bin/152868: bin: usr.sbin/pc-sysinstall - Add support for using encrypted pass strings

[Kris Moore]

>Number:         152868
>Category:       bin
>Synopsis:       bin: usr.sbin/pc-sysinstall - Add support for using encrypted pass strings
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Dec 06 19:00:19 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Kris Moore
>Release:        9.0-Current
>Organization:
PC-BSD / iXsystems
>Environment:
>Description:
The following patch adds support for using encrypted password strings when setting the root / user passwords via pc-sysinstall
>How-To-Repeat:

>Fix:


Patch attached with submission follows:

diff -ruN src.o/usr.sbin/pc-sysinstall/backend/functions-cleanup.sh src/usr.sbin/pc-sysinstall/backend/functions-cleanup.sh
--- src.o/usr.sbin/pc-sysinstall/backend/functions-cleanup.sh	2010-11-15 15:18:24.632396280 -0500
+++ src/usr.sbin/pc-sysinstall/backend/functions-cleanup.sh	2010-12-06 13:28:16.269745784 -0500
@@ -372,19 +372,32 @@
 # Function which sets the root password from the install config
 set_root_pw()
 {
+  # Get the plaintext string
   get_value_from_cfg_with_spaces rootPass
-  PW="${VAL}"
+  local PW="${VAL}"
+
+  # Get the encrypted string
+  get_value_from_cfg_with_spaces rootEncPass
+  local ENCPW="${VAL}"
 
   # If we don't have a root pass, return
-  if [ -z "${PW}" ]
-  then
-    return 0
-  fi
+  if [ -z "${PW}" -a -z "${ENCPW}" ] ; then return 0 ; fi
 
   echo_log "Setting root password"
-  echo "${PW}" > ${FSMNT}/.rootpw
-  run_chroot_cmd "cat /.rootpw | pw usermod root -h 0"
-  rc_halt "rm ${FSMNT}/.rootpw"
+
+  # Check if setting plaintext password
+  if [ ! -z "${PW}" ] ; then
+    echo "${PW}" > ${FSMNT}/.rootpw
+    run_chroot_cmd "cat /.rootpw | pw usermod root -h 0"
+    rc_halt "rm ${FSMNT}/.rootpw"
+  fi
+
+  # Check if setting encrypted password
+  if [ ! -z "${ENCPW}" ] ; then
+    echo "${ENCPW}" > ${FSMNT}/.rootpw
+    run_chroot_cmd "cat /.rootpw | pw usermod root -H 0"
+    rc_halt "rm ${FSMNT}/.rootpw"
+  fi
 
 };
 
diff -ruN src.o/usr.sbin/pc-sysinstall/backend/functions-users.sh src/usr.sbin/pc-sysinstall/backend/functions-users.sh
--- src.o/usr.sbin/pc-sysinstall/backend/functions-users.sh	2010-11-15 15:18:24.626384838 -0500
+++ src/usr.sbin/pc-sysinstall/backend/functions-users.sh	2010-12-06 13:41:36.664751903 -0500
@@ -93,6 +93,13 @@
       USERPASS="$VAL"
     fi
 
+    echo $line | grep "^userEncPass=" >/dev/null 2>/dev/null
+    if [ "$?" = "0" ]
+    then
+      get_value_from_string "${line}"
+      USERENCPASS="$VAL"
+    fi
+
     echo $line | grep "^userShell=" >/dev/null 2>/dev/null
     if [ "$?" = "0" ]
     then
@@ -135,6 +142,10 @@
         then
           ARGS="${ARGS} -h 0"
           echo "${USERPASS}" >${FSMNT}/.tmpPass
+	elif [ ! -z "${USERENCPASS}" ] 
+	then
+          ARGS="${ARGS} -H 0"
+          echo "${USERENCPASS}" >${FSMNT}/.tmpPass
         else
           ARGS="${ARGS} -h -"
           rm ${FSMNT}/.tmpPass 2>/dev/null 2>/dev/null
@@ -160,7 +171,7 @@
         add_user "${ARGS}"
 
         # Unset our vars before looking for any more users
-        unset USERNAME USERCOMMENT USERPASS USERSHELL USERHOME USERGROUPS
+        unset USERNAME USERCOMMENT USERPASS USERENCPASS USERSHELL USERHOME USERGROUPS
       else
         exit_err "ERROR: commitUser was called without any userName= entry!!!" 
       fi
diff -ruN src.o/usr.sbin/pc-sysinstall/examples/README src/usr.sbin/pc-sysinstall/examples/README
--- src.o/usr.sbin/pc-sysinstall/examples/README	2010-11-15 15:18:24.515381431 -0500
+++ src/usr.sbin/pc-sysinstall/examples/README	2010-12-06 13:31:52.103433323 -0500
@@ -286,7 +286,12 @@
 
 # rootPass=root
 
-Set the root password of the installed system to the specified string
+Set the root password of the installed system to the specified plaintext string
+
+# rootEncPass=<encryptedstring>
+
+Set the root password of the installed system to the specified encrypted string
+
 
 The below variables are used to setup a user on the installed system
 Be sure to call commitUser after after adding these values, and before
@@ -295,6 +300,8 @@
 # userName=kris
 # userComment=Kris Moore
 # userPass=mypass
+or
+# userEncPass=<encryptedstring>
 # userShell=/bin/csh
 # userHome=/home/kris
 # userGroups=wheel,operator


>Release-Note:
>Audit-Trail:
>Unformatted: