Update to libpam 1.5.2

This updates to libpam 1.5.2. This version removes support for
pam_cracklib and pam_tally2. They are replaced by pam_pwquality and
pam_faillock respectively.

Since parameters of pam_cracklb and pam_tally2 are configurable through
Redfish, it's possible that they will remain in the overlay of
/etc/pam.d with the old module names preventing PAM from working
correctly. To avoid this, this commit includes a script that will detect
if the old modules are in the overlay and update the overlay with the
new modules and configuration.

The script will allow updates from libpam 1.3.1 to libpam 1.5.2, but if there
are configured parameters during a downgrade from libpam 1.5.2 to libpam
1.3.1, it will require a factory reset before the downgrade.

pam_pwquality was selected over pam_passwdqc because of better security
and compatibility with pam_cracklib.

Note pam_faillock is necessarily configured into the pam module stack
differently than pam_tally2.

This patchset causes a BMC operational change:
- The pam_tally2 command (invoked from the BMC's command line) is no
  longer present.  If you used the "pam_tally2 -u USER -r" command
  to unlock a user after repeated authentication failures, change to
  use: faillock --user USER --reset

Compatibility note / migration issue.  If your BMC cannot authenticate
users after installing this change, the cause might be an overlayfs file
hiding the new /etc/pam.d/common-auth file.  To find out, use
`grep deny= /etc/pam.d/common-auth` on your BMC.  If it shows "tally2"
then your BMC is affected.  The recovery is to delete the overlay file,
to factory reset the BMC, or manually-install the changed files.
The convert-pam-configs service is intended to handle this problem.

Tested: as follows, for local users only (not tested with LDAP)

Note OpenBMC configuration defaults to an AccountLockoutThreshold
value of 0 which does not lock account passwords no matter how many
consecutive failed authentication attempts.  To configure this on
the BMC, for example, use:
curl -X PATCH https://${bmc}/redfish/v1/AccountService
  -d '{"AccountLockoutThreshold": 3, "AccountLockoutDuration": 60}'

Tested update scenarios:
1. Install from scratch.  Success.
2. Install over firmware which had old PAM configs.  Success.

Tested update scenarios for the convert-pam-configs service.

Tested changing the password via various interfaces:
- the passwd command
- the PATCH Refish AccountService {Password: NEW}
- SSH (accessible only when the password is expired)
- IPMI user set password (accessible for unexpired password)

Tested both good and bad (unacceptable) passwords.

Tested account lockout after N bad passwords
Tested unlock via Redfish.

Also, because its implementation changed, ensure reading and writing the
D-Bus User AccountPolicy RememberOldPasswordTimes property continues to
work.  There is no Redfish API for this.

Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net>
Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
Change-Id: I7b712cf7cfbf7b0bc79da42f822540baee66ca4f

4 files changed, 13 insertions, 34 deletions

diff --git a/meta-supermicro/meta-common/recipes-extended/libpwquality/libpwquality/pwquality.conf b/meta-supermicro/meta-common/recipes-extended/libpwquality/libpwquality/pwquality.conf
new file mode 100644
index 0000000000..378154e5b9
--- /dev/null
+++ b/meta-supermicro/meta-common/recipes-extended/libpwquality/libpwquality/pwquality.conf
@@ -0,0 +1,8 @@
+enforce_for_root
+minlen=9
+difok=0
+lcredit=-1
+ocredit=-1
+dcredit=-1
+ucredit=-1
+maxrepeat=3
diff --git a/meta-supermicro/meta-common/recipes-extended/libpwquality/libpwquality_%.bbappend b/meta-supermicro/meta-common/recipes-extended/libpwquality/libpwquality_%.bbappend
new file mode 100644
index 0000000000..f72de93a1a
--- /dev/null
+++ b/meta-supermicro/meta-common/recipes-extended/libpwquality/libpwquality_%.bbappend
@@ -0,0 +1,5 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+SRC_URI += " \
+        file://pwquality.conf \
+        "
diff --git a/meta-supermicro/meta-common/recipes-extended/pam/libpam/pam.d/common-password b/meta-supermicro/meta-common/recipes-extended/pam/libpam/pam.d/common-password
deleted file mode 100644
index 5a42680ee2..0000000000
--- a/meta-supermicro/meta-common/recipes-extended/pam/libpam/pam.d/common-password
+++ /dev/null
@@ -1,30 +0,0 @@
-#
-# /etc/pam.d/common-password - password-related modules common to all services
-#
-# This file is included from other service-specific PAM config files,
-# and should contain a list of modules that define the services to be
-# used to change user passwords.  The default is pam_unix.
-
-# Explanation of pam_unix options:
-#
-# The "sha512" option enables salted SHA512 passwords.  Without this option,
-# the default is Unix crypt.  Prior releases used the option "md5".
-#
-# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
-# login.defs.
-#
-# See the pam_unix manpage for other options.
-
-# here are the per-package modules (the "Primary" block)
-password	[success=ok default=die]	pam_cracklib.so debug enforce_for_root reject_username minlen=9 difok=0 lcredit=-1 ocredit=-1 dcredit=-1 ucredit=-1 maxrepeat=3
-password	[success=ok default=die]	pam_ipmicheck.so spec_grp_name=ipmi use_authtok
-password	[success=ok ignore=ignore default=die]	pam_pwhistory.so debug enforce_for_root remember=0 use_authtok
-password	[success=ok default=die]	pam_unix.so sha512 use_authtok
-password	[success=1 default=die] 	pam_ipmisave.so spec_grp_name=ipmi spec_pass_file=/etc/ipmi_pass key_file=/etc/key_file
-# here's the fallback if no module succeeds
-password	requisite			pam_deny.so
-# prime the stack with a positive return value if there isn't one already;
-# this avoids us returning an error just because nothing sets a success code
-# since the modules above will each just jump around
-password	required			pam_permit.so
-# and here are more per-package modules (the "Additional" block)
diff --git a/meta-supermicro/meta-common/recipes-extended/pam/libpam_%.bbappend b/meta-supermicro/meta-common/recipes-extended/pam/libpam_%.bbappend
deleted file mode 100644
index 20fe5e4cdd..0000000000
--- a/meta-supermicro/meta-common/recipes-extended/pam/libpam_%.bbappend
+++ /dev/null
@@ -1,4 +0,0 @@
-FILESEXTRAPATHS:append := "${THISDIR}/${PN}:"
-
-SRC_URI += " file://pam.d/common-password \
-            "