RFE: chpasswd in cloud-init should support hashed passwords #2649
Comments
|
Launchpad user Brian Murray(brian-murray) wrote on 2017-04-10T22:22:08.771047+00:00 Hello Tore, or anyone else affected, Accepted cloud-init into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cloud-init/0.7.9-90-g61eb03fe-0ubuntu1~16.10.1 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance! |
|
Launchpad user Brian Murray(brian-murray) wrote on 2017-04-10T22:45:34.667923+00:00 Hello Tore, or anyone else affected, Accepted cloud-init into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cloud-init/0.7.9-90-g61eb03fe-0ubuntu1~16.04.1 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance! |
|
Launchpad user Andreas Hasenack(ahasenack) wrote on 2017-04-17T12:36:36.218732+00:00 Tests passed for xenial according to the instructions (see attached output). |
|
Launchpad user Andreas Hasenack(ahasenack) wrote on 2017-04-17T12:37:31.957566+00:00 Tests passed for yakkety according to the instructions (see attached output). Launchpad attachments: lp-1570325-yakkety.txt |
|
Launchpad user Andreas Hasenack(ahasenack) wrote on 2017-04-17T13:28:37.509174+00:00 Also launched a yakkety lxd with the attached user-data file, and it correctly changed the user's password to the provided hash. lxc launch b03fe-yakkety-proposed y1-proposed "--config=user.user-data=$(cat cloud-init.yaml)" |
|
Launchpad user Andreas Hasenack(ahasenack) wrote on 2017-04-17T13:43:29.981403+00:00 Also launched a xenial lxd container with the same user-data file as in the previous comment and it correctly changed the "tom" user's password to the provided hash. lxc launch b03fe-xenial-proposed x1-proposed "--config=user.user-data=$(cat cloud-init.yaml)" |
|
Launchpad user Launchpad Janitor(janitor) wrote on 2017-04-20T19:33:34.017361+00:00 This bug was fixed in the package cloud-init - 0.7.9-90-g61eb03fe-0ubuntu1~16.10.1 cloud-init (0.7.9-90-g61eb03fe-0ubuntu1~16.10.1) yakkety; urgency=medium
-- Scott Moser smoser@ubuntu.com Mon, 03 Apr 2017 12:03:30 -0400 |
|
Launchpad user Steve Langasek(vorlon) wrote on 2017-04-20T19:34:17.802987+00:00 The verification of the Stable Release Update for cloud-init has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions. |
|
Launchpad user Launchpad Janitor(janitor) wrote on 2017-04-20T19:35:54.384643+00:00 This bug was fixed in the package cloud-init - 0.7.9-90-g61eb03fe-0ubuntu1~16.04.1 cloud-init (0.7.9-90-g61eb03fe-0ubuntu1~16.04.1) xenial-proposed; urgency=medium
-- Scott Moser smoser@ubuntu.com Mon, 03 Apr 2017 11:52:56 -0400 |
|
Launchpad user Scott Moser(smoser) wrote on 2017-09-23T02:13:35.942006+00:00 This bug is believed to be fixed in cloud-init in 17.1. If this is still a problem for you, please make a comment and set the state back to New Thank you. |
This bug was originally filed in Launchpad as LP: #1570325
Launchpad details
Launchpad user Tore(tlonoy) wrote on 2016-04-14T11:16:00.675314+00:00
=== Begin SRU Template ===
[Impact]
The only way to assign a hashed password to a user is to use passwd within a
users entry like this:
users:
- name: root
passwd: $6$Cl....Hy$IEJciQZLxQLzkST......g.bzqf3lUl.
But, if that user is already present on the system, cloud-init would skip
setting the password. The change was to add support for providing
encrypted passwords to 'chpasswd' as:
chpasswd:
list: |
user:$5$eriogqzq$Dg7PxHsKGzziuEGkZgkLvacjuEFeljJ.rLf.hZqKQLA
[Test Case]
There is an integration test in cloud-init that runs though this code.
To run that:
$ git clone https://git.launchpad.net/cloud-init
$ cd cloud-init
download the appropriate deb for cloud-init from -proposed
$ rel=xenial
$ pver=$(rmadison --url=ubuntu --suite=$rel-proposed cloud-init | awk '{print $3}')
$ fname="cloud-init_${pver}_all.deb"
$ wget "http://archive.ubuntu.com/ubuntu/pool/main/c/cloud-init/$fname"
$ ln -sf $fname cloud-init_all.$rel.deb
$ tox -e citest -- run -v -n $rel --deb=cloud-init_all.$rel.deb
-t tests/cloud_tests/testcases/modules/set_password_list_string.py
-t tests/cloud_tests/testcases/modules/set_password_list.py
That will install the new cloud-init into a container and run
with user data to excercise this new feature.
[Regression Potential]
Some user passwords provided via chpasswd and starting with '$'
may be interpreted as hashed passwords.
Specifically, those matching: r'$1,2a,2y,5,6{2}'
In english, that regex is:
- starts with a '$'
- followed by '1', '2a', '2y', '5', '6'
- followed by a $
- followed by 1 or more characters
- followed by another $
- followed by 1 or more characters
So a total of 3 '$' and starting with one of those specific 3 or 4
character strings. That could definitely happen, but it is low odds, and also fairly low risk. If a user hits this, they'd be unable to reach a new instance.
[Other Info]
Upstream commit:
https://git.launchpad.net/cloud-init/commit/?id=21632972df034
=== End SRU Template ===
The only way to assign a hashed password to a user is to use passwd within a users entry like this:
users:
- name: root
passwd: $6$Cl....Hy$IEJciQZLxQLzkST......g.bzqf3lUl.
But, if that user is already present on the system, cloud-init will skip setting the password:
journal: [CLOUDINIT] init.py[INFO]: User root already exists, skipping.
You can change password with chpasswd, but that only supports clear-text password.
Requesting that chpasswd get support for setting a hashed password to users.
The text was updated successfully, but these errors were encountered: