From 55ab131ee2a1099e7a41a76570365eba72b45159 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 9 Oct 2022 20:33:19 +0200 Subject: [PATCH 1/3] nixos/manual: Don't recommend mkpasswd methods Instead rely on the default, which at this time is yescrypt. --- nixos/doc/manual/configuration/user-mgmt.chapter.md | 3 +-- nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/nixos/doc/manual/configuration/user-mgmt.chapter.md b/nixos/doc/manual/configuration/user-mgmt.chapter.md index 37990664a8f1..5c3aca3ef9e9 100644 --- a/nixos/doc/manual/configuration/user-mgmt.chapter.md +++ b/nixos/doc/manual/configuration/user-mgmt.chapter.md @@ -32,8 +32,7 @@ account will cease to exist. Also, imperative commands for managing users and groups, such as useradd, are no longer available. Passwords may still be assigned by setting the user\'s [hashedPassword](#opt-users.users._name_.hashedPassword) option. A -hashed password can be generated using `mkpasswd -m - sha-512`. +hashed password can be generated using `mkpasswd`. A user ID (uid) is assigned automatically. You can also specify a uid manually by adding diff --git a/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml b/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml index 06492d5c2512..a2d7d2a9f115 100644 --- a/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml @@ -39,7 +39,7 @@ users.users.alice = { Passwords may still be assigned by setting the user's hashedPassword option. A hashed password can be generated using - mkpasswd -m sha-512. + mkpasswd. A user ID (uid) is assigned automatically. You can also specify a From f391e6dbccfb8289930a139f2afcfd032c60d89f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 9 Oct 2022 20:35:01 +0200 Subject: [PATCH 2/3] nixos/user: Don't recommend mkpasswd methods Instead rely on the default, which at this time is yescrypt. --- nixos/modules/config/users-groups.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index b538a0119c06..de5e398dc46a 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -35,7 +35,7 @@ let ''; hashedPasswordDescription = '' - To generate a hashed password run `mkpasswd -m sha-512`. + To generate a hashed password run `mkpasswd`. If set to an empty string (`""`), this user will be able to log in without being asked for a password (but not via remote From 78155df21dbdb8bd4c471df69e9352ec3471bf45 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 10 Oct 2022 04:19:06 +0200 Subject: [PATCH 3/3] nixos/users-groups: Warn about deprecated hashes at activation To allow for a reasonably fast deprecation of weak password hashing schemes we provide an activation script that checks existing hashes in /etc/shadow and issues a warning for user accounts that still rely on deprecated hashes. Co-Authored-By: oxalica --- nixos/modules/config/users-groups.nix | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index de5e398dc46a..2660b0e6c938 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -592,6 +592,26 @@ in { ''; }; + # Warn about user accounts with deprecated password hashing schemes + system.activationScripts.hashes = { + deps = [ "users" ]; + text = '' + users=() + while IFS=: read -r user hash tail; do + if [[ "$hash" = "$"* && ! "$hash" =~ ^\$(y|gy|7|2b|2y|2a|6)\$ ]]; then + users+=("$user") + fi + done