Abhishekmishra2808 opened a new pull request, #19321:
URL: https://github.com/apache/nuttx/pull/19321
## Summary
Remove implicit default credentials and add build-time validation. Add
check_passwd_keys.sh and gen_passwd_keys.sh; run key setup via passwd_keys.mk
before config.h is generated. Mirror the same logic in
cmake/nuttx_add_romfs.cmake for CMake builds.
BREAKING CHANGE: Builds with CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y now
require an explicit admin password and non-default TEA keys. The Kconfig
default password "Administrator" and default TEA keys are no longer accepted.
Fix: run make menuconfig, set Admin password under Board Selection ->
Auto-generate /etc/passwd, enable random TEA keys or set
CONFIG_FSUTILS_PASSWD_KEY1..4 manually, and use NSH login with Encrypted
password file verification.
## Impact
Removes the hard-coded "Administrator" password completely and also adds
random TEA generation which results in hardening of NuttX security.
## Testing
```
abhishek@Lethallaptop:~/nuttx$ make distclean
abhishek@Lethallaptop:~/nuttx$ tools/configure.sh sim:login
Copy files
Select CONFIG_HOST_LINUX=y
Refreshing...
CP: arch/dummy/Kconfig to /home/abhishek/nuttx/arch/dummy/dummy_kconfig
CP: boards/dummy/Kconfig to /home/abhishek/nuttx/boards/dummy/dummy_kconfig
LN: platform/board to /home/abhishek/nuttx-apps/platform/dummy
LN: include/arch to arch/sim/include
LN: include/arch/board to /home/abhishek/nuttx/boards/sim/sim/sim/include
LN: drivers/platform to /home/abhishek/nuttx/drivers/dummy
LN: include/arch/chip to /home/abhishek/nuttx/arch/sim/include/sim
LN: arch/sim/src/chip to /home/abhishek/nuttx/arch/sim/src/sim
LN: arch/sim/src/board to /home/abhishek/nuttx/boards/sim/sim/sim/src
mkkconfig in /home/abhishek/nuttx-apps/audioutils
mkkconfig in /home/abhishek/nuttx-apps/benchmarks
mkkconfig in /home/abhishek/nuttx-apps/boot
mkkconfig in /home/abhishek/nuttx-apps/canutils
mkkconfig in /home/abhishek/nuttx-apps/crypto
mkkconfig in /home/abhishek/nuttx-apps/database
mkkconfig in /home/abhishek/nuttx-apps/examples/elf/tests
mkkconfig in /home/abhishek/nuttx-apps/examples/elf
mkkconfig in /home/abhishek/nuttx-apps/examples/mcuboot
mkkconfig in /home/abhishek/nuttx-apps/examples/module
mkkconfig in /home/abhishek/nuttx-apps/examples/rust
mkkconfig in /home/abhishek/nuttx-apps/examples/sotest
mkkconfig in /home/abhishek/nuttx-apps/examples
mkkconfig in /home/abhishek/nuttx-apps/fsutils
mkkconfig in /home/abhishek/nuttx-apps/games
mkkconfig in /home/abhishek/nuttx-apps/graphics
mkkconfig in /home/abhishek/nuttx-apps/industry/modbus
mkkconfig in /home/abhishek/nuttx-apps/industry
mkkconfig in /home/abhishek/nuttx-apps/inertial
mkkconfig in /home/abhishek/nuttx-apps/interpreters/luamodules
mkkconfig in /home/abhishek/nuttx-apps/interpreters
mkkconfig in /home/abhishek/nuttx-apps/logging
mkkconfig in /home/abhishek/nuttx-apps/lte
mkkconfig in /home/abhishek/nuttx-apps/math
mkkconfig in /home/abhishek/nuttx-apps/mlearning
mkkconfig in /home/abhishek/nuttx-apps/netutils
mkkconfig in /home/abhishek/nuttx-apps/sdr
mkkconfig in /home/abhishek/nuttx-apps/system
mkkconfig in /home/abhishek/nuttx-apps/tee
mkkconfig in /home/abhishek/nuttx-apps/testing/arch
mkkconfig in /home/abhishek/nuttx-apps/testing/cxx
mkkconfig in /home/abhishek/nuttx-apps/testing/drivers
mkkconfig in /home/abhishek/nuttx-apps/testing/fs
mkkconfig in /home/abhishek/nuttx-apps/testing/libc
mkkconfig in /home/abhishek/nuttx-apps/testing/mm
mkkconfig in /home/abhishek/nuttx-apps/testing/sched
mkkconfig in /home/abhishek/nuttx-apps/testing
mkkconfig in /home/abhishek/nuttx-apps/videoutils
mkkconfig in /home/abhishek/nuttx-apps/wireless/bluetooth
mkkconfig in /home/abhishek/nuttx-apps/wireless/ieee802154
mkkconfig in /home/abhishek/nuttx-apps/wireless
mkkconfig in /home/abhishek/nuttx-apps
Loaded configuration '.config'
Configuration saved to '.config'
abhishek@Lethallaptop:~/nuttx$ make
BUILD ERROR: Admin password not set.
Run make menuconfig and set:
Board Selection -> Auto-generate /etc/passwd -> Admin password
For TEA keys, either enable random generation in the same menu,
or set CONFIG_FSUTILS_PASSWD_KEY1..4 under Application Configuration
-> File System Utilities -> Password file support.
Password and keys are not saved in defconfig.
tools/passwd_keys.mk:48: *** Aborting:
CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD is not set. Stop.
abhishek@Lethallaptop:~/nuttx$ make menuconfig
CP: arch/dummy/Kconfig to /home/abhishek/nuttx/arch/dummy/dummy_kconfig
CP: boards/dummy/Kconfig to /home/abhishek/nuttx/boards/dummy/dummy_kconfig
LN: platform/board to /home/abhishek/nuttx-apps/platform/dummy
LN: include/arch to arch/sim/include
LN: include/arch/board to /home/abhishek/nuttx/boards/sim/sim/sim/include
LN: drivers/platform to /home/abhishek/nuttx/drivers/dummy
LN: include/arch/chip to /home/abhishek/nuttx/arch/sim/include/sim
LN: arch/sim/src/chip to /home/abhishek/nuttx/arch/sim/src/sim
LN: arch/sim/src/board to /home/abhishek/nuttx/boards/sim/sim/sim/src
Loaded configuration '.config'
Configuration saved to '.config'
abhishek@Lethallaptop:~/nuttx$ make
[passwd] TEA keys written to .config (search for CONFIG_FSUTILS_PASSWD_KEY
to view)
Create version.h
LN: platform/board to /home/abhishek/nuttx-apps/platform/dummy
Register: gpio
Register: hello
Register: dd
Register: dumpstack
Register: nsh
Register: sh
CP: /home/abhishek/nuttx/include/nuttx/config.h
CP: /home/abhishek/nuttx/include/nuttx/fs/hostfs.h
LD: nuttx
Pac SIM with dynamic libs..
'/lib/x86_64-linux-gnu/libz.so.1' -> 'sim-pac/libs/libz.so.1'
'/lib/x86_64-linux-gnu/libc.so.6' -> 'sim-pac/libs/libc.so.6'
'/lib64/ld-linux-x86-64.so.2' -> 'sim-pac/ld-linux-x86-64.so.2'
SIM elf with dynamic libs archive in nuttx.tgz
abhishek@Lethallaptop:~/nuttx$ ./nuttx
login: root
password:
User Logged-in!
nsh> quit
```
<img width="1051" height="573" alt="image"
src="https://github.com/user-attachments/assets/eb8632e5-1b3a-4db7-b514-dda5c47b3768";
/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
