Add support for Password Hardening #10323

davidpil2002 · 2022-03-22T17:54:33Z

Why I did it

New security feature for enforcing strong passwords when login or changing passwords of existing users into the switch.

How I did it

By using mainly Linux package named pam-cracklib that support the enforcement of user passwords, the daemon named hostcfgd, will support add/modify password policies that enforce and strengthen the user passwords.

How to verify it

Manually Verification-

Enable the feature, using the new sonic-cli command passw-hardening or manually add the password hardening table like shown in HLD by using redis-cli command
Change password policies manually like in step 1.
Notes:
password hardening CLI can be found in sonic-utilities repo-
P.R: Add support for Password Hardening sonic-utilities#2121
code config path: config/plugins/sonic-passwh_yang.py
code show path: show/plugins/sonic-passwh_yang.py
Create a new user (using adduser command) or modify an existing password by using passwd command in the terminal. And it will now request a strong password instead of default linux policies.

Automatic Verification - Unitest:
This P.R contained unitest that cover:

test default init values of the feature in PAM files
test all the types of classes policies supported by the feature in PAM files
test aging policy configuration in PAM files

Which release branch to backport (provide reason below if selected)

The coded should be merge in master and should be release ~May

Description for the changelog

Link to config_db schema for YANG module changes

Yang model can be found:
#10322
HLD:
https://github.com/Azure/SONiC/blob/master/doc/passw_hardening/hld_password_hardening.md

A picture of a cute animal (not mandatory but encouraged)

lgtm-com · 2022-03-22T18:23:18Z

This pull request introduces 1 alert when merging eff356a into f8e1104 - view on LGTM.com

new alerts:

1 for Unused import

lgtm-com · 2022-03-24T11:28:29Z

This pull request introduces 1 alert when merging 5ab7c2b into 147d631 - view on LGTM.com

new alerts:

1 for Unused import

…mit: 2919b48

lgtm-com · 2022-03-27T11:53:20Z

This pull request introduces 1 alert when merging a4d452b into cc938e7 - view on LGTM.com

new alerts:

1 for Unused import

lgtm-com · 2022-03-28T11:08:55Z

This pull request introduces 1 alert when merging 93072bd into cc938e7 - view on LGTM.com

new alerts:

1 for Unused import

dgsudharsan · 2022-03-29T00:29:42Z

@davidpil2002 Can you please fix LGTM alert?

davidpil2002 · 2022-03-29T11:43:21Z

/azpw run Azure.sonic-buildimage

mssonicbld · 2022-03-29T11:43:23Z

/AzurePipelines run Azure.sonic-buildimage

azure-pipelines · 2022-03-29T11:43:34Z

Azure Pipelines successfully started running 1 pipeline(s).

davidpil2002 · 2022-03-30T06:26:46Z

@davidpil2002 Can you please fix LGTM alert?

done

davidpil2002 · 2022-03-30T10:50:02Z

/azpw run Azure.sonic-buildimage

mssonicbld · 2022-03-30T10:50:04Z

/AzurePipelines run Azure.sonic-buildimage

src/sonic-host-services/scripts/hostcfgd

src/sonic-host-services-data/templates/common-password.j2

…ning class

files/build_templates/sonic_debian_extension.j2

src/sonic-host-services-data/templates/common-password.j2

src/sonic-host-services/scripts/hostcfgd

…e/sonic-buildimage/pull/10323/files about verification when reading files and add exception

lguohan · 2022-05-30T06:34:18Z

files/build_templates/sonic_debian_extension.j2

@@ -266,6 +266,10 @@ fi
 sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/sonic-device-data_*.deb || \
    sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f

+# Install cracklib  (and its dependencies via 'apt-get -y install -f')
+sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/libpam-cracklib_*.deb || \


why not just apt-get? I do not understand this. the package is already in bullseye.

the package in bullseye is an older version than the version that I used.
I don't think the feature will be broken if we used an older version, but I think it is better to save it.

https://packages.debian.org/bullseye/libpam-cracklib

can you double check, think it is the same version.

I double-checked, you are correct, probably confused with the buster version.
I pushed a commit that is doing just apt-get install, instead download & dpkg Debian pkg

@lguohan
can you approve the pull request now?

