Changeset 2041 for trunk/LATMOS-Accounts

Timestamp:

06/13/17 19:28:43 (7 years ago)

Author:

nanardon

Message:

Allow to choose crypt algorythm per configuration

Location:

trunk/LATMOS-Accounts

Files:

• lib/LATMOS/Accounts.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Bases.pm (modified) (2 diffs)
• lib/LATMOS/Accounts/Bases/Ldap/User.pm (modified) (2 diffs)
• lib/LATMOS/Accounts/Bases/Objects.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Bases/Sql/User.pm (modified) (1 diff)
• lib/LATMOS/Accounts/Utils.pm (modified) (1 diff)
• man/man5/latmos-accounts.ini.pod (modified) (1 diff)
• t/05_utils.t (modified) (2 diffs)

trunk/LATMOS-Accounts/lib/LATMOS/Accounts.pm

@@ -142 +142 @@
     my %params =
         map { $_ => ($self->val($section, $_)) }
-        $self->Parameters($section);
+        ($self->Parameters($section), $self->Parameters('_default_'));
  
     my %defattr =

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases.pm

@@ -7 +7 @@
 use LATMOS::Accounts::Bases::Attributes;
 use LATMOS::Accounts::Log;
-use LATMOS::Accounts::Utils qw(exec_command to_ascii );
+use LATMOS::Accounts::Utils qw( exec_command to_ascii );
 
 our $VERSION = (q$Rev$ =~ /^Rev: (\d+) /)[0];
@@ -1155 +1155 @@
 }
 
+=head2 passCrypt($clear_pass)
+
+Return an encrypted password using method set in config
+
+=cut
+
+sub passCrypt {
+    my ($self, $clear_pass) = @_;
+
+    my $method = $self->config('crypt_method');
+
+    LATMOS::Accounts::Utils::Crypt($clear_pass, $method);
+}
+
 =head2 connect($username, $password)
 

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Ldap/User.pm

@@ -276 +276 @@
     my ($self, $clear_pass) = @_;
 
-    my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
-    my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
     # openldap use prefix to identify encryption passwd
     # {CRYPT} is system dependant, eg use crypt from system
@@ -283 +281 @@
     # as we use perl crypt() which does the same
     # This code will have to be changed if we use openldap on other UNIX
-    my $md5 = '{CRYPT}' . crypt($clear_pass, '$1$' . $salt);
+    my $crypt = '{CRYPT}' . $self->base->passCrypt($clear_pass);
 
     my ($lm, $nt) = ntlmgen $clear_pass;
 
     my $res = $self->set_fields(
-        userPassword    => $md5,
+        userPassword    => $crypt,
         sambaLMPassword => $lm,
         sambaNTPassword => $nt,

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm

@@ -543 +543 @@
     my ($self, $clear_pass) = @_;
     if (my $attribute = $self->base->attribute($self->type, 'userPassword')) {
-        my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
-        my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
-        my $res = $self->set_fields($attribute->iname, crypt($clear_pass, '$1$' . $salt));
+        my $res = $self->set_fields($attribute->iname, $self->base->passCrypt($clear_pass));
         $self->base->log(LA_NOTICE, 'Mot de passe changé pour %s', $self->id)
             if($res);

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql/User.pm

@@ -1947 +1947 @@
         }
 
-        my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
-        my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
-        my $res = $self->set_fields($field, crypt($clear_pass, '$1$' . $salt));
+        my $res = $self->set_fields($field, $self->base->passCrypt($clear_pass));
         if ($res) {
             if ($self->base->get_global_value('rsa_public_key')) {

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Utils.pm

@@ -370 +370 @@
 }
 
+=head2 Crypt($password, $method)
+
+Build an encrypted password using standard crypt(), $method is the encrypted method to use:
+
+=over 4
+
+=item DES: the old DES method, do not use
+
+=item 1 or md5
+
+=item 5 or sha-256
+
+=item 6 or sha-512
+
+=back
+
+=cut
+
+sub Crypt {
+    my ($clearpassword, $method) = @_;
+
+    $method ||= '';
+    my $methNumber = {
+        'des'     => -1,
+        'md5'     =>  1,
+        'sha-256' =>  5,
+        'sha-512' =>  6,
+    }->{lc($method)} || $method || 1;
+
+
+    if ($methNumber > 0) {
+        # Good we're secure
+        my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
+        my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
+
+        return crypt($clearpassword, '$' . $methNumber . '$' . $salt);
+    } else {
+        # Grumpf DES
+        my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9));
+        my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1,2));
+
+        return crypt($clearpassword, $salt);
+    }
+}
+
 =head2 buildLogin([$cb, ] @names)
 

trunk/LATMOS-Accounts/man/man5/latmos-accounts.ini.pod

@@ -50 +50 @@
 This parameter is dedicate to set the company or institute name. It is used to
 build the subject of mail send by application.
+
+=head3 crypt_method
+
+Specify the C<crypt()> algorythm to use to encrypt password when the work is
+done on application side. Can be DES, MD5, SHA-256 or SHA-512, default to MD5.
+
+Can be specified per base.
 
 =head2 [_defattr_] SECTION

trunk/LATMOS-Accounts/t/05_utils.t

@@ -1 +1 @@
 use strict;
 use warnings;
-use Test::More tests => 32;
+use Test::More tests => 44;
 use File::Temp qw(mkstemp);
 
@@ -77 +77 @@
 is(LATMOS::Accounts::Utils::buildLogin(sub { length($_[0]) > 9 }, 'TotoTataTiti'), 'tototatati', "buildLogin return 8 byte length login");
 
+my $clearpass = 'passwd';
+my $password = '';
+$password = LATMOS::Accounts::Utils::Crypt($clearpass, 'DES');
+like($password, qr/^\w\w.*/, 'Password encrypted using DES');
+is(crypt($clearpass, $password), $password);
+
+$password = LATMOS::Accounts::Utils::Crypt($clearpass, 'MD5');
+like($password, qr/^\$1\$.*/, 'Password encrypted using MD5');
+is(crypt($clearpass, $password), $password);
+
+$password = LATMOS::Accounts::Utils::Crypt($clearpass, 'sha-256');
+like($password, qr/^\$5\$.*/, 'Password encrypted using SHA-256');
+is(crypt($clearpass, $password), $password);
+
+$password = LATMOS::Accounts::Utils::Crypt($clearpass, 'SHA-512');
+like($password, qr/^\$6\$.*/, 'Password encrypted using SHA-512');
+is(crypt($clearpass, $password), $password);
+
+$password = LATMOS::Accounts::Utils::Crypt($clearpass, '5');
+like($password, qr/^\$5\$.*/, 'Password encrypted using SHA-256 (number)');
+is(crypt($clearpass, $password), $password);
+
+$password = LATMOS::Accounts::Utils::Crypt($clearpass);
+like($password, qr/^\$1\$.*/, 'Password encrypted using MD5 (default)');
+is(crypt($clearpass, $password), $password);
+
 is(yesno('yes'),  1, 'yes is true');
 is(yesno('true'), 1, 'true is true');