This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
commit c02683e2829644b1fc69d1335aee252e59f758fe Author: Abhishek Mishra <[email protected]> AuthorDate: Wed Jul 15 15:40:21 2026 +0000 !nshlib: Remove fixed login; require FSUTILS_PASSWD Report password policy failures clearly from useradd and passwd when a password does not meet complexity requirements. Signed-off-by: Abhishek Mishra <[email protected]> --- nshlib/Kconfig | 30 +++++++++--------------------- nshlib/nsh.h | 2 -- nshlib/nsh_identity.c | 3 --- nshlib/nsh_login.c | 3 --- nshlib/nsh_passwdcmds.c | 30 ++++++++++++++++++++++++++---- nshlib/nsh_telnetlogin.c | 3 --- 6 files changed, 35 insertions(+), 36 deletions(-) diff --git a/nshlib/Kconfig b/nshlib/Kconfig index 7a39d96b4..165bcc8b3 100644 --- a/nshlib/Kconfig +++ b/nshlib/Kconfig @@ -1230,32 +1230,30 @@ config NSH_LOGIN config NSH_CONSOLE_LOGIN bool "Console Login" default n + depends on FSUTILS_PASSWD select NSH_LOGIN ---help--- If defined, then the console user will be required to provide a - username and password to start the NSH shell. + username and password to start the NSH shell. Requires + CONFIG_FSUTILS_PASSWD so credentials are verified against the + encrypted password file (for example ROMFS /etc/passwd). config NSH_TELNET_LOGIN bool "Telnet Login" default n - depends on NSH_TELNET + depends on NSH_TELNET && FSUTILS_PASSWD select NSH_LOGIN ---help--- If defined, then the Telnet user will be required to provide a - username and password to start the NSH shell. + username and password to start the NSH shell. Requires + CONFIG_FSUTILS_PASSWD so credentials are verified against the + encrypted password file (for example ROMFS /etc/passwd). if NSH_LOGIN choice prompt "Verification method" - default NSH_LOGIN_PASSWD if FSUTILS_PASSWD - default NSH_LOGIN_FIXED if !FSUTILS_PASSWD - -config NSH_LOGIN_FIXED - bool "Fixed username/password" - ---help--- - Verify user credentials by matching to fixed username and password - strings + default NSH_LOGIN_PASSWD config NSH_LOGIN_PLATFORM bool "Platform username/password" @@ -1292,16 +1290,6 @@ config NSH_LOGIN_USERNAME ---help--- Login user name. Default: "root" -config NSH_LOGIN_PASSWORD - string "Login password" - depends on NSH_LOGIN_FIXED - ---help--- - The plaintext login password used when fixed username/password - verification is selected (CONFIG_NSH_LOGIN_FIXED). There is no - default; set CONFIG_NSH_LOGIN_PASSWORD in the board defconfig, - via menuconfig, or enter it when prompted during an interactive - build. - config NSH_LOGIN_FAILDELAY int "Login failure delay" default 0 diff --git a/nshlib/nsh.h b/nshlib/nsh.h index 5950c4fce..d2b7abc44 100644 --- a/nshlib/nsh.h +++ b/nshlib/nsh.h @@ -267,8 +267,6 @@ * options may be specified: * * CONFIG_NSH_LOGIN_USERNAME - Login user name. Default: "root" - * CONFIG_NSH_LOGIN_PASSWORD - Login password (required when using fixed - * credentials; no default is provided). * CONFIG_NSH_LOGIN_FAILCOUNT - Number of login retry attempts. * Default 3. */ diff --git a/nshlib/nsh_identity.c b/nshlib/nsh_identity.c index e69fd92e2..7bcb9a4a0 100644 --- a/nshlib/nsh_identity.c +++ b/nshlib/nsh_identity.c @@ -165,9 +165,6 @@ static bool nsh_verify_credentials(FAR const char *username, return PASSWORD_VERIFY_MATCH(passwd_verify(username, password)); #elif defined(CONFIG_NSH_LOGIN_PLATFORM) return PASSWORD_VERIFY_MATCH(platform_user_verify(username, password)); -#elif defined(CONFIG_NSH_LOGIN_FIXED) - return strcmp(password, CONFIG_NSH_LOGIN_PASSWORD) == 0 && - strcmp(username, CONFIG_NSH_LOGIN_USERNAME) == 0; #else UNUSED(username); UNUSED(password); diff --git a/nshlib/nsh_login.c b/nshlib/nsh_login.c index 6630a1689..228a66397 100644 --- a/nshlib/nsh_login.c +++ b/nshlib/nsh_login.c @@ -243,9 +243,6 @@ int nsh_login(FAR struct console_stdio_s *pstate) #endif if (PASSWORD_VERIFY_MATCH(ret)) -#elif defined(CONFIG_NSH_LOGIN_FIXED) - if (strcmp(password, CONFIG_NSH_LOGIN_PASSWORD) == 0 && - strcmp(username, CONFIG_NSH_LOGIN_USERNAME) == 0) #else # error No user verification method selected #endif diff --git a/nshlib/nsh_passwdcmds.c b/nshlib/nsh_passwdcmds.c index 5c7f86ed2..f37cbaf2a 100644 --- a/nshlib/nsh_passwdcmds.c +++ b/nshlib/nsh_passwdcmds.c @@ -53,8 +53,19 @@ int cmd_useradd(FAR struct nsh_vtbl_s *vtbl, int argc, FAR char **argv) ret = passwd_adduser(argv[1], argv[2]); if (ret < 0) { - nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_adduser", - NSH_ERRNO_OF(-ret)); + if (ret == -EINVAL) + { + nsh_error(vtbl, + "%s: password does not meet security policy " + "(min 8 chars, upper, lower, digit, special)\n", + argv[0]); + } + else + { + nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_adduser", + NSH_ERRNO_OF(-ret)); + } + return ERROR; } @@ -99,8 +110,19 @@ int cmd_passwd(FAR struct nsh_vtbl_s *vtbl, int argc, FAR char **argv) ret = passwd_update(argv[1], argv[2]); if (ret < 0) { - nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_update", - NSH_ERRNO_OF(-ret)); + if (ret == -EINVAL) + { + nsh_error(vtbl, + "%s: password does not meet security policy " + "(min 8 chars, upper, lower, digit, special)\n", + argv[0]); + } + else + { + nsh_error(vtbl, g_fmtcmdfailed, argv[0], "passwd_update", + NSH_ERRNO_OF(-ret)); + } + return ERROR; } diff --git a/nshlib/nsh_telnetlogin.c b/nshlib/nsh_telnetlogin.c index c796b2a36..8007b2684 100644 --- a/nshlib/nsh_telnetlogin.c +++ b/nshlib/nsh_telnetlogin.c @@ -248,9 +248,6 @@ int nsh_telnetlogin(FAR struct console_stdio_s *pstate) if (PASSWORD_VERIFY_MATCH(platform_user_verify(username, password))) # endif -#elif defined(CONFIG_NSH_LOGIN_FIXED) - if (strcmp(password, CONFIG_NSH_LOGIN_PASSWORD) == 0 && - strcmp(username, CONFIG_NSH_LOGIN_USERNAME) == 0) #else # error No user verification method selected #endif
