mirror of
https://github.com/apache/nuttx-apps.git
synced 2026-08-05 06:10:29 +00:00
608f13fd4b
Migrate passwd encrypt/verify to PBKDF2 modular crypt format using kernel cryptodev (CRYPTO_PBKDF2_HMAC_SHA256 via /dev/crypto). Add passwd_pbkdf2 wrapper, base64url helpers, complexity validation, and pbkdf2_test for RFC 6070 vector coverage. FSUTILS_PASSWD selects CRYPTO, ALLOW_BSD_COMPONENTS, and CRYPTO_CRYPTODEV so existing sim defconfigs keep building. Change NSH_LOGIN_USERNAME default to root and remove fixed-login password defaults. BREAKING CHANGE: TEA-encoded /etc/passwd entries no longer verify. Regenerate each entry after upgrading. Pair with the nuttx host mkpasswd changes in apache/nuttx#19209. Boards must enable the appropriate software or hardware crypto backend for PBKDF2 at runtime. When CONFIG_NSH_LOGIN_FIXED=y, set CONFIG_NSH_LOGIN_PASSWORD in the board defconfig or menuconfig; there is no default password. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
47 lines
1.3 KiB
Text
47 lines
1.3 KiB
Text
#
|
|
# For a description of the syntax of this configuration file,
|
|
# see the file kconfig-language.txt in the NuttX tools repository.
|
|
#
|
|
|
|
config FSUTILS_PASSWD
|
|
bool "Password file support"
|
|
default n
|
|
depends on CRYPTO_CRYPTODEV
|
|
depends on NETUTILS_CODECS
|
|
depends on CODECS_BASE64
|
|
---help---
|
|
Enables support for /etc/passwd file access routines.
|
|
|
|
Requires CONFIG_CRYPTO=y, CRYPTO_CRYPTODEV (and
|
|
ALLOW_BSD_COMPONENTS), plus NETUTILS_CODECS/CODECS_BASE64 for
|
|
base64url hash encoding.
|
|
|
|
NOTE: Password hashes use PBKDF2-HMAC-SHA256 (modular crypt format).
|
|
Existing TEA-encrypted /etc/passwd entries are NOT compatible and
|
|
must be regenerated.
|
|
|
|
if FSUTILS_PASSWD
|
|
|
|
config FSUTILS_PASSWD_PATH
|
|
string "Path to the passwd file"
|
|
default "/etc/passwd"
|
|
|
|
config FSUTILS_PASSWD_READONLY
|
|
bool "Read-only /etc/passwd file?"
|
|
default n
|
|
|
|
config FSUTILS_PASSWD_IOBUFFER_SIZE
|
|
int "Allocated I/O buffer size"
|
|
default 512
|
|
|
|
config FSUTILS_PASSWD_PBKDF2_ITERATIONS
|
|
int "Default PBKDF2 iteration count for new passwords"
|
|
default 10000
|
|
range 1000 200000
|
|
---help---
|
|
Number of PBKDF2-HMAC-SHA256 iterations applied when setting a new
|
|
password. Higher values slow brute-force attacks but also increase
|
|
login latency on low-MHz MCUs. The iteration count is stored in each
|
|
hash string, so changing this option only affects newly-set passwords.
|
|
|
|
endif # FSUTILS_PASSWD
|