Bugfix 8290

  Don't allow default password to persist after first boot.

  Due to the numerous ways a user can get a vyatta system this required
  a lot of changes.

  1. Don't allow a user to set a password to 'vyatta' after first login,
  but allow it on the initial boot otherwise the system will have no
  user.
  2. Don't allow the password to be set to vyatta in installer.
  3. Force password change on first login. under the following
  conditions:
  3.a. User is an admin level user. Operators do not have the abillity
  to change the config so they can't change passwords. Allow 'vyatta' to
  be the password until an admin logs in.
  3.b. This is not the livecd, its silly to force a password change
  before install.

1 files changed, 103 insertions, 0 deletions

diff --git a/scripts/vyatta-first-login-passwd.sh b/scripts/vyatta-first-login-passwd.sh
new file mode 100755
index 00000000..ff28c57d
--- /dev/null
+++ b/scripts/vyatta-first-login-passwd.sh
@@ -0,0 +1,103 @@
+#!/bin/bash
+trap '' INT KILL
+
+# don't run as operators 
+if ! groups | grep -q vyattacfg; then
+  exit 0
+fi
+
+# don't run if we've already done this, 
+# the commit system will handle the invalid password
+if [ -e /opt/vyatta/etc/.nofirstpasswd ]; then
+  exit 0
+fi
+
+# don't run on livecd installer will do the check
+if grep -q -e '^unionfs.*/filesystem.squashfs' /proc/mounts; then
+  exit 0
+fi
+
+API=/bin/cli-shell-api
+
+session_env=$($API getSessionEnv $PPID)
+eval $session_env
+$API setupSession
+
+exit_configure ()
+{
+  $API teardownSession
+  echo -n 'export -n VYATTA_CONFIG_TMP; '
+  echo -n 'export -n VYATTA_CHANGES_ONLY_DIR; '
+  echo -n 'export -n VYATTA_ACTIVE_CONFIGURATION_DIR; '
+  echo -n 'export -n VYATTA_TEMPLATE_LEVEL; '
+  echo -n 'export -n VYATTA_CONFIG_TEMPLATE; '
+  echo -n 'export -n VYATTA_TEMP_CONFIG_DIR; '
+  echo -n 'export -n VYATTA_EDIT_LEVEL; '
+}
+
+set ()
+{
+  /opt/vyatta/sbin/my_set $*
+}
+
+commit ()
+{
+  /opt/vyatta/sbin/my_commit "$@"
+}
+
+save ()
+{
+  /opt/vyatta/sbin/vyatta-save-config.pl
+}
+
+show ()
+{
+  $API showCfg "$@"
+}
+
+change_password() {
+  local user=$1
+  local pwd1="1"
+  local pwd2="2"
+
+  echo "Invalid password detected for user $user"
+  echo "Please enter a new password"
+  until [[ "$pwd1" == "$pwd2" && "$pwd1" != "vyatta" ]]; do
+    read -p "Enter $user password:" -r -s pwd1 <>/dev/tty 2>&0
+    echo
+    if [[ "$pwd1" == "" ]]; then
+      echo "'' is not a valid password"
+      continue
+    fi
+    read -p "Retype $user password:" -r -s pwd2 <>/dev/tty 2>&0
+    echo
+
+    if [[ "$pwd1" != "$pwd2" ]]; then 
+      echo "Passwords do not match"
+      continue
+    fi
+    if [[ "$pwd1" == "vyatta" ]]; then
+      echo "'vyatta' is not a vaild password"
+      continue
+    fi 
+  done
+
+  # escape any slashes in resulting password
+  local epwd=$(mkpasswd -H md5 "$pwd1" | sed 's:/:\\/:g')
+  set system login user $user authentication plaintext-password "$pwd1"
+  commit
+  save
+}
+
+for user in $($API listEffectiveNodes system login user); do
+  user=${user//\'/}
+  epwd=$(show system login user $user authentication encrypted-password)
+  epwd=$(awk '{ print $2 }' <<<$epwd)
+  salt=$(awk 'BEGIN{ FS="$" }; { print $3 }' <<<$epwd)
+  vyatta_epwd=$(mkpasswd -H md5 -S $salt vyatta)
+  if [[ $epwd == $vyatta_epwd ]]; then
+     change_password $user
+  fi
+done
+eval $(exit_configure)
+sudo touch /opt/vyatta/etc/.nofirstpasswd