Aksal/nuttx-apps
1
0
Fork 1
mirror of https://github.com/apache/nuttx-apps.git synced 2026-08-02 12:49:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

nshlib,fsutils: add Kconfig deps for NSH console login with PBKDF2

Browse source 
Require a cryptodev backend for FSUTILS_PASSWD and tie NSH console/telnet
login to ROMFS passwd generation when ETC_ROMFS is enabled.

Fixes #19573

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
This commit is contained in:
Abhishek Mishra 2026-07-29 16:18:51 +00:00 • committed by Xiang Xiao
parent 917e2e860b
commit fc14d02ae0
2 changed files with 21 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
fsutils/passwd/Kconfig
View file

@ -7,14 +7,17 @@ config FSUTILS_PASSWD
bool "Password file support" bool "Password file support"
default n default n
depends on CRYPTO_CRYPTODEV depends on CRYPTO_CRYPTODEV
depends on CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO || CRYPTO_CRYPTODEV_HARDWARE
depends on NETUTILS_CODECS depends on NETUTILS_CODECS
depends on CODECS_BASE64 depends on CODECS_BASE64
---help--- ---help---
Enables support for /etc/passwd file access routines. Enables support for /etc/passwd file access routines.
Requires CONFIG_CRYPTO=y, CRYPTO_CRYPTODEV (and Requires CONFIG_CRYPTO=y, CRYPTO_CRYPTODEV (and
ALLOW_BSD_COMPONENTS), plus NETUTILS_CODECS/CODECS_BASE64 for ALLOW_BSD_COMPONENTS), a cryptodev backend
base64url hash encoding. (CONFIG_CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO or
CONFIG_CRYPTO_CRYPTODEV_HARDWARE), plus NETUTILS_CODECS/CODECS_BASE64
for base64url hash encoding.
NOTE: Password hashes use PBKDF2-HMAC-SHA256 (modular crypt format). NOTE: Password hashes use PBKDF2-HMAC-SHA256 (modular crypt format).
Existing TEA-encrypted /etc/passwd entries are NOT compatible and Existing TEA-encrypted /etc/passwd entries are NOT compatible and

20
nshlib/Kconfig
View file

@ -1235,23 +1235,35 @@ config NSH_CONSOLE_LOGIN
bool "Console Login" bool "Console Login"
default n default n
depends on FSUTILS_PASSWD depends on FSUTILS_PASSWD
depends on !ETC_ROMFS || BOARD_ETC_ROMFS_PASSWD_ENABLE
select NSH_LOGIN select NSH_LOGIN
---help--- ---help---
If defined, then the console user will be required to provide a If defined, then the console user will be required to provide a
username and password to start the NSH shell. Requires username and password to start the NSH shell. Requires
CONFIG_FSUTILS_PASSWD so credentials are verified against the CONFIG_FSUTILS_PASSWD (PBKDF2-HMAC-SHA256) so credentials are
encrypted password file (for example ROMFS /etc/passwd). verified against the encrypted password file.
When CONFIG_ETC_ROMFS is enabled, also enable
CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE so /etc/passwd is generated
at build time (or provide the passwd file by other means and leave
ETC_ROMFS disabled).
config NSH_TELNET_LOGIN config NSH_TELNET_LOGIN
bool "Telnet Login" bool "Telnet Login"
default n default n
depends on NSH_TELNET && FSUTILS_PASSWD depends on NSH_TELNET && FSUTILS_PASSWD
depends on !ETC_ROMFS || BOARD_ETC_ROMFS_PASSWD_ENABLE
select NSH_LOGIN select NSH_LOGIN
---help--- ---help---
If defined, then the Telnet user will be required to provide a If defined, then the Telnet user will be required to provide a
username and password to start the NSH shell. Requires username and password to start the NSH shell. Requires
CONFIG_FSUTILS_PASSWD so credentials are verified against the CONFIG_FSUTILS_PASSWD (PBKDF2-HMAC-SHA256) so credentials are
encrypted password file (for example ROMFS /etc/passwd). verified against the encrypted password file.
When CONFIG_ETC_ROMFS is enabled, also enable
CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE so /etc/passwd is generated
at build time (or provide the passwd file by other means and leave
ETC_ROMFS disabled).
if NSH_LOGIN if NSH_LOGIN