Secure root support

Design_Warning

Background

xCAT stateful provisioning (kickstart file for RHEL) and stateless provisioning (image tarball) include the root password hash inside, and they are exposed to a HTTP server. Here might be security issue.

To enforce the security consideration, it is required xCAT to offer a capability to send the root password hash in a secure method during the provisioning only.

Platform

stateful provision

In existing implementation for RHEL7, when run nodeset <cn> osimage=xxx, xCAT will generate the kickstart file and it will contains a line

rootpw --iscrypted <root password hash>

During the provisioning, anaconda will get the kickstart file and generate the corresponding root in /etc/shadow

And with the 'secure root support' enhancement, nodeset will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then there are possible two option:
 1, User define `install` temporary password in `passwd` table, `nodeset` write temporary hash into kickstart file. 

2, No `install` temporary password defined, no root password hash into kickstart file.

When the node is in the end of provisioning and running xCAT default postscript, remoteshell will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then it send `getcredential xcat_secure_passwd [user]` to xCAT master, and update the `/etc/shadow` with the right hash 

stateless provision

In existing implementation for RHEL7, when run packimage xxx, xCAT will update the <rootimagedir>/etc/shadow with the and pack it into image, so the image contains the root password hash directly.

And with the 'secure root support' enhancement, packimage will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then there are possible two option:
 1, User define `install` temporary password in `passwd` table, `packimage` write temporary hash into `/etc/shadow`. 

 2, No `install` temporary password defined, no root password hash into `/etc/shadow` file.

When the node is in the end of provisioning and running xCAT default postscript, remoteshell will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then it send `getcredential xcat_secure_passwd [user]` to xCAT master, and update the `/etc/shadow` with the right hash 

Note: if you define /etc/shadow file in the synclist of the osimage, you must use packiamge --nosyncfiles xxx

Platform

• Support it for RHEL7 first
• Other Platform will use the same design, but lower priority

Other Design Considerations

• The interface to get the password hash must be secure enough

  • The client had to be verified to make sure it is from a managed compute node and with the privilege.

• The interface must be extensible to support other user

• To keep compatible, secure root capability is not enabled by default.

Out of Scope

Statelite provisioning other user password - Not support it now, just leave the API compatible.