mirror of
https://github.com/apache/nuttx.git
synced 2026-08-02 12:49:00 +00:00
ffa6ba222f
Remove implicit default credentials and add build-time validation. Add check_passwd_keys.sh and gen_passwd_keys.sh; run key setup via passwd_keys.mk before config.h is generated. Mirror the same logic in cmake/nuttx_add_romfs.cmake for CMake builds. BREAKING CHANGE: Builds with CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y now require an explicit admin password and non-default TEA keys. The Kconfig default password "Administrator" and default TEA keys are no longer accepted. Fix: run make menuconfig, set Admin password under Board Selection -> Auto-generate /etc/passwd, enable random TEA keys or set CONFIG_FSUTILS_PASSWD_KEY1..4 manually, and use NSH login with Encrypted password file verification. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
89 lines
3 KiB
Bash
Executable file
89 lines
3 KiB
Bash
Executable file
#!/usr/bin/env sh
|
|
# tools/gen_passwd_keys.sh
|
|
#
|
|
# Licensed to the Apache Software Foundation (ASF) under one or more
|
|
# contributor license agreements. See the NOTICE file distributed with
|
|
# this work for additional information regarding copyright ownership. The
|
|
# ASF licenses this file to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance with the
|
|
# License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
#
|
|
# Usage:
|
|
# gen_passwd_keys.sh <path-to-.config>
|
|
#
|
|
# Generates four random 32-bit TEA key values from /dev/urandom and
|
|
# writes/replaces CONFIG_FSUTILS_PASSWD_KEY1..4 in the target .config file.
|
|
# Handles both "line exists (replace)" and "line missing (append)" cases.
|
|
#
|
|
# Key values are NOT printed to stdout or stderr. Search the .config file
|
|
# for CONFIG_FSUTILS_PASSWD_KEY to view them if needed.
|
|
#
|
|
# Exit 0 on success, non-zero with a message on failure.
|
|
|
|
set -e
|
|
|
|
CONFIG="${1}"
|
|
if [ -z "${CONFIG}" ]; then
|
|
printf 'Usage: gen_passwd_keys.sh <path-to-.config>\n' >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "${CONFIG}" ]; then
|
|
printf 'gen_passwd_keys: file not found: %s\n' "${CONFIG}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Generate a random 32-bit hex value via /dev/urandom.
|
|
# Uses od -tx4 which always produces exactly 8 hex digits.
|
|
rand_key() {
|
|
dd if=/dev/urandom bs=4 count=1 2>/dev/null \
|
|
| od -An -tx4 \
|
|
| tr -d ' \n'
|
|
}
|
|
|
|
K1="0x$(rand_key)"
|
|
K2="0x$(rand_key)"
|
|
K3="0x$(rand_key)"
|
|
K4="0x$(rand_key)"
|
|
|
|
# Remove any existing definitions (assigned or "is not set") everywhere.
|
|
sed -i \
|
|
'/^# CONFIG_FSUTILS_PASSWD_KEY[1-4] is not set/d;
|
|
/^CONFIG_FSUTILS_PASSWD_KEY[1-4]=/d' \
|
|
"${CONFIG}" || {
|
|
printf 'gen_passwd_keys: ERROR: failed to edit %s (check permissions)\n' \
|
|
"${CONFIG}" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Insert keys in the FSUTILS_PASSWD section when it exists so menuconfig
|
|
# and mkconfig see a single canonical copy (not orphaned lines at EOF).
|
|
if grep -q '^CONFIG_FSUTILS_PASSWD_IOBUFFER_SIZE=' "${CONFIG}"; then
|
|
sed -i "/^CONFIG_FSUTILS_PASSWD_IOBUFFER_SIZE=/a\\
|
|
CONFIG_FSUTILS_PASSWD_KEY1=${K1}\\
|
|
CONFIG_FSUTILS_PASSWD_KEY2=${K2}\\
|
|
CONFIG_FSUTILS_PASSWD_KEY3=${K3}\\
|
|
CONFIG_FSUTILS_PASSWD_KEY4=${K4}" "${CONFIG}" || {
|
|
printf 'gen_passwd_keys: ERROR: failed to insert keys into %s\n' \
|
|
"${CONFIG}" >&2
|
|
exit 1
|
|
}
|
|
else
|
|
printf 'CONFIG_FSUTILS_PASSWD_KEY1=%s\nCONFIG_FSUTILS_PASSWD_KEY2=%s\nCONFIG_FSUTILS_PASSWD_KEY3=%s\nCONFIG_FSUTILS_PASSWD_KEY4=%s\n' \
|
|
"${K1}" "${K2}" "${K3}" "${K4}" >> "${CONFIG}" || {
|
|
printf 'gen_passwd_keys: ERROR: failed to append keys to %s\n' \
|
|
"${CONFIG}" >&2
|
|
exit 1
|
|
}
|
|
fi
|
|
|
|
printf 'TEA keys generated and written to %s.\nSearch %s for CONFIG_FSUTILS_PASSWD_KEY to view if needed.\n' \
|
|
"${CONFIG}" "${CONFIG}"
|