Gswauth-security-enhancements

1. super_admin password is kept as plain text in proxy-server.conf,this kind of mechanism to store super_admin password is very susceptible to security attacks.Thus a sha1/sha256 with a random salt for super_admin password is the way to go forward.

2. Best practices for storing passwords is to use a random salt. In current implementation of gluster-swift the salt used with sha1 to encrypt user password is a value picked from proxy-server.conf file or default 'gswauthsalt'.

Unix standard used in /etc/shadow can be used as reference.

Steps:-
For 1.
# echo 'gswauthkey'|sha1sum
6964e49a50e1576345b725cf129609381cc7d51b -

# vi /etc/swift/proxy-server.conf

# cat /etc/swift/proxy-server.conf |grep super_admin
super_admin_key = 6964e49a50e1576345b725cf129609381cc7d51b

# swift-init main restart
Signal proxy-server pid: 2496 signal: 15
Signal container-server pid: 2497 signal: 15
Signal account-server pid: 2498 signal: 15
Signal object-server pid: 2499 signal: 15
proxy-server (2496) appears to have stopped
container-server (2497) appears to have stopped
account-server (2498) appears to have stopped
object-server (2499) appears to have stopped
Starting proxy-server...(/etc/swift/proxy-server.conf)
Starting container-server...(/etc/swift/container-server.conf)
Starting account-server...(/etc/swift/account-server.conf)
Starting object-server...(/etc/swift/object-server.conf)

# swauth-add-user test tester7 testing1 -K gswauthkey
Account creation failed: 401 Unauthorized
User creation failed: 401 Unauthorized: Invalid user/key provided

For 2:-

# swauth-add-user test tester5 testing -K 6964e49a50e1576345b725cf129609381cc7d51b
# cat /mnt/gluster-object/gsmetadata/test/tester5
{"groups": [{"name": "test:tester5"}, {"name": "test"}], "auth": "sha1:saltnpepper$673e9b8003af1b7f4c5280b73a7a3
# swauth-add-user test tester6 testing -K 6964e49a50e1576345b725cf129609381cc7d51b
# cat /mnt/gluster-object/gsmetadata/test/tester6
{"groups": [{"name": "test:tester6"}, {"name": "test"}], "auth": "sha1:saltnpepper$673e9b8003af1b7f4c5280b73a7a3a2c56aae201"}
Add tags Tag