Security Working Group meeting - Wednesday August 4

[Patrick Williams]

On Tue, Aug 03, 2021 at 05:57:52PM -0500, Joseph Reynolds wrote:
>  2. (Joseph): Updated password hash algorithm from MD5 to SHA512 (while
>     keeping the same cleartext password)
>     https://gerrit.openbmc-project.xyz/c/openbmc/openbmc/+/45214
>     <https://gerrit.openbmc-project.xyz/c/openbmc/openbmc/+/45214>

The big hangup on this one right now is that there are tons of overrides of
EXTRA_USERS_PARAMS in a bunch of `local.conf.sample` files.  Does anyone know
why these are there rather than relying on the ones we get for free from the
meta-phosphor layer?  Does anyone have a problem if they are removed?

```
$ find -name local.conf.sample | xargs grep usermod -B1
./meta-evb/meta-evb-aspeed/meta-evb-ast2500/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-aspeed/meta-evb-ast2500/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-aspeed/meta-evb-ast2600/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-aspeed/meta-evb-ast2600/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-enclustra/meta-evb-zx3-pm3/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-enclustra/meta-evb-zx3-pm3/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-nuvoton/meta-evb-npcm750/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-nuvoton/meta-evb-npcm750/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-evb/meta-evb-raspberrypi/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-evb/meta-evb-raspberrypi/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-facebook/meta-tiogapass/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-facebook/meta-tiogapass/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-facebook/meta-yosemitev2/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-facebook/meta-yosemitev2/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-facebook/meta-bletchley/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-facebook/meta-bletchley/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-hxt/meta-stardragon4800-rep2/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-hxt/meta-stardragon4800-rep2/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-inspur/meta-on5263m5/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-inspur/meta-on5263m5/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-inventec/meta-lanyang/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-inventec/meta-lanyang/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-portwell/meta-neptune/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-portwell/meta-neptune/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-qualcomm/meta-centriq2400-rep/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-qualcomm/meta-centriq2400-rep/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-quanta/meta-q71l/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-quanta/meta-q71l/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-lenovo/meta-hr630/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-lenovo/meta-hr630/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-lenovo/meta-hr855xg2/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-lenovo/meta-hr855xg2/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-microsoft/meta-olympus/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-microsoft/meta-olympus/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-hpe/meta-dl360poc/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-hpe/meta-dl360poc/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-supermicro/meta-x11spi/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-supermicro/meta-x11spi/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
--
./meta-asrock/meta-e3c246d4i/conf/local.conf.sample-EXTRA_USERS_PARAMS = " \
./meta-asrock/meta-e3c246d4i/conf/local.conf.sample:  usermod -p '\$1\$UGMqyqdG\$FZiylVFmRRfl9Z0Ue8G7e/' root; \
```

My feeling is that the majority of them can be removed and were probably just
copy/paste jobs from somewhere else.  The only ones that we may need to
reconsider are the ones in meta-evb because I'm not 100% convinced that those
machines always use meta-phosphor.

I haven't had time to yet, but I would suggest just making a commit to delete
all of these and see who is outraged by it.

-- 
Patrick Williams
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20210803/938e160f/attachment.sig>