main/acf-core: backport password salt support and acfpasswd tool

4 files changed, 248 insertions, 4 deletions

diff --git a/main/acf-core/0001-acfpasswd-new-tool-to-set-passwords-from-comman-line.patch b/main/acf-core/0001-acfpasswd-new-tool-to-set-passwords-from-comman-line.patch
new file mode 100644
index 0000000000..405ff0c667
--- /dev/null
+++ b/main/acf-core/0001-acfpasswd-new-tool-to-set-passwords-from-comman-line.patch
@@ -0,0 +1,99 @@
+From a55d954939799cd35efffa896cebaa17d7393e7f Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Thu, 12 Jan 2012 11:21:20 +0100
+Subject: [PATCH] acfpasswd: new tool to set passwords from comman line
+
+This tool allows users to set/reset an ACF password from command line.
+
+It also allows user to syncronize the ACF password with the system
+password so the ACF password becomes same as shell login password. This
+requires that the username exists in both /etc/acf/passwd and /etc/shadow
+
+diff --git a/bin/acfpasswd b/bin/acfpasswd
+new file mode 100644
+index 0000000..e25b966
+--- /dev/null
++++ b/bin/acfpasswd
+@@ -0,0 +1,79 @@
++#!/bin/sh
++
++# tool for managing the ACF passwords
++
++passwdfile=${ACFPASSWD:-/etc/acf/passwd}
++shadow=${SHADOW:-/etc/shadow}
++
++usage() {
++	echo "usage: acfpasswd [-s] USER"
++	echo ""
++	exit 1
++}
++
++die() {
++	echo "$@" >&2
++	exit 1
++}
++
++find_user_or_die() {
++	local user="$1"
++	grep -q "^${user}:" "$passwdfile" \
++		|| die "user '$user' was not found in $passwdfile"
++}
++
++set_pw_hash() {
++	local user="$1"
++	local pwhash="$2"
++	# use : as sed separator since its guaranteed to no be valid in shadow
++	sed -i -e "s:^${user}\:[^\:]*\::${user}\:${pwhash}\::" "$passwdfile"
++}
++
++syncpasswd() {
++	local user="$1"
++	local pwhash=$(awk -F: -v user="$user" '$1 == user { print $2 }' \
++			$shadow) || exit
++	find_user_or_die "$user"
++	[ -z "$pwhash" ] && die "user '$user' was not found in $shadow"
++	set_pw_hash "$user" "$pwhash"
++	exit
++}
++
++sync_with_system=
++while getopts "hs" opt; do
++	case "$opt" in
++	h) usage;;
++	s) sync_with_system=yes;;
++	esac
++done
++
++shift $(($OPTIND - 1))
++
++user="$1"
++[ -z "$user" ] && usage
++
++[ -n "$sync_with_system" ] && syncpasswd "$user"
++
++# set password for given user
++find_user_or_die "$user"
++tries=0
++while true; do 
++	echo -n "Enter new ACF password for $user (will not echo): "
++	hash=$(mkpasswd -m sha | tail -n1)
++	salt=$(echo "$hash" | cut -d$ -f3)
++	echo ""
++	echo -n "Re-enter the ACF password (will not echo): "
++	hash2=$(mkpasswd -S "$salt" -m sha | tail -n1)
++	echo ""
++	[ "$hash" = "$hash2" ] && break
++	echo -n "The entered passwords does not match. "
++	tries=$(( $tries + 1))
++	if [ $tries -gt 3 ]; then
++		die "ACF password was NOT changed"
++	else
++		echo "Please try again."
++	fi
++done
++
++set_pw_hash "$user" "$hash" && echo "ACF password for $user was changed."
++
+-- 
+1.7.8.2
+
diff --git a/main/acf-core/0001-authenticator-use-salt-and-sha-512-encryption.patch b/main/acf-core/0001-authenticator-use-salt-and-sha-512-encryption.patch
new file mode 100644
index 0000000000..5c38cc38ab
--- /dev/null
+++ b/main/acf-core/0001-authenticator-use-salt-and-sha-512-encryption.patch
@@ -0,0 +1,89 @@
+From eb4221096cc581a41f64d7d6b99e8d5be0d470b0 Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Thu, 27 Oct 2011 18:52:11 +0200
+Subject: [PATCH 1/2] authenticator: use salt and sha-512 encryption
+
+---
+ lib/authenticator.lua |   45 +++++++++++++++++++++++++++++++++++++++++++--
+ 1 files changed, 43 insertions(+), 2 deletions(-)
+
+diff --git a/lib/authenticator.lua b/lib/authenticator.lua
+index 724b854..f3af4e3 100644
+--- a/lib/authenticator.lua
++++ b/lib/authenticator.lua
+@@ -6,6 +6,8 @@ module (..., package.seeall)
+ require("modelfunctions")
+ require("format")
+ require("md5")
++require("posix")
++require("session")
+ 
+ -- This is the sub-authenticator
+ -- In the future, this will be set based upon configuration
+@@ -61,6 +63,45 @@ local get_id = function(self, userid)
+ 	return authstruct[userid]
+ end
+ 
++-- verify a plaintextword against a hash
++-- returns:
++--	true if password matches or
++--	false if password does not match
++local verify_password = function(plaintext, pwhash)
++	--[[ 
++	from man crypt(3):
++
++	If  salt is a character string starting with the characters "$id$" fol-
++	lowed by a string terminated by "$":
++
++              $id$salt$encrypted
++
++	then instead of using the DES machine,  id  identifies  the  encryption
++	method  used  and  this  then  determines  how the rest of the password
++	string is interpreted.  The following values of id are supported:
++
++              ID  | Method
++              ---------------------------------------------------------
++              1   | MD5
++              2a  | Blowfish (not in mainline glibc; added in some
++                  | Linux distributions)
++              5   | SHA-256 (since glibc 2.7)
++              6   | SHA-512 (since glibc 2.7)
++	]]--
++	local algo_salt, hash = string.match(pwhash, "^(%$%d%$[a-zA-Z0-9./]+%$)(.*)")
++	if algo_salt ~= nil and hash ~= nil then
++		return (pwhash == posix.crypt(plaintext, algo_salt))
++	end
++	-- fall back to old style md5 checksum
++	return (pwhash == md5.sumhexa(plaintext))	
++end
++
++-- generate a salt string
++local mksalt = function()
++	-- use sha-512 algorithm (no 6)
++	return "$6$"..session.random_hash(96).."$"
++end
++
+ --- public methods
+ 
+ -- This function returns true or false, and
+@@ -75,7 +116,7 @@ authenticate = function(self, userid, password)
+ 		
+ 		if not id then
+ 			errtxt = "Userid not found"
+-		elseif id.password ~= md5.sumhexa(password) then
++		elseif not verify_password(password, id.password) then
+ 			errtxt = "Invalid password"
+ 		end
+ 	end
+@@ -110,7 +151,7 @@ write_userinfo = function(self, userinfo)
+ 	-- Username, password, roles, skin, home are allowed to not exist, just leave the same
+ 	id.userid = userinfo.userid
+ 	if userinfo.username then id.username = userinfo.username end
+-	if userinfo.password then id.password = md5.sumhexa(userinfo.password) end
++	if userinfo.password then id.password = posix.crypt(userinfo.password, mksalt()) end
