From 4e300e071b97e1e3a6ba4d856cc65e5386366f6f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 10 Mar 2023 19:25:45 +0100 Subject: [PATCH 1/4] libxcrypt: Build only with strong hashes Effectively removes support for the following hashing algorithms as announced in the NixOS 22.11 release notes: - bcrypt_x ($2x$) - sha256crypt ($5$) - sha1crypt ($sha1$) - sunmd5 ($md5$) - md5crypt ($1$) - nt ($3$) - bdiscrypt (_) - bigcrypt (:) - descrypt (:) And exposes the crypt scheme ids for enabled algorithms, so they can be reused for validation in the users-groups module. --- .../manual/release-notes/rl-2305.section.md | 2 ++ .../libraries/libxcrypt/default.nix | 19 ++++++++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 1bd8906cf64f..affa11f3b9a7 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -18,6 +18,8 @@ In addition to numerous new and upgraded packages, this release has the followin - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands. +- `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, and [many other packages](https://github.com/search?q=repo%3ANixOS%2Fnixpkgs%20libxcrypt&type=code). + ## New Services {#sec-release-23.05-new-services} diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix index 86bb12ee3d1f..769994a5cdfd 100644 --- a/pkgs/development/libraries/libxcrypt/default.nix +++ b/pkgs/development/libraries/libxcrypt/default.nix @@ -15,7 +15,8 @@ stdenv.mkDerivation rec { ]; configureFlags = [ - "--enable-hashes=all" + # Update the enabled crypt scheme ids in passthru when the enabled hashes change + "--enable-hashes=strong" "--enable-obsolete-api=glibc" "--disable-failure-tokens" ] ++ lib.optionals (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.libc == "bionic") [ @@ -30,8 +31,20 @@ stdenv.mkDerivation rec { doCheck = true; - passthru.tests = { - inherit (nixosTests) login shadow; + passthru = { + tests = { + inherit (nixosTests) login shadow; + }; + enabledCryptSchemeIds = [ + # https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf + "y" # yescrypt + "gy" # gost_yescrypt + "7" # scrypt + "2b" # bcrypt + "2y" # bcrypt_y + "2a" # bcrypt_a + "6" # sha512crypt + ]; }; meta = with lib; { From 0d7cd666520621ebb3f2fb0e590064e8621e249e Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sat, 11 Mar 2023 22:29:16 +0100 Subject: [PATCH 2/4] nixos/users-groups: Update password scheme validation Updates the warnings message for statefully set up passwords, now that weak algorithms have been removed from our libxcrypt package. Additionall we now add proper validation for hashing schemes used in `hashedPassword`. Neither will prevent a rebuiild, but instead issue a warning, that this requires immediate remediation, or else users will be unable to login. Reuses the crypt scheme ids as provided by the libxcrypt package. --- nixos/modules/config/users-groups.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index ee4692fc6a6a..5fb38a4e2ff8 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -539,7 +539,9 @@ in { ###### implementation - config = { + config = let + cryptSchemeIdPatternGroup = "(${lib.concatStringsSep "|" pkgs.libxcrypt.enabledCryptSchemeIds})"; + in { users.users = { root = { @@ -601,15 +603,16 @@ in { text = '' users=() while IFS=: read -r user hash tail; do - if [[ "$hash" = "$"* && ! "$hash" =~ ^\$(y|gy|7|2b|2y|2a|6)\$ ]]; then + if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then users+=("$user") fi done Date: Sun, 12 Mar 2023 17:58:19 +0100 Subject: [PATCH 3/4] pam: Make libxcrypt a non-optional dependency Our PAM configuration now defaults to yescrypt, which requires libxcrypt. --- pkgs/os-specific/linux/pam/default.nix | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix index 22e7057e343f..8b068100f32a 100644 --- a/pkgs/os-specific/linux/pam/default.nix +++ b/pkgs/os-specific/linux/pam/default.nix @@ -1,6 +1,5 @@ -{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit +{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext, audit, libxcrypt , nixosTests -, withLibxcrypt ? true, libxcrypt }: stdenv.mkDerivation rec { @@ -20,9 +19,8 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ flex ] ++ lib.optional stdenv.buildPlatform.isDarwin gettext; - buildInputs = [ cracklib db4 ] - ++ lib.optional stdenv.buildPlatform.isLinux audit - ++ lib.optional withLibxcrypt libxcrypt; + buildInputs = [ cracklib db4 libxcrypt ] + ++ lib.optional stdenv.buildPlatform.isLinux audit; enableParallelBuilding = true; From 4472cf44eba4991e46904c588e07dfe8e6fcceb8 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 12 Mar 2023 17:59:01 +0100 Subject: [PATCH 4/4] treewide: Make yescrypt the default algorithm for pam_unix.so This ensures `passwd` will default to yescrypt for newly generated passwords. --- nixos/modules/security/pam.nix | 2 +- nixos/modules/services/x11/display-managers/gdm.nix | 2 +- nixos/modules/services/x11/display-managers/lightdm.nix | 2 +- nixos/tests/pam/test_chfn.py | 2 +- pkgs/build-support/docker/default.nix | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 4224722f8792..d57dec36c328 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -620,7 +620,7 @@ let optionalString config.services.homed.enable '' password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so '' + '' - password sufficient pam_unix.so nullok sha512 + password sufficient pam_unix.so nullok yescrypt '' + optionalString config.security.pam.enableEcryptfs '' password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix index 1c3881bef2de..f8f82bda3fa4 100644 --- a/nixos/modules/services/x11/display-managers/gdm.nix +++ b/nixos/modules/services/x11/display-managers/gdm.nix @@ -323,7 +323,7 @@ in account sufficient pam_unix.so - password requisite pam_unix.so nullok sha512 + password requisite pam_unix.so nullok yescrypt session optional pam_keyinit.so revoke session include login diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix index 65f414705fc5..548d3c5bc46a 100644 --- a/nixos/modules/services/x11/display-managers/lightdm.nix +++ b/nixos/modules/services/x11/display-managers/lightdm.nix @@ -302,7 +302,7 @@ in account sufficient pam_unix.so - password requisite pam_unix.so nullok sha512 + password requisite pam_unix.so nullok yescrypt session optional pam_keyinit.so revoke session include login diff --git a/nixos/tests/pam/test_chfn.py b/nixos/tests/pam/test_chfn.py index b108a9423caf..a48438b8d305 100644 --- a/nixos/tests/pam/test_chfn.py +++ b/nixos/tests/pam/test_chfn.py @@ -8,7 +8,7 @@ expected_lines = { "auth sufficient pam_rootok.so", "auth sufficient pam_unix.so likeauth try_first_pass", "password sufficient @@pam_krb5@@/lib/security/pam_krb5.so use_first_pass", - "password sufficient pam_unix.so nullok sha512", + "password sufficient pam_unix.so nullok yescrypt", "session optional @@pam_krb5@@/lib/security/pam_krb5.so", "session required pam_env.so conffile=/etc/pam/environment readenv=0", "session required pam_unix.so", diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix index 7fa5aeafc8e3..5f48fb9f7bdb 100644 --- a/pkgs/build-support/docker/default.nix +++ b/pkgs/build-support/docker/default.nix @@ -190,7 +190,7 @@ rec { cat > /etc/pam.d/other <