Aksal/nuttx-apps
1
0
Fork 1
mirror of https://github.com/apache/nuttx-apps.git synced 2026-08-01 20:29:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

!nshlib: Remove fixed login; require FSUTILS_PASSWD

Browse source 
Report password policy failures clearly from useradd and passwd when a
password does not meet complexity requirements.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
This commit is contained in:
Abhishek Mishra 2026-07-15 15:40:21 +00:00 • committed by Xiang Xiao
parent 608f13fd4b
commit c02683e282
6 changed files with 35 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nshlib/Kconfig
View file

@ -1230,32 +1230,30 @@ config NSH_LOGIN
config NSH_CONSOLE_LOGIN
bool "Console Login"
default n
depends on FSUTILS_PASSWD
select NSH_LOGIN
---help---
If defined, then the console user will be required to provide a
username and password to start the NSH shell.
username and password to start the NSH shell. Requires
CONFIG_FSUTILS_PASSWD so credentials are verified against the
encrypted password file (for example ROMFS /etc/passwd).
config NSH_TELNET_LOGIN
bool "Telnet Login"
default n
depends on NSH_TELNET
depends on NSH_TELNET && FSUTILS_PASSWD
select NSH_LOGIN
---help---
If defined, then the Telnet user will be required to provide a
username and password to start the NSH shell.
username and password to start the NSH shell. Requires
CONFIG_FSUTILS_PASSWD so credentials are verified against the
encrypted password file (for example ROMFS /etc/passwd).
if NSH_LOGIN
choice
prompt "Verification method"
default NSH_LOGIN_PASSWD if FSUTILS_PASSWD
default NSH_LOGIN_FIXED if !FSUTILS_PASSWD
config NSH_LOGIN_FIXED
bool "Fixed username/password"
---help---
Verify user credentials by matching to fixed username and password
strings
default NSH_LOGIN_PASSWD
config NSH_LOGIN_PLATFORM
bool "Platform username/password"
@ -1292,16 +1290,6 @@ config NSH_LOGIN_USERNAME
---help---
Login user name. Default: "root"
config NSH_LOGIN_PASSWORD
string "Login password"
depends on NSH_LOGIN_FIXED
---help---
The plaintext login password used when fixed username/password
verification is selected (CONFIG_NSH_LOGIN_FIXED). There is no
default; set CONFIG_NSH_LOGIN_PASSWORD in the board defconfig,
via menuconfig, or enter it when prompted during an interactive
build.
config NSH_LOGIN_FAILDELAY
int "Login failure delay"
default 0

2
nshlib/nsh.h
View file

@ -267,8 +267,6 @@
* options may be specified:
*
* CONFIG_NSH_LOGIN_USERNAME - Login user name. Default: "root"
* CONFIG_NSH_LOGIN_PASSWORD - Login password (required when using fixed
* credentials; no default is provided).
* CONFIG_NSH_LOGIN_FAILCOUNT - Number of login retry attempts.
* Default 3.
*/

3
nshlib/nsh_identity.c
View file

@ -165,9 +165,6 @@ static bool nsh_verify_credentials(FAR const char *username,
return PASSWORD_VERIFY_MATCH(passwd_verify(username, password));
#elif defined(CONFIG_NSH_LOGIN_PLATFORM)
return PASSWORD_VERIFY_MATCH(platform_user_verify(username, password));
#elif defined(CONFIG_NSH_LOGIN_FIXED)
return strcmp(password, CONFIG_NSH_LOGIN_PASSWORD) == 0 &&
strcmp(username, CONFIG_NSH_LOGIN_USERNAME) == 0;
#else
UNUSED(username);
UNUSED(password);

3
nshlib/nsh_login.c
View file

@ -243,9 +243,6 @@ int nsh_login(FAR struct console_stdio_s *pstate)
#endif
if (PASSWORD_VERIFY_MATCH(ret))
#elif defined(CONFIG_NSH_LOGIN_FIXED)
if (strcmp(password, CONFIG_NSH_LOGIN_PASSWORD) == 0 &&
strcmp(username, CONFIG_NSH_LOGIN_USERNAME) == 0)
#else
# error No user verification method selected
#endif

30
nshlib/nsh_passwdcmds.c
View file

@ -53,8 +53,19 @@ int cmd_useradd(FAR struct nsh_vtbl_s *vtbl, int argc, FAR char **argv)
ret = passwd_adduser(argv[1], argv[2]);
if (ret < 0)
{
nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_adduser",
NSH_ERRNO_OF(-ret));
if (ret == -EINVAL)
{
nsh_error(vtbl,
"%s: password does not meet security policy "
"(min 8 chars, upper, lower, digit, special)\n",
argv[0]);
}
else
{
nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_adduser",
NSH_ERRNO_OF(-ret));
}
return ERROR;
}
@ -99,8 +110,19 @@ int cmd_passwd(FAR struct nsh_vtbl_s *vtbl, int argc, FAR char **argv)
ret = passwd_update(argv[1], argv[2]);
if (ret < 0)
{
nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_update",
NSH_ERRNO_OF(-ret));
if (ret == -EINVAL)
{
nsh_error(vtbl,
"%s: password does not meet security policy "
"(min 8 chars, upper, lower, digit, special)\n",
argv[0]);
}
else
{
nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_update",
NSH_ERRNO_OF(-ret));
}
return ERROR;
}

3
nshlib/nsh_telnetlogin.c
View file

@ -248,9 +248,6 @@ int nsh_telnetlogin(FAR struct console_stdio_s *pstate)
if (PASSWORD_VERIFY_MATCH(platform_user_verify(username,
password)))
# endif
#elif defined(CONFIG_NSH_LOGIN_FIXED)
if (strcmp(password, CONFIG_NSH_LOGIN_PASSWORD) == 0 &&
strcmp(username, CONFIG_NSH_LOGIN_USERNAME) == 0)
#else
# error No user verification method selected
#endif