…nic-net#10919)

Signed-off-by: Guohan Lu <[email protected]>

…cts sonic-net#10972 Why I did it Fix the target directory not empty issue when publishing artifacts. Some of the artifacts are published to $(Build.ArtifactStagingDirectory)/target/ before source code checked out.

…wnload debian

davidpil2002

Fix comment about cracklib pkg

davidpil2002 · 2022-06-06T10:56:53Z

/azpw run Azure.sonic-buildimage

mssonicbld · 2022-06-06T10:56:55Z

/AzurePipelines run Azure.sonic-buildimage

azure-pipelines · 2022-06-06T10:57:08Z

Azure Pipelines successfully started running 1 pipeline(s).

liuh-80 · 2022-06-29T03:22:59Z

/azp run

azure-pipelines · 2022-06-29T03:23:06Z

You have several pipelines (over 10) configured to build pull requests in this repository. Specify which pipelines you would like to run by using /azp run [pipelines] command. You can specify multiple pipelines using a comma separated list.

liuh-80 · 2022-06-29T03:27:45Z

/AzurePipelines run Azure.sonic-buildimage

azure-pipelines · 2022-06-29T03:27:58Z

Azure Pipelines successfully started running 1 pipeline(s).

liuh-80

This feature will be runtime optional, this is acceptable according to offline sync, approved.

- Why I did it New security feature for enforcing strong passwords when login or changing passwords of existing users into the switch. - How I did it By using mainly Linux package named pam-cracklib that support the enforcement of user passwords, the daemon named hostcfgd, will support add/modify password policies that enforce and strengthen the user passwords. - How to verify it Manually Verification- 1. Enable the feature, using the new sonic-cli command passw-hardening or manually add the password hardening table like shown in HLD by using redis-cli command 2. Change password policies manually like in step 1. Notes: password hardening CLI can be found in sonic-utilities repo- P.R: Add support for Password Hardening sonic-utilities#2121 code config path: config/plugins/sonic-passwh_yang.py code show path: show/plugins/sonic-passwh_yang.py 3. Create a new user (using adduser command) or modify an existing password by using passwd command in the terminal. And it will now request a strong password instead of default linux policies. Automatic Verification - Unitest: This PR contained unitest that cover: 1. test default init values of the feature in PAM files 2. test all the types of classes policies supported by the feature in PAM files 3. test aging policy configuration in PAM files

davidpil2002 added 7 commits March 1, 2022 18:58

Password Hardening Feature

2a59875

fix password hardening comments from the pull request

440307d

Merge branch 'master' into dev-password-hardening

fb5764e

small fix about passw hardening P.R

7a7fc90

move init_cfg.json.j2 changes to separate pull request with YANG model

9563886

modify age calculation & fix some values in the common-password.j2 file

49d1195

fix digits class name case

eff356a

davidpil2002 requested review from qiluo-msft, xumia and lguohan as code owners March 22, 2022 17:54

davidpil2002 changed the title ~~Dev password hardening~~ Password Hardening Feature Mar 23, 2022

dgsudharsan previously approved these changes Mar 24, 2022

View reviewed changes

fix unitest hostcfgd_passwh_test.py by adding enable_digits_class sample

5ab7c2b

davidpil2002 dismissed dgsudharsan’s stale review via 5ab7c2b March 24, 2022 10:58

davidpil2002 added 2 commits March 24, 2022 13:51

Merge branch 'master' into dev-password-hardening

a5959f5

add mock table to passw hardening unitest in result of changes in com…

a4d452b

…mit: 2919b48

fix credit disabled, by setting 0 instead to be clear

93072bd

removed unused import

3a8b5fd

davidpil2002 mentioned this pull request Mar 29, 2022

Password Hardening HLD sonic-net/SONiC#874

Merged

[passw-hardening] remove misstype line in hostcfgd

8e507e8

davidpil2002 dismissed dgsudharsan’s stale review via 8e507e8 April 27, 2022 07:28

liuh-80 reviewed Apr 28, 2022

View reviewed changes

src/sonic-host-services/scripts/hostcfgd Outdated Show resolved Hide resolved

src/sonic-host-services/scripts/hostcfgd Outdated Show resolved Hide resolved

src/sonic-host-services-data/templates/common-password.j2 Show resolved Hide resolved

