Skip to content

Commit 159c78f

Browse files
alejandro-colomaralejandro-colomar
committed
*: Make support for SHA256 and SHA512 unconditional
This is necessary for later changing the fallback from the insecure DES to something secure such as SHA512. Link: <#1278> Cc: Andre Boscatto <andreboscatto@gmail.com> Cc: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
1 parent 25aea74 commit 159c78f

File tree

14 files changed

+28
-146
lines changed

14 files changed

+28
-146
lines changed

‎configure.ac‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -187,9 +187,6 @@ AC_ARG_WITH([skey],
187187
AC_ARG_WITH([tcb],
188188
[AS_HELP_STRING([--with-tcb], [use tcb support (incomplete) @<:@default=yes if found@:>@])],
189189
[with_tcb=$withval], [with_tcb=maybe])
190-
AC_ARG_WITH([sha-crypt],
191-
[AS_HELP_STRING([--with-sha-crypt], [allow the SHA256 and SHA512 password encryption algorithms @<:@default=yes@:>@])],
192-
[with_sha_crypt=$withval], [with_sha_crypt=yes])
193190
AC_ARG_WITH([bcrypt],
194191
[AS_HELP_STRING([--with-bcrypt], [allow the bcrypt password encryption algorithm @<:@default=no@:>@])],
195192
[with_bcrypt=$withval], [with_bcrypt=no])
@@ -222,11 +219,6 @@ AC_SUBST([GROUP_NAME_MAX_LENGTH])
222219
GROUP_NAME_MAX_LENGTH="$with_group_name_max_length"
223220

224221

225-
AM_CONDITIONAL([USE_SHA_CRYPT], [test "x$with_sha_crypt" = "xyes"])
226-
if test "X$with_sha_crypt" = "Xyes"; then
227-
AC_DEFINE([USE_SHA_CRYPT], [1], [Define to allow the SHA256 and SHA512 password encryption algorithms])
228-
fi
229-
230222
AM_CONDITIONAL([USE_BCRYPT], [test "x$with_bcrypt" = "xyes"])
231223
if test "X$with_bcrypt" = "Xyes"; then
232224
AC_DEFINE([USE_BCRYPT], [1], [Define to allow the bcrypt password encryption algorithm])
@@ -708,7 +700,6 @@ AC_MSG_NOTICE([shadow ${PACKAGE_VERSION} has been configured with the following
708700
tcb support (incomplete): $with_tcb
709701
shadow group support: $enable_shadowgrp
710702
S/Key support: $with_skey
711-
SHA passwords encryption: $with_sha_crypt
712703
bcrypt passwords encryption: $with_bcrypt
713704
yescrypt passwords encryption: $with_yescrypt
714705
nscd support: $with_nscd

‎lib/getdef.c‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,8 @@ static struct itemdef def_table[] = {
112112
{"PASS_MAX_DAYS", NULL},
113113
{"PASS_MIN_DAYS", NULL},
114114
{"PASS_WARN_AGE", NULL},
115-
#ifdef USE_SHA_CRYPT
116115
{"SHA_CRYPT_MAX_ROUNDS", NULL},
117116
{"SHA_CRYPT_MIN_ROUNDS", NULL},
118-
#endif
119117
#ifdef USE_BCRYPT
120118
{"BCRYPT_MAX_ROUNDS", NULL},
121119
{"BCRYPT_MIN_ROUNDS", NULL},

‎lib/obscure.c‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -221,10 +221,8 @@ obscure_get_range(int *minlen, int *maxlen)
221221
}
222222
} else {
223223
if ( streq(method, "MD5")
224-
#ifdef USE_SHA_CRYPT
225224
|| streq(method, "SHA256")
226225
|| streq(method, "SHA512")
227-
#endif
228226
#ifdef USE_BCRYPT
229227
|| streq(method, "BCRYPT")
230228
#endif

‎lib/salt.c‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@
5151
#define B_ROUNDS_MAX 31
5252
#endif /* USE_BCRYPT */
5353

54-
#ifdef USE_SHA_CRYPT
5554
/* Fixed salt len for sha{256,512}crypt. */
5655
#define SHA_CRYPT_SALT_SIZE 16
5756
/* Default number of rounds if not explicitly specified. */
@@ -60,7 +59,6 @@
6059
#define SHA_ROUNDS_MIN 1000
6160
/* Maximum number of rounds. */
6261
#define SHA_ROUNDS_MAX 999999999
63-
#endif
6462

