Project

General

Profile

Feature #26608

Windows password hashes require 'AdministratorPassword' at the end of passwd string

Added by Si Man over 1 year ago. Updated 8 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Unattended installations
Target version:
-
Difficulty:
Triaged:
No
Bugzilla link:

Description

Windows OS's that I have tested (2012r2 to 10.1809) require the string "AdministratorPassword" to be appended to the end of the raw password string prior to hashing, which must then be in UTF16LE format. While the hashing method is now included in the latest 1.21.2 release as 'Base-64-Windows' option under Operating System, the additional string is not. Windows (Unattended) Answer files (.xml) encapsulated in provisioning templates (.erb) cannot be processed by the OS unless this string exists at the end of the password when <%= root_pass > is used.

    case hash_alg
    when 'Base64'
      result = Base64.strict_encode64(passwd)
    when 'Base64-Windows'
*      passwd << Base64.strict_encode64("AdministratorPassword")*
      result = Base64.strict_encode64(passwd.encode('utf-16le'))

The attached password_crypt.rb file has an additional line that appends the passwd with the required string.

Templates tested were originally sourced from https://github.com/kireevco/foreman-wimaging/tree/1bd8f0facff80c19a5eccc12c01e8febd00f701e/wimaging and have been customised to my environment.

password_crypt.rb password_crypt.rb 1.29 KB Si Man, 04/17/2019 08:56 AM

Associated revisions

Revision 0de4e199 (diff)
Added by UXabre 11 months ago

Fixes #26608 - suffixed "AdministratorPassword" for windows

History

#1 Updated by Si Man over 1 year ago

Further testing has shown that the appending of AdministratorPassword does NOT need to be base64 encoded prior to adding to the passwd contents. The following line is enough:

when 'Base64-Windows'
passwd << "AdministratorPassword"
result = Base64.strict_encode64(passwd.encode('utf-16le'))

Also, if a default password is saved in a Host Group it appears to be stored in a hash other than UTF16LE, and the result fails to create a host. Therefore, a password must not be stored in a Host Group and needs to be assigned to a Host upon creation.

Found 2 side-effects of this method however:
1. The build token cannot be successfully retrieved. Unsure why appending the passwd would cause this, but removing the line fixed this issue
2. Cancelling a build results in a password length error, but building or deleting a Host completes OK.

#2 Updated by Si Man over 1 year ago

  • File deleted (password_crypt.rb)

#3 Updated by The Foreman Bot 11 months ago

  • Assignee set to Arend Lapere
  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/7131 added

#4 Updated by The Foreman Bot 11 months ago

  • Fixed in Releases 2.0.0 added

#5 Updated by Anonymous 11 months ago

  • Status changed from Ready For Testing to Closed

#6 Updated by The Foreman Bot 8 months ago

  • Pull request https://github.com/theforeman/foreman/pull/7339 added

#7 Updated by Tomer Brisker 8 months ago

  • Fixed in Releases 1.24.1 added

#8 Updated by Tomer Brisker 8 months ago

  • Category set to Unattended installations

Also available in: Atom PDF