Username and Password Customizations

When deploying Crowbar and OpenStack in your environment, you may wish to change some of the default username and password settings. The goal of this document is to define the locations where these changes can be configured, and how to properly make these changes. Ultimately, it should be possible (using this document) to set or change usernames and passwords throughout the Crowbar infrastructure when needed.

Crowbar Web Interface & REST API

Pre installation

1. Create a working copy of the Crowbar proposal

/opt/dell/bin/crowbar crowbar proposal show default > file.json

1. Edit the users section of the working copy of the Crowbar proposal.

vim file.json

* Example: 

    ```bash
    "users": {
      "machine-install": { "password": "machine_password" },
      "crowbar": { "password": "crowbar" }
    }
    ```

    is modified with `NEWPASSWORD`

    ```bash
    "users": {
      "machine-install": { "password": "machine_password" },
      "crowbar": { "password": "NEWPASSWORD" }
    }
    ```

1. Stage the edited version of the Crowbar proposal

/opt/dell/bin/crowbar crowbar proposal edit default --file=file.json

1. Commit the edited version of the Crowbar proposal

/opt/dell/bin/crowbar crowbar proposal commit default

1. Switch to root

sudo -i

1. Run chef-client to apply the new password to the Crowbar Web UI and REST API

chef-client

The Crowbar Web Interface and REST API should now be accessible using the new password.

post install

Edit the crowbar proposal in raw mode, and update the password.

Chef

The Chef Web UI password is created during installation, but it can also be changed upon first login to the Chef web interface. The base installation password is based on:

/tftpboot/ubuntu_dvd/extra/debsel.conf

Edit

# New password for the 'admin' user in the Chef Server WebUI:
chef-server-webui       chef-server-webui/admin_password        password        password
# New password for the 'chef' AMQP user in the RabbitMQ vhost "/chef":
chef-solr       chef-solr/amqp_password password        password

To change it from the web interface

1. Log into the web interface

2. Click Users > List > and Edit under the account for which you wish to change the password .

3. Enter a new password.

4. Click Save User to apply the new password.

Openstack Dashboard

To change before deploying Crowbar

/opt/dell/barclamps/keystone/chef/data_bags/crowbar/bc-template-keystone.json

Look for the "admin" and "default" entries, that include the username, password and tenant for both a keystone admin and a simple user.

To change on a running Crowbar admin node

Edit the keystone proposal for the same values as above.

Nagios & Ganglia

Nagios and Ganglia use databag items to define users. Note that the password is the htpasswd version, not the clear text one. see man htpasswd for usage.

Pre install

/opt/dell/barclamps/nagios/chef/data_bags/users/nagiosadmin.json

post install

use the chef server GUI to edit the nagiosadmin item in the users databag.

Ubuntu

Ubuntu compute gets default user info from:

/opt/dell/barclamps/provisioner/chef/data_bags/crowbar/bc-template-provisioner.json

1. The password used in this proposal is an md5 password hash. Though optionally you can specify a clear text password using default_password, this is less secure. To generate a hashed password, use the md5pass command-line utility. This will output YOURNEWLYGENERATEDHASH:

md5pass [NEWPLAINTEXTPASSWORD]

1. Copy this YOURNEWLYGENERATEDHASH hash. It will replace the default hash in the working copy of the Provisioner proposal.

2. Create a working copy of the Provisioner proposal.

/opt/dell/bin/crowbar provisioner proposal show default > file.json

1. Edit the default_password_hash section of the working copy of the Provisioner proposal. Replace the default hash with your newly generated hash (the output of the md5pass command).

vim file.json

* Example: 

    ```bash
    "default_password_hash": "$1$BDC3UwFr$/VqOWN1Wi6oM0jiMOjaPb."
    ```

    is modified with `YOURNEWLYGENERATEDHASH`

    ```bash
    "default_password_hash": "YOURNEWLYGENERATEDHASH"
    ```

1. Stage the edited version of the Provisioner proposal

/opt/dell/bin/crowbar provisioner proposal edit default --file=file.json

1. Commit the edited version of the Provisioner proposal

/opt/dell/bin/crowbar provisioner proposal commit default

1. Switch to root

sudo -i

1. Run chef-client. Any new Ubuntu installs completed via Crowbar will get the new password (NOTE: Existing Ubuntu installs will not be updated, and will need to be updated!)

chef-client

Red Hat

Red Hat follows a similar pattern as Ubuntu