à la liste principale des fuseaux horaires}
 
-message choose_crypt   
-{
-Veuillez sélectionner le type de hachage des mots de passe.
-NetBSD supporte DES, MD5, Blowfish et SHA1.
-
-DES est compatible avec la plupart des systèmes de type Unix mais ne
-permet pas d'utiliser plus de huit caractères pour les mots de passe.
-MD5, Blowfish et SHA1 permettent d'utiliser des mots de passe plus longs,
-ce qui peut être plus sécurisé.
-
-Si votre réseau comporte NIS, veuillez vérifier la capacité des
-autres machines composant ce dernier.
-
-Si vous effectuez une mise à jour et que vous souhaitez conserver la
-configuration déjà existante, veuillez choisir "Ne rien changer".
-}
-
 message swapactive
 {
 Le disque sélectionné dispose d'une partition d'échange (swap) qui
@@ -1032,12 +1015,6 @@ message Skip_set {Sauter cet ensemble}
 message Skip_group {Sauter ce groupe}
 message Abandon {Abandonner l'installation}
 message Abort_fetch {Annuler la récupération}
-message Password_cipher {Chiffrement du mot de passe}
-message DES {DES}
-message MD5 {MD5}
-message Blowfish_2_7_round {Blowfish à 2^7 rondes}
-message SHA1 {SHA1}
-message do_not_change {ne rien changer}
 message Device {Périphérique}
 message File_system {Système de fichiers}
 message Select_IPv6_DNS_server {  Choisissez un serveur de noms IPv6 :}
Index: distrib/utils/sysinst/msg.mi.pl
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/msg.mi.pl,v
retrieving revision 1.68
diff -u -p -r1.68 msg.mi.pl
--- distrib/utils/sysinst/msg.mi.pl     30 Mar 2010 20:09:25 -0000      1.68
+++ distrib/utils/sysinst/msg.mi.pl     1 Dec 2010 11:06:50 -0000
@@ -828,22 +828,6 @@ Nacisnij 'x' a potem ENTER aby wyjsc.
 message tz_back
 {Powroc do glownej listy stref}
 
-message choose_crypt
-{Wybierz sposob szyfrowania hasel, ktorego chcesz uzywac. NetBSD moze korzystac
-z DES, MD5 lub Blowfish.
-
-Tradycyjna metoda DES jest kompatybilna z wiekszoscia unixowych systemow
-operacyjnych, ale wtedy tylko 8 pierwszych znakow w hasle jest rozpoznawanych.
-Metody MD5 oraz Blowfish umozliwiaja dluzsze hasla, niektorzy uwazaja to za
-bardziej bezpieczne.
-
-Jesli posiadasz siec oraz zamierasz korzystac z NIS, pamietaj o mozliwosciach
-maszyn w twojej sieci i wynikajacych stad ograniczeniach.
-
-Jezeli uaktualniasz swoj system i nie chcesz, aby zostaly dokonane zmiany w
-konfiguracji, wybierz ostatnia opcje "nie zmieniaj".
-}
-
 message swapactive
 {Dysk, ktory wybrales posiada partycje wymiany, ktora moze byc aktualnie
 w uzyciu jesli twoj system ma malo pamieci. Poniewaz chcesz zmienic uklad
@@ -933,12 +917,6 @@ message Skip_set {Pomin pakiet}
 message Skip_group {Pomin grupe pakietow}
 message Abandon {Przerwij instalacje}
 message Abort_fetch {Przerwij pobieranie}
-message Password_cipher {Kodowanie hasel}
-message DES {DES}
-message MD5 {MD5}
-message Blowfish_2_7_round {Blowfish 2^7 round}
-message SHA1 {SHA1}
-message do_not_change {nie zmieniaj}
 message Device {Urzadzenie}
 message File_system {SystemPlikow}
 message Select_IPv6_DNS_server {  Wybierz serwer nazw IPv6}
Index: distrib/utils/sysinst/util.c
===================================================================
RCS file: /cvsroot/src/distrib/utils/sysinst/util.c,v
retrieving revision 1.165
diff -u -p -r1.165 util.c
--- distrib/utils/sysinst/util.c        5 Apr 2010 22:53:02 -0000       1.165
+++ distrib/utils/sysinst/util.c        1 Dec 2010 11:06:50 -0000
@@ -1354,41 +1354,6 @@ done:
        return 1;
 }
 