6563
#ifdef USE_YESCRYPT
6664
/*
@@ -93,10 +91,8 @@
9391
#if !USE_XCRYPT_GENSALT
9492
static /*@observer@*/const char *gensalt (size_t salt_size);
9593
#endif /* !USE_XCRYPT_GENSALT */
96-
#ifdef USE_SHA_CRYPT
9794
static /*@observer@*/unsigned long SHA_get_salt_rounds (/*@null@*/const int *prefered_rounds);
9895
static /*@observer@*/void SHA_salt_rounds_to_buf (char *buf, unsigned long rounds);
99-
#endif /* USE_SHA_CRYPT */
10096
#ifdef USE_BCRYPT
10197
static /*@observer@*/unsigned long BCRYPT_get_salt_rounds (/*@null@*/const int *prefered_rounds);
10298
static /*@observer@*/void BCRYPT_salt_rounds_to_buf (char *buf, unsigned long rounds);
@@ -107,7 +103,6 @@ static /*@observer@*/void YESCRYPT_salt_cost_to_buf (char *buf, unsigned long co
107103
#endif /* USE_YESCRYPT */
108104

109105

110-
#ifdef USE_SHA_CRYPT
111106
/* Return the the rounds number for the SHA crypt methods. */
112107
static /*@observer@*/unsigned long SHA_get_salt_rounds (/*@null@*/const int *prefered_rounds)
113108
{
@@ -179,7 +174,6 @@ static /*@observer@*/void SHA_salt_rounds_to_buf (char *buf, unsigned long round
179174

180175
(void) snprintf (buf + buf_begin, 18, "rounds=%lu$", rounds);
181176
}
182-
#endif /* USE_SHA_CRYPT */
183177

184178
#ifdef USE_BCRYPT
185179
/* Return the the rounds number for the BCRYPT method. */
@@ -392,7 +386,6 @@ static /*@observer@*/const char *gensalt (size_t salt_size)
392386
rounds = YESCRYPT_get_salt_cost (arg);
393387
YESCRYPT_salt_cost_to_buf (result, rounds);
394388
#endif /* USE_YESCRYPT */
395-
#ifdef USE_SHA_CRYPT
396389
} else if (streq(method, "SHA256")) {
397390
MAGNUM(result, '5');
398391
salt_len = SHA_CRYPT_SALT_SIZE;
@@ -403,7 +396,6 @@ static /*@observer@*/const char *gensalt (size_t salt_size)
403396
salt_len = SHA_CRYPT_SALT_SIZE;
404397
rounds = SHA_get_salt_rounds (arg);
405398
SHA_salt_rounds_to_buf (result, rounds);
406-
#endif /* USE_SHA_CRYPT */
407399
} else if (!streq(method, "DES")) {
408400
fprintf (log_get_logfd(),
409401
_("Invalid ENCRYPT_METHOD value: '%s'.\n"

‎man/chgpasswd.8.xml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -94,9 +94,10 @@
9494
The available methods are <phrase condition="bcrypt">
9595
<replaceable>BCRYPT</replaceable>,</phrase>
9696
<replaceable>DES</replaceable>,
97-
<replaceable>MD5</replaceable><phrase condition="sha_crypt">,
97+
<replaceable>MD5</replaceable>,
9898
<replaceable>SHA256</replaceable>,
99-
<replaceable>SHA512</replaceable></phrase><phrase condition="yescrypt">,
99+
<replaceable>SHA512</replaceable>,
100+
<phrase condition="yescrypt">
100101
<replaceable>YESCRYPT</replaceable></phrase> and
101102
<replaceable>NONE</replaceable>
102103
if your libc supports these methods.
@@ -138,7 +139,7 @@
138139
</para>
139140
</listitem>
140141
</varlistentry>
141-
<varlistentry condition="bcrypt;sha_crypt;yescrypt">
142+
<varlistentry>
142143
<term><option>-s</option>, <option>--sha-rounds</option></term>
143144
<listitem>
144145
<para>
@@ -148,9 +149,8 @@
148149
You can only use this option with crypt method:
149150
<phrase condition="bcrypt">
150151
<replaceable>BCRYPT</replaceable></phrase>
151-
<phrase condition="sha_crypt">
152152
<replaceable>SHA256</replaceable>
153-
<replaceable>SHA512</replaceable></phrase>
153+
<replaceable>SHA512</replaceable>
154154
<phrase condition="yescrypt">
155155
<replaceable>YESCRYPT</replaceable></phrase>
156156
</para>
@@ -163,12 +163,12 @@
163163
A minimal value of 4 and a maximal value of 31
164164
will be enforced for BCRYPT. The default number of rounds is 13.
165165
</para>
166-
<para condition="sha_crypt">
166+
<para>
167167
By default, the number of rounds for SHA256 or SHA512 is defined by
168168
the SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS variables in
169169
<filename>/etc/login.defs</filename>.
170170
</para>
171-
<para condition="sha_crypt">
171+
<para>
172172
A minimal value of 1000 and a maximal value of 999,999,999
173173
will be enforced for SHA256 and SHA512. The default number of rounds
174174
is 5000.

