Add some troubleshooting steps for access recovery

[jlebon]

The init=/bin/sh trick is known, but let's give a clear step-by-step
to make this easier. (The SELinux step in particular is easy to miss.)

See related user question:
https://discussion.fedoraproject.org/t/recommended-password-recovery-procedure/17034

[lucab]

@jlebon can we maybe remove all the password-setting references and just stick to show the SSH flow? I'm worried users could end with forgotten weak temporary passwords.

Also, I'm somehow surprised that init=sh still manages to boot into rootfs given all the missing things from systemd and rpm-ostree. Did you try this on a recent FCOS?

[jlebon]

@jlebon can we maybe remove all the password-setting references and just stick to show the SSH flow? I'm worried users could end with forgotten weak temporary passwords.

I think the only places it's showing up right now are where it makes sense. Once in the specifications for FCC, and once about migrating from AH: https://docs.fedoraproject.org/en-US/fedora-coreos/migrate-ah/. Hmm, I guess we should probably add a warning there though about SSH password logins being disabled by default and discouraged?

Also, I'm somehow surprised that init=sh still manages to boot into rootfs given all the missing things from systemd and rpm-ostree. Did you try this on a recent FCOS?

Bash doesn't need systemd nor rpm-ostree though :) It's functional enough to at least reset passwords and do other basic things. (Edit: and yup, tried this before posting it!).

[austinnichols101]

I just tried init=/bin/sh with FCOS 31 and it just hangs at boot. Possibly I am not following the correct procedure...

[jlebon]

@austinnichols101 What message does it hang on?

I'll admit I tested it on a local build. Will sanity-check against the latest release.

[austinnichols101]

@jlebon Here's the last of the boot log (running VMware Workstation 15).

[austinnichols101]

@jlebon - here's an MP4 video of the boot failure.
RCOS Boot 2020-02-14_12-59-32.zip

[jlebon]

@austinnichols101 Ahhh, you're doing this over tty0, right? Try adding console=tty0 at the end.

[austinnichols101]

@jlebon - Adding console=tty0 helped. Then at the prompt I

• Loaded the SELinux policy: /sbin/load_policy -i
• Reset the password for root and core: passwd <user>
  . Reboot: /sbin/reboot -f

However, after I reboot I'm unable to log on as either core or root.

Note that I did make a first attempt WITHOUT loading the SELinux policy so that might have screwed things up.

[jlebon]

Note that I did make a first attempt WITHOUT loading the SELinux policy so that might have screwed things up.

Yeah, judging from the AVC denials, that seems to be the issue. You can fix it using /sbin/restorecon -v /etc/{passwd,shadow} from the shell boot again.

[austinnichols101]

That solved the problem. Thanks!

@jamescassell - I think the /sbin/restorecon -v /etc/{passwd,shadow} should be included in the procedure with a note/warning to load the selinux policy as the first step after logging in.

[jlebon]

I added a bit about restorecon to be explicit.

[jamescassell]

Looks good to me. I've never tried restorecon without a loaded policy...

[jamescassell]

Maybe we need a "intro to sysadmin" link we assume folks have already read, though.

[jamescassell]

By holding the left shift key or sequentially pressing the up and down arrows to interrupt the grub timeout, then press e to edit the selected entry, entering the grub user (usually root) and password if necessary. (Do we support grub passwords?)

[jlebon]

Maybe let's keep further tweaks as follow-ups and just get this one in? It does more good as is on the docs site, than not-quite-perfect sitting here. :)

[bgilbert]

Yup, let's get this in!