-static
-void
-replace_crypt_type(const char *localcipher, const char *ypcipher)
-{
-
-       replace("/etc/passwd.conf", "s/^.*default:.*$/default:/;"
-           "s/^.*localcipher.*$/\tlocalcipher = %s/;"
-           "s/^.*ypcipher.*$/\typcipher = %s/", localcipher, ypcipher);
-}
-
-void
-set_crypt_type(void)
-{
-
-       msg_display(MSG_choose_crypt);
-       process_menu(MENU_crypttype, NULL);
-
-       switch (yesno) {
-       case 0:
-               break;
-       case 1: /* DES */
-               replace_crypt_type("old", "old");
-               break;
-       case 2: /* MD5 */
-               replace_crypt_type("md5", "md5");
-               break;
-       case 3: /* blowfish 2^7 */
-               replace_crypt_type("blowfish,7", "blowfish,7");
-               break;
-       case 4: /* sha1 */
-               replace_crypt_type("sha1", "sha1");
-               break;
-       }
-}
-
 int
 set_root_password(void)
 {
Index: doc/CHANGES
===================================================================
RCS file: /cvsroot/src/doc/CHANGES,v
retrieving revision 1.1464
diff -u -p -r1.1464 CHANGES
--- doc/CHANGES 28 Nov 2010 00:26:39 -0000      1.1464
+++ doc/CHANGES 1 Dec 2010 11:06:50 -0000
@@ -792,3 +792,8 @@ Changes from NetBSD 5.0 to NetBSD 6.0:
        dhcpcd(8): Import dhcpcd-5.2.9. [roy 20101127]
        postfix(1): Import version 2.7.2 [tron 20101127]
        module: Rename <module>.prop to <module>.plist.  [jnemeth 20101127]
+       passwd.conf(5): Set the default cyphers for passwords to 'sha1'.
+               [jmmv 20101201]
+       sysinst(8): Drop the question to select a password cypher algorithm
+               in favor of a saner default setting that can later be changed
+               by the user.  [jmmv 20101112]
Index: share/man/man5/passwd.conf.5
===================================================================
RCS file: /cvsroot/src/share/man/man5/passwd.conf.5,v
retrieving revision 1.9
diff -u -p -r1.9 passwd.conf.5
--- share/man/man5/passwd.conf.5        3 Oct 2009 12:45:15 -0000       1.9
+++ share/man/man5/passwd.conf.5        1 Dec 2010 11:06:50 -0000
@@ -28,7 +28,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd September 4, 2005
+.Dd December 1, 2010
 .Dt PASSWD.CONF 5
 .Os
 .Sh NAME
@@ -57,6 +57,7 @@ Some fields and their possible values th
 .Bl -tag -width localcipher
 .It Sy localcipher
 The cipher to use for local passwords.
+.Pp
 Possible values are:
 .Dq old ,
 .Dq newsalt,\*[Lt]rounds\*[Gt] ,
@@ -75,9 +76,16 @@ For
 .Dq blowfish
 the value can be between 4 and 31.
 It specifies the base 2 logarithm of the number of rounds.
+.Pp
+If not specified, the default value is
+.Dq old .
 .It Sy ypcipher
 The cipher to use for YP passwords.
+.Pp
 The possible values are the same as for localcipher.
+.Pp
+If not specified, the default value is
+.Dq old .
 .El
 .Pp
 To retrieve information from this file use
@@ -107,3 +115,14 @@ The
 .Nm
 configuration file first appeared in
 .Nx 1.6 .
+.Pp
+The default values of
+.Sy localcypher
+and
+.Sy ypcipher
+were set to
+.Dq sha1
+in
+.Pa /etc/passwd.conf
+starting from
+.Nx 6.0 .


Home | Main Index | Thread Index | Old Index