‎man/chpasswd.8.xml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -121,9 +121,10 @@
121121
The available methods are <phrase condition="bcrypt">
122122
<replaceable>BCRYPT</replaceable>,</phrase>
123123
<replaceable>DES</replaceable>,
124-
<replaceable>MD5</replaceable><phrase condition="sha_crypt">,
124+
<replaceable>MD5</replaceable>,
125125
<replaceable>SHA256</replaceable>,
126-
<replaceable>SHA512</replaceable></phrase><phrase condition="yescrypt">,
126+
<replaceable>SHA512</replaceable>,
127+
<phrase condition="yescrypt">
127128
<replaceable>YESCRYPT</replaceable></phrase> and
128129
<replaceable>NONE</replaceable>
129130
if your libc supports these methods.
@@ -195,7 +196,7 @@
195196
</para>
196197
</listitem>
197198
</varlistentry>
198-
<varlistentry condition="bcrypt;sha_crypt;yescrypt">
199+
<varlistentry>
199200
<term>
200201
<option>-s</option>, <option>--sha-rounds</option>&nbsp;<replaceable>ROUNDS</replaceable>
201202
</term>
@@ -207,9 +208,8 @@
207208
You can only use this option with crypt method:
208209
<phrase condition="bcrypt">
209210
<replaceable>BCRYPT</replaceable></phrase>
210-
<phrase condition="sha_crypt">
211211
<replaceable>SHA256</replaceable>
212-
<replaceable>SHA512</replaceable></phrase>
212+
<replaceable>SHA512</replaceable>
213213
<phrase condition="yescrypt">
214214
<replaceable>YESCRYPT</replaceable></phrase>
215215
</para>
@@ -222,12 +222,12 @@
222222
A minimal value of 4 and a maximal value of 31
223223
will be enforced for BCRYPT. The default number of rounds is 13.
224224
</para>
225-
<para condition="sha_crypt">
225+
<para>
226226
By default, the number of rounds for SHA256 or SHA512 is defined by
227227
the SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS variables in
228228
<filename>/etc/login.defs</filename>.
229229
</para>
230-
<para condition="sha_crypt">
230+
<para>
231231
A minimal value of 1000 and a maximal value of 999,999,999
232232
will be enforced for SHA256 and SHA512. The default number of rounds
233233
is 5000.

‎man/generate_mans.mak‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,6 @@ else
1919
TCB_COND=no_tcb
2020
endif
2121

22-
if USE_SHA_CRYPT
23-
SHA_CRYPT_COND=sha_crypt
24-
else
25-
SHA_CRYPT_COND=no_sha_crypt
26-
endif
27-
2822
if USE_BCRYPT
2923
BCRYPT_COND=bcrypt
3024
else
@@ -62,7 +56,7 @@ if ENABLE_REGENERATE_MAN
6256
fi
6357

