[baseimage]: Improve password hashing for default user account

[serhepopovych]

- What I did
Improve password hashing for default user account created during image build.

There are couple of issues with current implementation of default
user account management in baseimage:

  1) It uses DES to encrypt accounts password. Furthermore this
     effectively limits password length to 8 symbols, even if more
     provided with PASSWORD or DEFAULT_PASSWORD from rules/config.

  2) Salt value for password is same on all builds even with different
     password increasing attack surface.

  3) During the build process password passed as command line parameter
     either as plain text (if given to make(1) as "make PASSWORD=...")
     or DES encrypted (if given to build_debian.sh) can be seen by
     non-build users using /proc/<pid>/cmdline file that has group and
     world readable permissions.

- How I did it
To address issues above we propose following changes:

  1) Do not create password by hands (e.g. using perl snippet above):
     put this job to chpasswd(8) which is aware about system wide
     password hashing policy specified in /etc/login.defs with
     ENCRYPT_METHOD (by default it is SHA512 for Debian 8).

  2) Now chpasswd(8) will take care about proper salt value.

  3) This has two steps:

    3.1) For compatibility reasons accept USERNAME and PASSWORD as
         make(1) parameters, but warn user that this is unsafe.

    3.2) Use process environment to pass USERNAME and PASSWORD variables
         from Makefile to build_debian.sh as more secure alternative to
         passing via command line parameters: /proc/<pid>/environ
         readable only by user running process or privileged users like
         root.

- How to verify it
Build image (I use sonic-broadcom.bin), boot it. Use getent(1) tool to get /etc/shadow entry for user.

Before change:
--------------

  hash1
  -----
  # u='admin'
  # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')"
                                      ^^^^^^^^
                                      8 symbols
  # echo "$u:$p" | chpasswd -e

  # getent shadow admin
  admin:sazQDkwgZPfSk:17680:0:99999:7:::
        ^^^^^^^^^^^^^
        Note the hash (DES encrypted password)

  hash2
  -----
  # u='admin'
  # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')"
                                      ^^^^^^^^^^^^
                                      12 symbols
  # echo "$u:$p" | chpasswd -e

  # getent shadow admin
  admin:sazQDkwgZPfSk:17680:0:99999:7:::
        ^^^^^^^^^^^^^
        Hash is the same as for "YourPaSs"

After change:
-------------

  hash1
  -----
  # echo "admin:YourPaSs" | chpasswd
  # getent shadow admin
  admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\
           ^^^^^^^^
           Note salt here
  ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7:::

  hash2
  -----
  # echo "admin:YourPaSs" | chpasswd
  # getent shadow admin
  admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\
           ^^^^^^^^
           Here salt completely different from case above
  plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7:::

Since salt is different hashes for same password different too.

  hash1
  -----
  # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"'
                                             ^^^^^
                                             We want SHA512 hash
  $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\
  yd2ELrIMJ.FQLNjgSD0nNha7/

  hash2
  -----
  # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"'
  $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\
  kYDI8zwRumRwga/A29nHm4mZ1

Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but
different password length we have different hashes.

- Description for the changelog
Improve password hashing for default user account

- A picture of a cute animal (not mandatory but encouraged)

[qiluo-msft]

SNIiC [](start = 47, length = 5)

typo

[serhepopovych]

I reworked code and leave this file as is: no need to source from shell scripts at the moment.

[qiluo-msft]

PASSWORD [](start = 5, length = 8)

PASSWORD [](start = 5, length = 8)

Could you make the behavior backward compatible. In some case, we are ok to have them in command line. You may add warning for this case.

make PASSWORD=$SONIC_PASSWORD target/sonic-broadcom.bin
``` #Closed

[serhepopovych]

Keeping compatibility is good idea so I leave rules/config in Makefile format as well as opportunity to supply USERNAME/PASSWORD via command line.

Warning message is printed to stderr when passing these variables as make(1) parameters because they will be visible to other users on build host.

Passing USERNAME and PASSWORD from Makefile to build_debian.sh now done via process environment: /proc//environ only available to build user: this has nearly same security level as passing it via configuration file (password will be in process memory anyway, either in environment block or in IO buffers when read from config file).

[qiluo-msft]

user [](start = 2, length = 4)

user [](start = 2, length = 4)

Make the comment style consistent? Same below. #Closed

[serhepopovych]

No longer need to include rules/config.

[qiluo-msft]

salt [](start = 76, length = 4)

Could you give an example?

1. It uses DES to encrypt accounts password. Furthermore this
   effectively limits password length to 8 symbols, even if more
   provided with PASSWORD or DEFAULT_PASSWORD from rules/config #Closed

[serhepopovych]

Ok, I have updated commit description message to contain more information on Before/After change. It should explain problem.

In short: you can try any image and login with only with first 8 symbols from password (e.g. for default image use YourPaSs instead of YourPaSsWoRd).

This works of course only if password for that account isn't changed since image was build (e.g. via passwd(1) or chpasswd(1) tools on running system).

[qiluo-msft]

As comments.

[qiluo-msft]

export [](start = 1, length = 6)

export [](start = 1, length = 6)

I think export is needed. #Closed

[serhepopovych]

You are right. Will respin.
Thanks.

[qiluo-msft]

ifneq [](start = 0, length = 5)

Could you check and warn inside slave.mk?

[serhepopovych]

Yes, sure. Replace echo with $(warning ...) and improve warning message text. Looks much better now.

However if someone adds USERNAME and PASSWORD to rules/config they will get false positive warning. But I think this isn't big trouble.