Bug 20342

Summary: Use SHA-512 instead of blowfish as the default password encryption for the root and user accounts on install
Product: Mageia Reporter: Frédéric "LpSolit" Buclin <LpSolit>
Component: InstallerAssignee: Frédéric "LpSolit" Buclin <LpSolit>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Normal CC: mageia, mageiatools, marja11, pterjan, thierry.vignaud
Version: CauldronKeywords: PATCH
Target Milestone: Mageia 6   
Hardware: All   
OS: Linux   
See Also: https://bugs.mageia.org/show_bug.cgi?id=20344
Whiteboard:
Source RPM: CVE:
Status comment:
Attachments: fix default password encryption, v1

Description Frédéric "LpSolit" Buclin 2017-02-24 02:27:42 CET 
The installer uses blowfish to hash passwords in /etc/shadow, but subsequent user account creation with drakuser uses SHA-512 as specified in /etc/libuser.conf, see bug 16467:

crypt_style = sha512

For consistency, the installer should use SHA-512 too instead of blowfish.
Comment 1 Frédéric "LpSolit" Buclin 2017-02-24 02:31:19 CET 
Created attachment 8984 [details]
fix default password encryption, v1

Here is the patch, which fixes install2.pm.
Comment 2 Frédéric "LpSolit" Buclin 2017-02-24 02:32:15 CET 
Thierry: could you have a look at this patch, please?

CC: (none) => thierry.vignaud

Comment 3 Thierry Vignaud 2017-02-24 08:53:39 CET 
CCing Pascal which did the original work:
http://gitweb.mageia.org/software/drakx/commit/?id=c0529b4c5858300c0bd9c94fd35540e1f105dfd6

Keywords: (none) => PATCH
CC: (none) => pterjan

Comment 4 Nicolas Lécureuil 2017-02-24 10:42:58 CET 
sound good for me and more coherent with pascal previous changes.

CC: (none) => mageia

Marja Van Waes 2017-02-24 20:00:03 CET

CC: (none) => mageiatools, marja11

Marja Van Waes 2017-02-24 20:01:01 CET

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=20344

Comment 5 Mageia Robot 2017-02-25 08:40:55 CET 
commit 67d8f423c623740a1118b80d2c5e4489d432cc26
Author: Frédéric Buclin <LpSolit@...>
Date:   Sat Feb 25 07:55:40 2017 +0100

    use SHA-512 instead of blowfish
    
    as the default password encryption (mga#20342)
    
    thus completing commit c0529b4c5858300c0bd9c94fd35540e1f105dfd6
---
 Commit Link:
   http://gitweb.mageia.org/software/drakx/commit/?id=67d8f423c623740a1118b80d2c5e4489d432cc26
Comment 6 Thierry Vignaud 2017-02-25 08:41:17 CET 
Closing

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED