Merge branch 'improve_password_rules' into 'develop'

Improve password rules for local accounts

See merge request yourdev/orange-yourdev-login!1

LICENSE.md

@@ -0,0 +1,177 @@
+# Inner Source terms of use v1.0
+
+The accompanying Component is provided under the current terms of use. Any
+installation and use of the Component constitute recipient's acceptance of
+these terms.
+
+THESE TERMS MAY BE COPIED OR DISTRIBUTED BUT IN ORDER TO AVOID INCONSISTENCY.
+THESE TERMS MAY ONLY BE MODIFIED BY ORANGE SA LEGAL DEPARTMENT – INTELLECTUAL
+PROPERTY.
+
+1. DEFINITIONS
+
+    1.1. *Affiliate*: any entity in which Orange SA, acting alone or in
+         concert, holds (i) directly or indirectly more than fifty percent
+         (50%) of the voting rights in general meetings of shareholders, or
+         (ii) holds the right to appoint the majority of the members of the
+         Board of Directors or of a body fulfilling a similar function. Such
+         entities will be considered as Orange SA subsidiaries only as long as
+         one of the aforementioned criteria is met.
+
+    1.2. *Component*: any software’s source code, document, design, picture,
+         database provided by the Inner Source Project under these Inner
+         Source terms of use.
+
+    1.3. *Inner Source Project*: Orange SA’s project that decides to make
+         available the Component under these Inner Source terms of use.
+
+2. OBJECTIVE OF THE DOCUMENT
+
+    Inner Source aims to strengthen collaboration within Orange Group.
+    Therefore, these terms give a comprehensive list of the rules that must be
+    applied to each Component in order to comply with Orange’s inner source
+    principles, secure the copyright rights of Orange SA and/or any of its
+    Affiliates and allow the use of the Component by users to improve
+    collaboration within Orange Group.  
+
+    Two categories of users have been identified:
+
+    - *Internal Users*: Orange SA staff (employees, PhD students, apprentices,
+      interns)
+
+    - *External Users*: Orange Affiliates’ staffs, external partners,
+      subcontractors, and any other entity which is not part of Orange SA.
+
+3. CONDITIONS APPLICABLE TO INTERNAL USERS
+
+    a. Rights
+
+    Permission is hereby granted, free of charge, to any Internal User, to:
+
+    - access to the Component including but not limited to the source code of
+      the software and associated technical documentation;
+
+    - use the Component;
+
+    - contribute to the Component by submitting patches and/or major
+      contributions to the Orange SA’s Inner Source Project;
+
+    - copy, reproduce and duplicate the Component internally and only for the
+      needs of any Internal User’s Orange SA’s projects;
+
+    - modify and merge the Component for the needs of any Internal User’s
+      Orange SA’s projects;
+
+    - make available the Component within Orange SA only, modified or not.
+
+    b. Duties
+
+    In consideration of the rights granted above, each Internal User must
+    comply with the following conditions:
+
+    - Do not copy, publish, distribute, sublicence or sell the Component in
+      any form outside Orange SA without informing Orange SA’s Inner Source
+      Project and the agreement of the Intellectual Property and Licensing
+      (IPL) department.
+
+    - Do not delete or modify the copyright notice that may have been inserted
+      within the Component (see point 7 below) and these terms of use;
+
+    - Give credit to the original authors of the Component;
+
+    - Do not link, compile or otherwise the Component with any other component
+      published under GNU GPL license or GNU Affero license or any copyleft
+      license without the prior approval of the open source governance;
+
+    - Inform Orange SA’s Inner Source Project of any duplication of the
+      project/component (fork) or any modifications/enhancements made to the
+      Component.
+
+4. CONDITIONS APPLICABLE TO EXTERNAL USERS
+
+    4.1. External Users must execute an agreement with Orange SA to have
+         access to and use the Component. External Users shall use Orange SA’s
+         Component under the conditions defined in the contract the External
+         Users entered into with Orange SA.
+
+    4.2. When an External User is an Affiliate, any supplier contracts with
+         the Affiliate shall include a formal statement that the supplier
+         transfers all copyright rights to the Affiliate.
+
+    4.3. When an External user is an Affiliate and provided that the Component
+         is invoiced or recharged to one or more business unit or Affiliate,
+         in that case Orange SA hereby grants to the Affiliate a personal,
+         non-transferable, non-exclusive free licence to have access to the
+         Component on its own equipment only for six (6) months and solely for
+         the purposes of the technical evaluation of the Component by the
+         Affiliate and understanding its mechanisms, and induced software
+         architecture as the case may be, as well as its interest to develop
+         one or more features within the framework of the Orange’s Inner
+         Source ecosystem. The Affiliate may make copies of the Component that
+         are necessary to evaluate the Component on its own equipment but may
+         not make any back-up or archival copies and may not load all or any
+         part of the Component on any computer other than its own equipment.
+         No other rights, even implied, are granted herein, other than those
+         mentioned above, especially the Affiliate is not allowed:
+
+      - to modify, adapt, translate or create derivative works based on the
+        Component;
+
+      - to sublicense, distribut e, disclose, market, rent, lease, or transfer
+        the Component to any third party such as but not limited to
+        subcontractors.
+
+    The Affiliate acknowledges that any disclosure pursuant to these terms of
+    use shall not transfer or confer to the Affiliate any intellectual
+    property or other rights in relation to the Component.
+
+    In case the Affiliate wishes to take part to the development/enhancement
+    of the Component and contribute to it, the Affiliate shall contact the
+    Inner Source Project in order to put in place the contractual agreements
+    accordingly.  
+
+5. NO WARRANTY
+
+    THE COMPONENT IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+    NO EVENT SHALL ORANGE SA BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE COMPONENT OR THE USE OR OTHER
+    DEALINGS IN THE COMPONENT.
+
+6. TERMINATION
+
+    Any failure to comply with the current terms of use will terminate any
+    rights to use the Component if no cure of such failure has been carried
+    out within ten (10) days after becoming aware of such noncompliance and/or
+    if the user ceases to be an Orange’s staff or to be in an agreement with
+    Orange.
+
+    In case of termination of these terms of use, the user agrees to cease any
+    use of the Component and delete any copy of the Component.
+
+7. COPYRIGHT NOTICE TO BE INCLUDED INTO THE HEADERS FILES
+
+    ```javascript
+    /*
+     * Software Name: <software name>
+     * Version: <version>
+     * SPDX-FileCopyrightText: Copyright (c) <firstyear>[-<lastyear>] Orange SA
+     *
+     * This software is confidential and proprietary information of Orange SA.
+     * You shall not disclose such Confidential Information and shall not copy,
+     * use or distribute it in whole or in part without the prior written
+     * consent of Orange SA.
+     *
+     * Author: <optional: authors list>
+     * Software Description: <optional: software description text>
+     */
+    ```
+
+    Where:
+
+    - `<firstyear>`: Year of the first publication;
+    - `<lastyear>`: Year of the latest published version;
+    - `<authors list>`: Only include the name of authors who agreed to be
+      identified.

