Patchwork shadow: change to use SHA512 password encryption

login
register
mail settings
Submitter Paul Eggleton
Date Dec. 13, 2013, 2:42 p.m.
Message ID <1386945766-24556-1-git-send-email-paul.eggleton@linux.intel.com>
Download mbox | patch
Permalink /patch/63331/
State Accepted
Commit 68fbbd1008a76d78c7cef141dc06696d27fe2d0c
Headers show

Comments

Paul Eggleton - Dec. 13, 2013, 2:42 p.m.
The default encryption method for shadow is DES, which limits passwords
to 8 characters. Not only is this undesirable, it's also not how busybox
works so we had different passwd/login length behaviour depending on
whether shadow was installed in the image or not. Change it to SHA512
which is what most Linux distributions seem to be using currently.
(SHA512 also matches up with how we are configuring PAM.)

Fixes [YOCTO #5656].

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
---
 meta/recipes-extended/shadow/shadow.inc | 3 +++
 1 file changed, 3 insertions(+)

Patch

diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc
index 33ecc7d..048709e 100644
--- a/meta/recipes-extended/shadow/shadow.inc
+++ b/meta/recipes-extended/shadow/shadow.inc
@@ -109,6 +109,9 @@  do_install() {
 	# Disable checking emails.
 	sed -i 's/MAIL_CHECK_ENAB/#MAIL_CHECK_ENAB/g' ${D}${sysconfdir}/login.defs
 
+	# Use proper encryption for passwords
+	sed -i 's/^#ENCRYPT_METHOD.*$/ENCRYPT_METHOD SHA512/' ${D}${sysconfdir}/login.defs
+
 	# Now we don't have a mail system. Disable mail creation for now.
 	sed -i 's:/bin/bash:/bin/sh:g' ${D}${sysconfdir}/default/useradd
 	sed -i '/^CREATE_MAIL_SPOOL/ s:^:#:' ${D}${sysconfdir}/default/useradd