From: Johnathan Mantey <johnathanx.mantey@intel.com>
To: Patrick Williams <patrick@stwcx.xyz>
Cc: OpenBMC List <openbmc@lists.ozlabs.org>
Subject: Re: meta-phosphor: enable `allow-root-login`?
Date: Tue, 4 Jan 2022 11:24:28 -0800 [thread overview]
Message-ID: <751ead02-272c-6882-5108-dc5df3bbfc53@intel.com> (raw)
In-Reply-To: <YdSRSUhGYWj58YJb@heinlein>
[-- Attachment #1.1.1: Type: text/plain, Size: 1696 bytes --]
On 1/4/22 10:26, Patrick Williams wrote:
> On Tue, Jan 04, 2022 at 07:32:06AM -0800, Johnathan Mantey wrote:
>> Patrick....
>>
>> On 12/30/21 05:52, Patrick Williams wrote:
>>> I am currently enabling this IMAGE_FEATURE in meta-facebook to avoid having this
>>> happen again. Is there any reason why we wouldn't want to enable it by default
>>> in meta-phosphor? There isn't really full support for non-root users in the
>>> base systems anyhow, so is there anyone that wouldn't want "allow-root-login"
>>> enabled by default?
>> Intel explicitly requires root login to be disabled for production
>> releases. Especially since the default password is a known quantity.
>>
>> The Intel security audit group enforced blocking a default user for the
>> S2600 WF/BNP/STP series of servers. All user accounts are created using
>> local IPMI commands.
> Is this currently able to be done with all upstream functionality or something
> that only works in your own forks?
As a developer for Intel I have to explicitly add 'debug-tweaks' back
into our bitbake config. I've not dug into who made the decision, and
which layer of the build process enforced it.
>
>> Intel will prefer the existing behavior remain.
> It seems to me that the current behavior is broken for typical cases using
> currently upstreamed functionality and so that's why I'm suggesting that
> meta-phosphor be "fixed". It'd be pretty easy to IMAGE_FEATURE:remove this
> for meta-intel-bmc, right?
>
--
Johnathan Mantey
Senior Software Engineer
*azad te**chnology partners*
Contributing to Technology Innovation since 1992
Phone: (503) 712-6764
Email: johnathanx.mantey@intel.com
[-- Attachment #1.1.2: Type: text/html, Size: 3389 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
next prev parent reply other threads:[~2022-01-04 19:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-30 13:52 meta-phosphor: enable `allow-root-login`? Patrick Williams
2022-01-04 15:32 ` Johnathan Mantey
2022-01-04 18:26 ` Patrick Williams
2022-01-04 19:24 ` Johnathan Mantey [this message]
2022-01-04 18:32 ` Ed Tanous
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=751ead02-272c-6882-5108-dc5df3bbfc53@intel.com \
--to=johnathanx.mantey@intel.com \
--cc=openbmc@lists.ozlabs.org \
--cc=patrick@stwcx.xyz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.