Changeset 4635a45d for postlfs/security/shadow.xml

Timestamp:

11/16/2022 04:15:27 PM (18 months ago)

Author:

Pierre Labastie <pierre.labastie@…>

Branches:

11.3, 12.0, 12.1, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, xry111/llvm18, xry111/xf86-video-removal

Children:

ae27cdc

Parents:

42d51c6

git-author:

Pierre Labastie <pierre.labastie@…> (11/16/2022 03:39:23 PM)

git-committer:

Pierre Labastie <pierre.labastie@…> (11/16/2022 04:15:27 PM)

Message:

Shadow: increase the number of rounds for passwd

for the SHA512 crypt method, the default number of rounds (5000) is
too low to prevent brute force attacks on modern hardware. Multiply
it by 1000 (not sure it is enough).

File:

• postlfs/security/shadow.xml (modified) (2 diffs)

postlfs/security/shadow.xml

@@ -139 +139 @@
 
 sed -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' \
+    -e 's@#\(SHA_CRYPT_..._ROUNDS 5000\)@\1000@'      \
     -e 's@/var/spool/mail@/var/mail@'                 \
     -e '/PATH=/{s@/sbin:@@;s@/bin:@@}'                \
@@ -188 +189 @@
     <para>
       <command>sed -e 's@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@' -e
-      's@/var/spool/mail@/var/mail@' -e '/PATH=/{s@/sbin:@@;s@/bin:@@}'
-      -i etc/login.defs</command>: Instead of using
-      the default 'DES' method, this command modifies the installation to use
-      the more secure 'SHA512' method of hashing passwords, which also allows
-      passwords longer than eight characters. It also changes the obsolete
-      <filename class="directory">/var/spool/mail</filename> location for user
-      mailboxes that <application>Shadow</application> uses by default to the
-      <filename class="directory">/var/mail</filename> location. It also
-      changes the default path to be consistent with that set in LFS.
+        's@#SHA_CRYPT_..._ROUNDS 5000@&amp;000@' -e
+        's@/var/spool/mail@/var/mail@' -e '/PATH=/{s@/sbin:@@;s@/bin:@@}'
+        -i etc/login.defs</command>: Instead of using the default 'DES'
+      method, this command modifies the installation to use the more secure
+      'SHA512' method of hashing passwords, which also allows passwords
+      longer than eight characters. The number of rounds is also increased
+      to prevent brute force pasword attacks. The command also changes the
+      obsolete <filename class="directory">/var/spool/mail</filename> location
+      for user mailboxes that <application>Shadow</application> uses by
+      default to the <filename class="directory">/var/mail</filename>
+      location. It also changes the default path to be consistent with that
+      set in LFS.
     </para>
 <!--