password setting via install hook is a security issue

password setting via install hook is a security issue

[Henning Schild]

Hi,

just discussed the whole password setting story with Claudius. We
discussed whether the password setting package should be a transient
package.
So one that gets installed last and gets removed again. These packages
should not have any content and just carry scriptlets to replace the
distro configure-scripts, making these layer-able.

Turns out that dpkg keeps all post/pre-inst/rm scripts for currently
installed packages. And it does so in a world-readable form. So if your
target has multiple users even unprivileged users can find the rootpw
with a simple "grep chpass /var/lib/dpkg/info/*".

That is why Claudius will turn his passwd setting package into a
transient one. In addition we will need a changelog entry telling all
users to drop the "chpasswd" in "postinst" pattern for
regular/non-transient packages. 

Henning