Add standalone host PBKDF2-HMAC-SHA256 mkpasswd, board_romfs_mkpasswd.sh,
and promptpasswd.sh with confirm-password support. Integrate ROMFS passwd
generation in Board.mk and CMake. Drop TEA key checks from passwd_keys.mk.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Support NUTTX_ROMFS_PASSWD_PASSWORD via update_romfs_password.sh for
configs that enable ROMFS passwd without a defconfig password (sim/login
CI). Enable RANDOMIZE_KEYS in sim/login defconfig. Update mkpasswd.c
header, platform docs, and the mkpasswd_autogen guide.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Remove implicit default credentials and add build-time validation.
Add check_passwd_keys.sh and gen_passwd_keys.sh; run key setup via
passwd_keys.mk before config.h is generated. Mirror the same logic in
cmake/nuttx_add_romfs.cmake for CMake builds.
BREAKING CHANGE: Builds with CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y now
require an explicit admin password and non-default TEA keys. The
Kconfig default password "Administrator" and default TEA keys are no
longer accepted. Fix: run make menuconfig, set Admin password under
Board Selection -> Auto-generate /etc/passwd, enable random TEA keys or
set CONFIG_FSUTILS_PASSWD_KEY1..4 manually, and use NSH login with
Encrypted password file verification.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Introduce mkpasswd, a pure-C host tool for generating encrypted password
files at build time using TEA encryption. This enables secure,
credential-free firmware images while allowing build-time password
configuration.
Changes:
* Add mkpasswd.c host tool for TEA-based password hashing and encryption
* Integrate mkpasswd into Make build system (tools/Makefile.host)
* Add CMake support for mkpasswd compilation and ROMFS passwd generation
* Add CONFIG_BOARD_ETC_ROMFS_PASSWD_* configuration options to Kconfig
* Implement credential exclusion from defconfig to prevent password leaking
* Update savedefconfig.cmake to strip sensitive credentials
* Fix mkdir() portability for Windows Native builds (CONFIG_WINDOWS_NATIVE)
* Change default username from "admin" to "root" (POSIX convention)
* Improve build-failure error message with full menuconfig navigation path
BREAKING CHANGE: Boards enabling CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE
must set CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD to a non-empty string
of at least 8 characters. The build now fails with an explicit error if
this config is left empty. To fix: run 'make menuconfig' and navigate to:
Board Selection --->
Auto-generate /etc/passwd at build time --->
Admin password
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
