| Summary: | The installer should rely on /etc/libuser.conf to decide which password encryption to use | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Frédéric "LpSolit" Buclin <LpSolit> |
| Component: | Installer | Assignee: | Mageia tools maintainers <mageiatools> |
| Status: | NEW --- | QA Contact: | |
| Severity: | enhancement | ||
| Priority: | Low | CC: | bequimao.de, marja11 |
| Version: | Cauldron | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: | https://bugs.mageia.org/show_bug.cgi?id=20342 | ||
| Whiteboard: | |||
| Source RPM: | CVE: | ||
| Status comment: | |||
|
Marja Van Waes
2017-02-24 20:00:30 CET
CC:
(none) =>
marja11
Marja Van Waes
2017-02-24 20:01:01 CET
See Also:
(none) =>
https://bugs.mageia.org/show_bug.cgi?id=20342
Ulrich Beckmann
2017-02-28 12:39:18 CET
CC:
(none) =>
bequimao.de sha512 seems to be a bad choice, since most Linux distributions use blowfish. Added see also #18986. Kwallet-pam uses blowfish, and thus 'single sign on' is no longer possible with a wrong hash. As kwallet-pam seem to be broken anyway, I could not verify this relationship. Also I do not know, how gnome-keyring works. Ulrich See Also:
(none) =>
https://bugs.mageia.org/show_bug.cgi?id=18986 (In reply to Ulrich Beckmann from comment #1) > sha512 seems to be a bad choice, since most Linux distributions use > blowfish. I installed and tested Linux Mint and OpenSUSE, and they both use SHA-512. SHA-512 is not a bad choice, it's just different from blowfish. The advantage of blowfish is that it's slower than SHA-512, on purpose. But this is not the topic of this bug. :) (In reply to Frédéric Buclin from comment #2) > I installed and tested Linux Mint and OpenSUSE, and they both use SHA-512. > SHA-512 is not a bad choice, it's just different from blowfish. The > advantage of blowfish is that it's slower than SHA-512, on purpose. But this > is not the topic of this bug. :) You are right. My assumption and test in https://bugs.mageia.org/show_bug.cgi?id=18986#c9 is invalid. You should add # passwd to your list of applications. I found that passwd could change the encryption method. Ulrich
Ulrich Beckmann
2017-02-28 19:45:55 CET
See Also:
https://bugs.mageia.org/show_bug.cgi?id=18986 =>
(none) |
Currently, the password encryption is defined in 4 different places: /lib/libDrakX/install/install2.pm, used by the installer when creating the root and user accounts: authentication => { sha512 => 1, shadow => 1 } /lib/libDrakX/authentication.pm twice, the first one via /etc/pam.d/system-auth (for adduserdrake) and the 2nd one hardcoded (as fallback method): sub get() { my $system_auth = cat_("/etc/pam.d/system-auth"); sub user_crypted_passwd { my ($u, $authentication) = @_; ... # Default to sha512 $authentication = { sha512 => 1 } unless $authentication; and /etc/libuser.conf (for drakuser): crypt_style = sha512 IMHO, and unless I miss something important, they should all rely on a single source to determine which encryption to use, probably /etc/libuser.conf. The fact that the installer, drakuser and adduserdrake use 3 different sources is totally confusing and prone to inconsistencies, see e.g. bug 20342.