From 72defc45dd7cb3f75f2cb2669225084293a5d9cb Mon Sep 17 00:00:00 2001 From: "Yann E. MORIN" Date: Sat, 5 Jan 2013 04:52:03 +0000 Subject: target: add different methods to encode passwords Passwords can be encoded in different ways (from the weakest to the strongest): des, md5, sha-256, sha-512 Add a choice entry to select the method, defaulting to 'md5'. Signed-off-by: "Yann E. MORIN" Tested-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard --- system/Config.in | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) (limited to 'system/Config.in') diff --git a/system/Config.in b/system/Config.in index 19bdd2d74..69863c42b 100644 --- a/system/Config.in +++ b/system/Config.in @@ -12,6 +12,60 @@ config BR2_TARGET_GENERIC_ISSUE help Select system banner (/etc/issue) to be displayed at login. +choice + bool "Passwords encoding" + default BR2_TARGET_GENERIC_PASSWD_MD5 + help + Choose the password encoding scheme to use when Buildroot + needs to encode a password (eg. the root password, below). + + Note: this is used at build-time, and *not* at runtime. + +config BR2_TARGET_GENERIC_PASSWD_DES + bool "des" + help + Use standard 56-bit DES-based crypt(3) to encode passwords. + + Old, wildly available, but also the weakest, very susceptible to + brute-force attacks. + +config BR2_TARGET_GENERIC_PASSWD_MD5 + bool "md5" + help + Use MD5 to encode passwords. + + The default. Wildly available, and pretty good. + Although pretty strong, MD5 is now an old hash function, and + suffers from some weaknesses, which makes it susceptible to + brute-force attacks. + +config BR2_TARGET_GENERIC_PASSWD_SHA256 + bool "sha-256" + help + Use SHA256 to encode passwords. + + Very strong, but not ubiquitous, although available in glibc + for some time now. Choose only if you are sure your C library + understands SHA256 passwords. + +config BR2_TARGET_GENERIC_PASSWD_SHA512 + bool "sha-512" + help + Use SHA512 to encode passwords. + + Extremely strong, but not ubiquitous, although available in glibc + for some time now. Choose only if you are sure your C library + understands SHA512 passwords. + +endchoice # Passwd encoding + +config BR2_TARGET_GENERIC_PASSWD_METHOD + string + default "des" if BR2_TARGET_GENERIC_PASSWD_DES + default "md5" if BR2_TARGET_GENERIC_PASSWD_MD5 + default "sha-256" if BR2_TARGET_GENERIC_PASSWD_SHA256 + default "sha-512" if BR2_TARGET_GENERIC_PASSWD_SHA512 + choice prompt "/dev management" default BR2_ROOTFS_DEVICE_CREATION_STATIC -- cgit v1.2.3