From 2d4018c82c4304c6522f68469530aee69aed4a97 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Tue, 15 Aug 2017 12:40:43 +0200 Subject: [PATCH 1/2] [fix] auto upgrade admin password to sha-512 on login --- moulinette/authenticators/ldap.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/moulinette/authenticators/ldap.py b/moulinette/authenticators/ldap.py index dc843b49..0a15c55b 100644 --- a/moulinette/authenticators/ldap.py +++ b/moulinette/authenticators/ldap.py @@ -4,6 +4,9 @@ from __future__ import absolute_import import errno import logging +import random +import string +import crypt import ldap import ldap.modlist as modlist @@ -82,6 +85,24 @@ class Authenticator(BaseAuthenticator): raise MoulinetteError(169, m18n.g('ldap_server_down')) else: self.con = con + self._ensure_password_uses_strong_hash(password) + + def _ensure_password_uses_strong_hash(self, password): + # XXX this has been copy pasted from YunoHost, should we put that into moulinette? + def _hash_user_password(password): + char_set = string.ascii_uppercase + string.ascii_lowercase + string.digits + "./" + salt = ''.join([random.SystemRandom().choice(char_set) for x in range(16)]) + salt = '$6$' + salt + '$' + return '{CRYPT}' + crypt.crypt(str(password), salt) + + hashed_password = self.search("cn=admin,dc=yunohost,dc=org", + attrs=["userPassword"])[0]["userPassword"][0] + + # we aren't using sha-512 but something else that is weaker, proceed to upgrade + if not hashed_password.startswith("{CRYPT}$6$"): + self.update("cn=admin", { + "userPassword": _hash_user_password(password), + }) # Additional LDAP methods # TODO: Review these methods From 6aa22000cd87f9bcb2df1ea0af1c0d60df626c0b Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 18 Aug 2017 02:03:22 +0200 Subject: [PATCH 2/2] [fix] handle post-install --- moulinette/authenticators/ldap.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/moulinette/authenticators/ldap.py b/moulinette/authenticators/ldap.py index 0a15c55b..ea874605 100644 --- a/moulinette/authenticators/ldap.py +++ b/moulinette/authenticators/ldap.py @@ -96,10 +96,14 @@ class Authenticator(BaseAuthenticator): return '{CRYPT}' + crypt.crypt(str(password), salt) hashed_password = self.search("cn=admin,dc=yunohost,dc=org", - attrs=["userPassword"])[0]["userPassword"][0] + attrs=["userPassword"])[0] + + # post-install situation, password is not already set + if "userPassword" not in hashed_password or not hashed_password["userPassword"]: + return # we aren't using sha-512 but something else that is weaker, proceed to upgrade - if not hashed_password.startswith("{CRYPT}$6$"): + if not hashed_password["userPassword"][0].startswith("{CRYPT}$6$"): self.update("cn=admin", { "userPassword": _hash_user_password(password), })