From: Patrick Williams <patrick@stwcx.xyz>
To: Joseph Reynolds <jrey@linux.ibm.com>
Cc: openbmc <openbmc@lists.ozlabs.org>
Subject: Re: Security Working Group meeting - Wednesday August 4
Date: Tue, 3 Aug 2021 22:28:47 -0500 [thread overview]
Message-ID: <YQoJb72EMj1Sk1Lg@heinlein> (raw)
In-Reply-To: <89b3524f-a1b3-513c-fc6a-1d888e479238@linux.ibm.com>
[-- Attachment #1: Type: text/plain, Size: 5187 bytes --]
On Tue, Aug 03, 2021 at 05:57:52PM -0500, Joseph Reynolds wrote:
> 2. (Joseph): Updated password hash algorithm from MD5 to SHA512 (while
> keeping the same cleartext password)
> https://gerrit.openbmc-project.xyz/c/openbmc/openbmc/+/45214
> <https://gerrit.openbmc-project.xyz/c/openbmc/openbmc/+/45214>
The big hangup on this one right now is that there are tons of overrides of
EXTRA_USERS_PARAMS in a bunch of `local.conf.sample` files. Does anyone know
why these are there rather than relying on the ones we get for free from the
meta-phosphor layer? Does anyone have a problem if they are removed?
```
$ find -name local.conf.sample | xargs grep usermod -B1
./meta-evb/meta-evb-aspeed/meta-evb-ast2500/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-aspeed/meta-evb-ast2500/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-aspeed/meta-evb-ast2600/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-aspeed/meta-evb-ast2600/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-enclustra/meta-evb-zx3-pm3/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-enclustra/meta-evb-zx3-pm3/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-nuvoton/meta-evb-npcm750/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-nuvoton/meta-evb-npcm750/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-raspberrypi/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-raspberrypi/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-facebook/meta-tiogapass/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-facebook/meta-tiogapass/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-facebook/meta-yosemitev2/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-facebook/meta-yosemitev2/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-facebook/meta-bletchley/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-facebook/meta-bletchley/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-hxt/meta-stardragon4800-rep2/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-hxt/meta-stardragon4800-rep2/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-inspur/meta-on5263m5/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-inspur/meta-on5263m5/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-inventec/meta-lanyang/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-inventec/meta-lanyang/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-portwell/meta-neptune/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-portwell/meta-neptune/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-qualcomm/meta-centriq2400-rep/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-qualcomm/meta-centriq2400-rep/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-quanta/meta-q71l/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-quanta/meta-q71l/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-lenovo/meta-hr630/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-lenovo/meta-hr630/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-lenovo/meta-hr855xg2/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-lenovo/meta-hr855xg2/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-microsoft/meta-olympus/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-microsoft/meta-olympus/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-hpe/meta-dl360poc/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-hpe/meta-dl360poc/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-supermicro/meta-x11spi/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-supermicro/meta-x11spi/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-asrock/meta-e3c246d4i/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-asrock/meta-e3c246d4i/conf/local.conf.sample: usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
```
My feeling is that the majority of them can be removed and were probably just
copy/paste jobs from somewhere else. The only ones that we may need to
reconsider are the ones in meta-evb because I'm not 100% convinced that those
machines always use meta-phosphor.
I haven't had time to yet, but I would suggest just making a commit to delete
all of these and see who is outraged by it.
--
Patrick Williams
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2021-08-04 3:29 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-03 22:57 Security Working Group meeting - Wednesday August 4 Joseph Reynolds
2021-08-04 3:04 ` Patrick Williams
2021-08-04 3:22 ` Patrick Williams
2021-08-09 14:09 ` Security Working Group meeting - Wednesday August 4 - ibm-acf repo Joseph Reynolds
2021-08-04 3:28 ` Patrick Williams [this message]
2021-08-04 18:43 ` Security Working Group meeting - Wednesday August 4 - all distro owners please review Joseph Reynolds
2021-08-04 18:47 ` Security Working Group meeting - Wednesday August 4 - results Joseph Reynolds
2021-08-04 20:09 ` Patrick Williams
2021-08-04 20:39 ` Joseph Reynolds
2021-08-04 20:49 ` Patrick Williams
2021-08-04 23:23 ` Patrick Williams
2021-08-06 17:10 ` Mihm, James
2021-08-04 23:47 ` Andrew Jeffery
2021-08-04 23:57 ` Ed Tanous
2021-08-05 13:55 ` Brad Bishop
2021-08-05 13:43 ` Brad Bishop
2021-08-05 15:54 ` Brad Bishop
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YQoJb72EMj1Sk1Lg@heinlein \
--to=patrick@stwcx.xyz \
--cc=jrey@linux.ibm.com \
--cc=openbmc@lists.ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.