Bug 5656

Summary: shadow configured for short passwords by default
Product: [Runtime] Security Reporter: Paul Eggleton <bluelightning>
Component: securityAssignee: Paul Eggleton <bluelightning>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: Medium CC: richard.purdie, sgw
Version: unspecified   
Target Milestone: 1.6 M2   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Paul Eggleton 2013-12-11 16:32:55 UTC 
It seems that if shadow is installed, it is configured (via the default version of /etc/login.defs) to use DES encryption, which means only the first 8 characters of passwords are actually used. It seems that all that is necessary to do to fix this is to set ENCRYPT_METHOD in /etc/login.defs to some other value (e.g. MD5). Given that this 8-character limit is not present if your image doesn't have shadow installed and therefore uses busybox's version of passwd/login, we should probably change our default configuration of shadow unless there is a good reason not to.