Feature #26608: Windows password hashes require 'AdministratorPassword' at the end of passwd string - Foreman

Actions

Copy link

Feature #26608

closed

Windows password hashes require 'AdministratorPassword' at the end of passwd string

Added by Si Man about 5 years ago. Updated over 4 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Arend Lapere

Category:

Unattended installations

Target version:

Difficulty:

Triaged:

Bugzilla link:

Pull request:

https://github.com/theforeman/foreman/pull/7339, https://github.com/theforeman/foreman/pull/7131

Fixed in Releases:

1.24.1, 2.0.0

Found in Releases:

1.21.2

Red Hat JIRA:

Description

Windows OS's that I have tested (2012r2 to 10.1809) require the string "AdministratorPassword" to be appended to the end of the raw password string prior to hashing, which must then be in UTF16LE format. While the hashing method is now included in the latest 1.21.2 release as 'Base-64-Windows' option under Operating System, the additional string is not. Windows (Unattended) Answer files (.xml) encapsulated in provisioning templates (.erb) cannot be processed by the OS unless this string exists at the end of the password when <%= root_pass > is used.

    case hash_alg
    when 'Base64'
      result = Base64.strict_encode64(passwd)
    when 'Base64-Windows'
*      passwd << Base64.strict_encode64("AdministratorPassword")*
      result = Base64.strict_encode64(passwd.encode('utf-16le'))

The attached password_crypt.rb file has an additional line that appends the passwd with the required string.

Templates tested were originally sourced from https://github.com/kireevco/foreman-wimaging/tree/1bd8f0facff80c19a5eccc12c01e8febd00f701e/wimaging and have been customised to my environment.

Files

password_crypt.rb

1.29 KB

Si Man, 04/17/2019 08:56 AM

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Si Man about 5 years ago

File password_crypt.rb password_crypt.rb added

Further testing has shown that the appending of AdministratorPassword does NOT need to be base64 encoded prior to adding to the passwd contents. The following line is enough:

when 'Base64-Windows'
      passwd << "AdministratorPassword" 
      result = Base64.strict_encode64(passwd.encode('utf-16le'))

Also, if a default password is saved in a Host Group it appears to be stored in a hash other than UTF16LE, and the result fails to create a host. Therefore, a password must not be stored in a Host Group and needs to be assigned to a Host upon creation.

Found 2 side-effects of this method however:
1. The build token cannot be successfully retrieved. Unsure why appending the passwd would cause this, but removing the line fixed this issue
2. Cancelling a build results in a password length error, but building or deleting a Host completes OK.

Actions

Copy link