+ 	if userinfo.roles then id.roles = table.concat(userinfo.roles, ",") end
+ 	if userinfo.skin then id.skin = userinfo.skin end
+ 	if userinfo.home then id.home = userinfo.home end
+-- 
+1.7.8.2
+
diff --git a/main/acf-core/0002-Fixed-mksalt-to-use-correct-characters.patch b/main/acf-core/0002-Fixed-mksalt-to-use-correct-characters.patch
new file mode 100644
index 0000000000..a228e97c58
--- /dev/null
+++ b/main/acf-core/0002-Fixed-mksalt-to-use-correct-characters.patch
@@ -0,0 +1,37 @@
+From f41fd7182d71427d7a0adf54e55df3a3c97a667e Mon Sep 17 00:00:00 2001
+From: Ted Trask <ttrask01@yahoo.com>
+Date: Thu, 27 Oct 2011 18:51:08 +0000
+Subject: [PATCH 2/2] Fixed mksalt to use correct characters
+
+---
+ lib/authenticator.lua |   13 ++++++++++---
+ 1 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/lib/authenticator.lua b/lib/authenticator.lua
+index f3af4e3..43814c1 100644
+--- a/lib/authenticator.lua
++++ b/lib/authenticator.lua
+@@ -96,10 +96,17 @@ local verify_password = function(plaintext, pwhash)
+ 	return (pwhash == md5.sumhexa(plaintext))	
+ end
+ 
+--- generate a salt string
++local b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./"
++
+ local mksalt = function()
+-	-- use sha-512 algorithm (no 6)
+-	return "$6$"..session.random_hash(96).."$"
++	local file = io.open("/dev/urandom")
++	local str = ""
++	if file == nil then return nil end
++	for i = 1,16 do
++		local offset = (string.byte(file:read(1)) % 64) + 1 
++		str = str .. string.sub (b64, offset, offset)
++	end
++	return "$6$"..str.."$"
+ end
+ 
+ --- public methods
+-- 
+1.7.8.2
+
diff --git a/main/acf-core/APKBUILD b/main/acf-core/APKBUILD
index e9d11fc00e..becedf5d4d 100644
--- a/main/acf-core/APKBUILD
+++ b/main/acf-core/APKBUILD
@@ -2,17 +2,36 @@
 # Maintainer: Ted Trask <ttrask01@yahoo.com>
 pkgname=acf-core
 pkgver=0.13.5
-pkgrel=0
+pkgrel=1
 pkgdesc="A web-based system administration interface framework"
 url="http://git.alpinelinux.org/cgit/acf-core"
 arch="noarch"
 license="GPL-2"
 install="$pkgname.post-upgrade"
 depends="acf-jquery acf-lib acf-skins haserl lua lua-posix lua-md5"
-source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2"
+source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2
+	0001-authenticator-use-salt-and-sha-512-encryption.patch
+	0002-Fixed-mksalt-to-use-correct-characters.patch
+	0001-acfpasswd-new-tool-to-set-passwords-from-comman-line.patch
+"
+
+prepare() {
+	cd "$srcdir/$pkgname-$pkgver"
+	for i in $source; do
+		case $i in
+		*.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
+		esac
+	done
+}
 
 package() {
 	cd "$srcdir/$pkgname-$pkgver"
-	make DESTDIR="$pkgdir" install
+	make DESTDIR="$pkgdir" install || return 1
+	# remove those lines when 'make install' installs bin/acfpasswd
+	[ -f "$pkgdir"/bin/acfpasswd ] && return 1
+	install -Dm755 bin/acfpasswd "$pkgdir"/bin/acfpasswd
 }
-md5sums="2122ea39dbb6d35bc59c4eb821b4baae  acf-core-0.13.5.tar.bz2"
+md5sums="2122ea39dbb6d35bc59c4eb821b4baae  acf-core-0.13.5.tar.bz2
+09cd615dfb441cb9e34459daa214e3bb  0001-authenticator-use-salt-and-sha-512-encryption.patch
+ea61fe424c6e85e867a947f99c01ed04  0002-Fixed-mksalt-to-use-correct-characters.patch
+186de27cd4bf66454ede177ae723c321  0001-acfpasswd-new-tool-to-set-passwords-from-comman-line.patch"