StarlingX

  1. Bug #2043608
  2. Comment #2

Comment 2 for bug 2043608

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to utilities (master)

Reviewed: https://review.opendev.org/c/starlingx/utilities/+/901088
Committed: https://opendev.org/starlingx/utilities/commit/5e7fd494a002cfd099c9d12f1f25eb8f5cea7293
Submitter: "Zuul (22348)"
Branch: master

commit 5e7fd494a002cfd099c9d12f1f25eb8f5cea7293
Author: Kyle MacLeod <email address hidden>
Date: Wed Nov 15 13:19:05 2023 -0500

    Update openssl passwd compatibility version 1/3

    This update fixes incompatibilities between openssl versions 1.x (in
    current system controller load) and 3.x (on more recent distributions
    including Ubuntu 22.x). The ancient '-crypt' switch is replaced with the
    '-6' encryption format, which is a secure SHA512-based algorithm.

    Both openssl 1 and 3 versions support the '-6' option.
    Since the --initial-password can also be used with --no-force-password,
    the encrypted password hashing is now hardened to modern levels.

    Test Plan

    Perform the following two tests using two systems; one running openssl
    version 1.1 and the other 3.0:
    - OpenSSL 1.1.1n 15 Mar 2022
    - OpenSSL 3.0.11 19 Sep 2023

    PASS: Update installation ISO specifying a new initial password:
    sudo ./update-iso.sh -i
    /opt/dc-vault/loads/23.09/starlingx-intel-x86-64-cd.iso -o ./updated.iso
    --initial-password 'MyPassword!23*'
    Verify that the node boots and the new initial password is applied.
    Verify that the user is forced to change the password on first boot.

    PASS: Update installation ISO specifying a new initial password:
    sudo ./update-iso.sh -i
    /opt/dc-vault/loads/23.09/starlingx-intel-x86-64-cd.iso -o ./updated.iso
    --initial-password 'MyPassword!23*' --no-force-password
    Verify that the node boots and the new initial password is applied.
    Verify that the user is not forced to change the password on first boot.

    PASS: verify that the password does not appear in plain text in logs

    Closes-Bug: 2043608

    Change-Id: Ib851d8db1a72ba4aa74573fb290d8417d016e370
    Signed-off-by: Kyle MacLeod <email address hidden>