[password-hardening] move passw logic from AaaCfg class to PasswHarde…

e4bface

…ning class

liuh-80 reviewed Apr 29, 2022

View reviewed changes

davidpil2002 and others added 2 commits May 1, 2022 10:40

[password-hardening]fix few comments from PR: https://github.com/Azur…

458691c

…e/sonic-buildimage/pull/10323/files about verification when reading files and add exception

Merge branch 'Azure:master' into dev-password-hardening

3b5f7a1

lguohan reviewed May 30, 2022

View reviewed changes

davidpil2002 and others added 5 commits May 30, 2022 10:41

Merge branch 'Azure:master' into dev-password-hardening

010e023

[ci] Publish logs when building image job is canceled by timeout. (so…

eb977ca

…nic-net#10919)

[CODEOWNERS]: update code owners for various repos (sonic-net#10980)

0f423af

Signed-off-by: Guohan Lu <[email protected]>

[password-hardening]install cracklib from debian repo list instead do…

2967247

…wnload debian

davidpil2002 commented May 31, 2022

View reviewed changes

Merge branch 'master' into dev-password-hardening

a2ec817

zhangyanzhao requested a review from lguohan June 1, 2022 23:56

liuh-80 approved these changes Jun 29, 2022

View reviewed changes

liat-grozovik added the Request for 202205 Branch label Jun 29, 2022

liat-grozovik merged commit 8b7d069 into sonic-net:master Jun 29, 2022

yxieca added the Included in 202205 Branch label Jun 30, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for Password Hardening #10323

Add support for Password Hardening #10323

davidpil2002 commented Mar 22, 2022 •

edited by liat-grozovik

Loading

lgtm-com bot commented Mar 22, 2022

lgtm-com bot commented Mar 24, 2022

lgtm-com bot commented Mar 27, 2022

lgtm-com bot commented Mar 28, 2022

dgsudharsan commented Mar 29, 2022

davidpil2002 commented Mar 29, 2022

mssonicbld commented Mar 29, 2022

azure-pipelines bot commented Mar 29, 2022

davidpil2002 commented Mar 30, 2022

davidpil2002 commented Mar 30, 2022

mssonicbld commented Mar 30, 2022

lguohan May 30, 2022

davidpil2002 May 30, 2022

lguohan May 30, 2022

davidpil2002 May 31, 2022 •

edited

Loading

davidpil2002 Jun 7, 2022

davidpil2002 left a comment

davidpil2002 commented Jun 6, 2022

mssonicbld commented Jun 6, 2022

azure-pipelines bot commented Jun 6, 2022

liuh-80 commented Jun 29, 2022

azure-pipelines bot commented Jun 29, 2022

liuh-80 commented Jun 29, 2022

azure-pipelines bot commented Jun 29, 2022

liuh-80 left a comment

Add support for Password Hardening #10323

Add support for Password Hardening #10323

Conversation

davidpil2002 commented Mar 22, 2022 • edited by liat-grozovik Loading

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

lgtm-com bot commented Mar 22, 2022

lgtm-com bot commented Mar 24, 2022

lgtm-com bot commented Mar 27, 2022

lgtm-com bot commented Mar 28, 2022

dgsudharsan commented Mar 29, 2022

davidpil2002 commented Mar 29, 2022

mssonicbld commented Mar 29, 2022

azure-pipelines bot commented Mar 29, 2022

davidpil2002 commented Mar 30, 2022

davidpil2002 commented Mar 30, 2022

mssonicbld commented Mar 30, 2022

lguohan May 30, 2022

Choose a reason for hiding this comment

davidpil2002 May 30, 2022

Choose a reason for hiding this comment

lguohan May 30, 2022

Choose a reason for hiding this comment

davidpil2002 May 31, 2022 • edited Loading

Choose a reason for hiding this comment

davidpil2002 Jun 7, 2022

Choose a reason for hiding this comment

davidpil2002 left a comment

Choose a reason for hiding this comment

davidpil2002 commented Jun 6, 2022

mssonicbld commented Jun 6, 2022

azure-pipelines bot commented Jun 6, 2022

liuh-80 commented Jun 29, 2022

azure-pipelines bot commented Jun 29, 2022

liuh-80 commented Jun 29, 2022

azure-pipelines bot commented Jun 29, 2022

liuh-80 left a comment

Choose a reason for hiding this comment

davidpil2002 commented Mar 22, 2022 •

edited by liat-grozovik

Loading

davidpil2002 May 31, 2022 •

edited

Loading