6458
man1/% man3/% man5/% man8/%: %.xml-config Makefile config.xml
65-
$(XSLTPROC) --stringparam profile.condition "$(PAM_COND);$(SHADOWGRP_COND);$(TCB_COND);$(SHA_CRYPT_COND);$(BCRYPT_COND);$(YESCRYPT_COND);$(SUBIDS_COND);$(VENDORDIR_COND);$(LASTLOG_COND)" \
59+
$(XSLTPROC) --stringparam profile.condition "$(PAM_COND);$(SHADOWGRP_COND);$(TCB_COND);$(BCRYPT_COND);$(YESCRYPT_COND);$(SUBIDS_COND);$(VENDORDIR_COND);$(LASTLOG_COND)" \
6660
--param "man.authors.section.enabled" "0" \
6761
--stringparam "man.output.base.dir" "" \
6862
--stringparam vendordir "$(VENDORDIR)" \

‎man/login.defs.5.xml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -256,8 +256,7 @@
256256
<phrase condition="bcrypt">BCRYPT_MAX_ROUNDS
257257
BCRYPT_MIN_ROUNDS</phrase>
258258
ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB
259-
<phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
260-
SHA_CRYPT_MIN_ROUNDS</phrase>
259+
SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS
261260
<phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
262261
</para>
263262
</listitem>
@@ -270,8 +269,7 @@
270269
BCRYPT_MIN_ROUNDS</phrase>
271270
<phrase condition="no_pam">ENCRYPT_METHOD
272271
MD5_CRYPT_ENAB </phrase>
273-
<phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
274-
SHA_CRYPT_MIN_ROUNDS</phrase>
272+
SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS
275273
<phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
276274
</para>
277275
</listitem>
@@ -293,8 +291,7 @@
293291
<phrase condition="bcrypt">BCRYPT_MAX_ROUNDS
294292
BCRYPT_MIN_ROUNDS</phrase>
295293
ENCRYPT_METHOD MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB
296-
<phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
297-
SHA_CRYPT_MIN_ROUNDS</phrase>
294+
SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS
298295
<phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
299296
</para>
300297
</listitem>
@@ -399,8 +396,7 @@
399396
MAX_MEMBERS_PER_GROUP MD5_CRYPT_ENAB
400397
HOME_MODE
401398
PASS_MAX_DAYS PASS_MIN_DAYS PASS_WARN_AGE
402-
<phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
403-
SHA_CRYPT_MIN_ROUNDS</phrase>
399+
SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS
404400
SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN
405401
SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN
406402
SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
@@ -418,8 +414,7 @@
418414
BCRYPT_MIN_ROUNDS</phrase>
419415
ENCRYPT_METHOD MD5_CRYPT_ENAB OBSCURE_CHECKS_ENAB
420416
PASS_ALWAYS_WARN PASS_CHANGE_TRIES PASS_MAX_LEN PASS_MIN_LEN
421-
<phrase condition="sha_crypt">SHA_CRYPT_MAX_ROUNDS
422-
SHA_CRYPT_MIN_ROUNDS</phrase>
417+
SHA_CRYPT_MAX_ROUNDS SHA_CRYPT_MIN_ROUNDS
423418
<phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
424419
</para>
425420
</listitem>

‎man/login.defs.d/ENCRYPT_METHOD.xml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,10 @@
1313
It can take one of these values: <phrase condition="bcrypt">
1414
<replaceable>BCRYPT</replaceable>,</phrase>
1515
<replaceable>DES</replaceable> (default),
16-
<replaceable>MD5</replaceable><phrase condition="sha_crypt">,
16+
<replaceable>MD5</replaceable>,
1717
<replaceable>SHA256</replaceable>,
18-
<replaceable>SHA512</replaceable></phrase><phrase condition="yescrypt">,
18+
<replaceable>SHA512</replaceable>,
19+
<phrase condition="yescrypt">
1920
<replaceable>YESCRYPT</replaceable></phrase>.
2021
MD5 and DES should not be used for new hashes, see
2122
<refentrytitle>crypt</refentrytitle><manvolnum>5</manvolnum>

‎man/login.defs.d/SHA_CRYPT_MIN_ROUNDS.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
SPDX-FileCopyrightText: 2007 - 2008, Nicolas François
33
SPDX-License-Identifier: BSD-3-Clause
44
-->
5-
<varlistentry condition="sha_crypt">
5+
<varlistentry>
66
<term><option>SHA_CRYPT_MIN_ROUNDS</option> (number)</term>
77
<term><option>SHA_CRYPT_MAX_ROUNDS</option> (number)</term>
88
<listitem>

0 commit comments

Comments
 (0)