Secure root support

Design_Warning

Background

xCAT stateful provisioning (kickstart file for RHEL) and stateless provisioning (image tarball) include the root password hash inside, and they are exposed to a HTTP server. Here might be security issue.

To enforce the security consideration, it is required xCAT to offer a capability to send the root password hash in a secure method during the provisioning only.

Platform

stateful provision

In existing implementation for RHEL7, when run nodeset <cn> osimage=xxx, xCAT will generate the kickstart file and it will contains a line

rootpw --iscrypted <root password hash>

During the provisioning, anaconda will get the kickstart file and generate the corresponding root in /etc/shadow

And with the 'secure root support' enhancement, nodeset will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then there are possible two option:
 1, User define `install` temporary password in `passwd` table, `nodeset` write temporary hash into kickstart file. 

2, No `install` temporary password defined, no root password hash into kickstart file.

When the node is in the end of provisioning and running xCAT default postscript, remoteshell will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then it send `getcredential xcat_secure_passwd` to xCAT master, and update the `/etc/shadow` with the right hash 

stateless provision

In existing implementation for RHEL7, when run packimage xxx, xCAT will update the <rootimagedir>/etc/shadow with the and pack it into image, so the image contains the root password hash directly.

And with the 'secure root support' enhancement, packimage will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then there are possible two option:
 1, User define `install` temporary password in `passwd` table, `packimage` write temporary hash into `/etc/shadow`. 

 2, No `install` temporary password defined, no root password hash into `/etc/shadow` file.

When the node is in the end of provisioning and running xCAT default postscript, remoteshell will do the following:

• To check if secure root is enabled, if not, same as previous.

If yes, then it send `getcredential xcat_secure_passwd` to xCAT master, and update the `/etc/shadow` with the right hash 

Note: if you define /etc/shadow file in the synclist of the osimage, you must use packiamge --nosyncfiles xxx

getcredential is the existing API for compute node to get sensitive information form MN, it is secure enough, we just need to extend it to return the password hash per requesting.

Platform

• Support it for RHEL7 first
• Other Platform will use the same design, but lower priority

Other Design Considerations

• The interface to get the password hash must be secure enough

  • The client had to be verified to make sure it is from a managed compute node and with the privilege.

• The interface must be extensible to support other user

• To keep compatible, secure root capability is not enabled by default.

• For some of the case, user might define shadow file into synclist. In such case, syncfiles will be run after remoteshell and override the /etc/shadow

Out of Scope

Statelite provisioning other user password - Not support it now, just leave the API compatible.