openwall / tcb Goto Github PK
View Code? Open in Web Editor NEWAlternative password shadowing scheme
Home Page: https://www.openwall.com/tcb/
License: Other
Alternative password shadowing scheme
Home Page: https://www.openwall.com/tcb/
License: Other
The tcb package contains core components of our tcb suite implementing the alternative password shadowing scheme on Openwall GNU/*/Linux (Owl). It is being made available separately from Owl primarily for use by other distributions. For more information please refer to: https://www.openwall.com/tcb/ To compile and use this you either need recent libxcrypt (which adopted the password hashing API we had introduced in Owl) or our crypt_blowfish patched into glibc (which is how we had introduced that API originally). libxcrypt is available at: https://github.com/besser82/libxcrypt crypt_blowfish is available at: https://www.openwall.com/crypt/
See if any of the changes from NixOS packaging of tcb by @Izorkin should be made upstream or should inspire other related changes upstream. NixOS/nixpkgs#203916
Make -DENABLE_SETFSUGID
the default and only implementation, and use the setgroups()
direct syscall, so that we don't affect other threads' effective credentials.
As discussed in #14 (comment) @ldv-alt sees "no potential benefits in keeping the non-ENABLE_SETFSUGID
variant, and it definitely makes sense to use the setgroups()
syscall instead of the glibc function."
Steps taken:
--with-tcb --with-bcrypt --with-yescrypt
.# Account management.
account required /nix/store/mc3j8gfm9jafs2ywy9xq96whg10fmn3k-tcb-1.2/lib/security/pam_tcb.so shadow fork helper=/run/wrappers/bin/tcb_chkpwd
# Authentication management.
auth sufficient /nix/store/mc3j8gfm9jafs2ywy9xq96whg10fmn3k-tcb-1.2/lib/security/pam_tcb.so nullok shadow fork helper=/run/wrappers/bin/tcb_chkpwd
auth required pam_deny.so
# Password management.
password sufficient /nix/store/mc3j8gfm9jafs2ywy9xq96whg10fmn3k-tcb-1.2/lib/security/pam_tcb.so use_authtok shadow fork nullok write_to=tcb helper=/run/wrappers/bin/tcb_chkpwd
# Session management.
session required pam_env.so conffile=/etc/pam/environment readenv=0
session required /nix/store/mc3j8gfm9jafs2ywy9xq96whg10fmn3k-tcb-1.2/lib/security/pam_tcb.so helper=/run/wrappers/bin/tcb_chkpwd
-r-x--s--x 1 root shadow 17K Dec 4 21:59 /run/wrappers/bin/passwd
-r-x--s--x 1 root shadow 17K Dec 4 21:59 /run/wrappers/bin/tcb_chkpwd
/etc/nsswitch.conf
:shadow: tcb
/etc/login.defs
:USE_TCB yes
TCB_AUTH_GROUP yes
auth
tcb_convert
After all changes, when I try to log in I get an error:
login[3552]: pam_tcb(login:auth): Credentials for user root unknown
login[3033]: pam_tcb(login:auth): Authentication failed for UNKNOWN USER from (uid=0)
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.