| Summary: | Split up IMAGE_FEATURES - debug-tweaks into logical components | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Koen Kooi <koen> |
| Component: | configuration | Assignee: | Saul Wold <sgw> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | enhancement | ||
| Priority: | Medium | CC: | chong.lu, koen, mark.hatle, sgw, srifenbark |
| Version: | unspecified | ||
| Target Milestone: | 1.8 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | 12 February 2015: Docs updated | ||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Done (doc changes complete) | |
|
Description
Koen Kooi
2013-10-14 09:46:12 UTC
There is following configuration in /etc/pam.d/common-auth file on target:
auth [success=1 default=ignore] pam_unix.so nullok
About nullok argument:
nullok
The default action of this module is to not permit the user access to a service if their official password is blank. The nullok argument overrides this default
and allows any user with a blank password to access the service.
So, we can use this argument to decide whether allow empty password login.
Hi Koen, Can you describe this defect in detail? Assigned to Koen Kooi since that is who should supply the NEEDINFO per RP. The ability to do an empty password login is provided by debug-tweaks, but it also happens to do other things that may be less then desired. I'm updating this to be an enhancement request that breaks up the debug-tweaks functionality into logical units so they can be individually used. Change summary from: Add knob to (dis)allow empty password login for PAM/dropbear/openssh/etc to: Split up IMAGE_FEATURES - debug-tweaks into logical components Suggested enhancement: Split debug-tweaks into it's logical components: empty-root-password - run zap_empty_root_password allow-empty-password - run ssh_allow_empty_password post-install-logging - run postinst_enable_logging Map "debug-tweaks" to enabled those three items. http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=d42963a3feda6c4cf074cbdacc7cf904734d70cf ScottR, docs will need to add definitions for the split values of debug-tweaks as enumerated by Mark in the above comment. Hi, The documentation changes for this fix are here: http://www.yoctoproject.org/docs/1.8/ref-manual/ref-manual.html#var-EXTRA_IMAGE_FEATURES. http://www.yoctoproject.org/docs/1.8/ref-manual/ref-manual.html#ref-features-image (see the 'allow-empty-password', 'debug-tweaks', 'empty-root-password', and 'post-install-logging' items in the feature list. Since the bug is already set to RESOLVED, I am simply posting notice that these changes are in. If there are issues, let me know here. I also set the documentation flag to "done". Thanks, Scott |