debian/control

@@ -18,6 +18,7 @@ Depends: ${misc:Depends},
   libpam-sss,
   libpam-pkcs11,
   libpam-ccreds,
+  libpam-pwquality,
   orange-certs, 
   orange-krb5
 Recommends: 

debian/copyright

@@ -3,8 +3,8 @@ Upstream-Name: orange-yourdev-pki-login
 Source: https://gitlab.forge.orange-labs.fr/yourdev/orange-yourdev-login
 
 Files: * ./debian/*
-Copyright: 2021, Orange Labs
-License: GPL-2
- On Debian systems, the full text of the GNU General Public
- License version 2 can be found in the file
- '/usr/share/common-licenses/GPL-2'.
+Copyright: 2020-2022 Orange SA
+License: Orange-InnerSource
+ On Debian systems, the full text of the Orange Inner-Source terms of use
+ can be found in the file `/usr/share/common-licenses/Orange-InnerSource'.
+

debian/postinst

@@ -1,6 +1,16 @@
 #!/bin/sh
+# SPDX-License-Identifier: Orange-InnerSource
+
 set -e
 
+CONF_FILE="/etc/security/pwquality.conf"
+
+yd_update_keyval() { # file key value...
+    local file="$1" key="$2" ; shift 2
+    # delete line starting with key then append to the end
+    sed -e "/^[ \t]*$key[ \t]\=/d" -e "\$a$key = $*" -i "$file"
+}
+
 case "$1" in
     configure)
         # Enable GDM customization
@@ -55,6 +65,21 @@ case "$1" in
     ;;
 esac
 
+# Min size of password
+yd_update_keyval "$CONF_FILE" "minlen" "10"
+
+# Lowercase char (-1 => min 1 char)
+yd_update_keyval "$CONF_FILE" "lcredit" "-1" 
+
+# Uppercase char (-1 => min 1 char)
+yd_update_keyval "$CONF_FILE" "ucredit" "-1"
+
+# Decimal char (-1 => min 1 char)
+yd_update_keyval "$CONF_FILE" "dcredit" "-1"
+
+# Other char (-1 => min 1 char)
+yd_update_keyval "$CONF_FILE" "ocredit" "-1"
+
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.
 

debian/postrm

@@ -1,4 +1,6 @@
 #!/bin/sh
+# SPDX-License-Identifier: Orange-InnerSource
+
 set -e
 
 case "$1" in

debian/preinst

@@ -1,4 +1,6 @@
 #!/bin/sh
+# SPDX-License-Identifier: Orange-InnerSource
+
 set -e
 
 case "$1" in

debian/prerm

@@ -1,4 +1,6 @@
 #!/bin/sh
+# SPDX-License-Identifier: Orange-InnerSource
+
 set -e
 
 case "$1" in

usr/sbin/pkcs11_generate_uids

@@ -1,7 +1,16 @@
 #!/bin/bash
-# 
-# Written by Michel Decima
-# Copyright 2021 Orange
+#
+#   Software Name : orange-yourdev-login
+#   SPDX-License-Identifier: Orange-InnerSource
+#   SPDX-FileCopyrightText: Copyright (c) 2020-2022 Orange SA
+#  
+#   This software is confidential and proprietary information of Orange SA.
+#   You shall not disclose such Confidential Information and shall not copy,
+#   use or distribute it in whole or in part without the prior written
+#   consent of Orange SA.
+#  
+#   Author: Michel Decima <michel.decima@orange.com>
+#
 #
 # Generate uid mapping for pam_pkcs11 using /etc/passwd
 #

usr/share/orange-yourdev-login/login-password

@@ -1,9 +1,18 @@
 #!/bin/bash
 #
-# Written by Michel Decima
-# Copyright (C) 2020 Orange
+#   Software Name : orange-yourdev-login
+#   SPDX-License-Identifier: Orange-InnerSource
+#   SPDX-FileCopyrightText: Copyright (c) 2020-2022 Orange SA
+# 
+#   This software is confidential and proprietary information of Orange SA.
+#   You shall not disclose such Confidential Information and shall not copy,
+#   use or distribute it in whole or in part without the prior written
+#   consent of Orange SA.
+#  
+#   Author: Michel Decima <michel.decima@orange.com>
 #
 
+
 (( EUID == 0 )) || { echo >&2 "Not root." ; exit 1 ; }
 
 if [ -e /etc/pam.d/gdm-smartcard-sssd-or-password ] ; then

usr/share/orange-yourdev-login/login-pki

@@ -1,9 +1,18 @@
 #!/bin/bash
 #
-# Written by Michel Decima
-# Copyright (C) 2020 Orange
+#   Software Name : orange-yourdev-login
+#   SPDX-License-Identifier: Orange-InnerSource
+#   SPDX-FileCopyrightText: Copyright (c) 2020-2022 Orange SA
+#  
+#   This software is confidential and proprietary information of Orange SA.
+#   You shall not disclose such Confidential Information and shall not copy,
+#   use or distribute it in whole or in part without the prior written
+#   consent of Orange SA.
+# 
+#   Author: Michel Decima <michel.decima@orange.com>
 #
 
+
 (( EUID == 0 )) || { echo >&2 "Not root." ; exit 1 ; }
 
 update-alternatives --set gdm-smartcard \