5365 2013-10-18 09:59:58 +0000 ability to set root password in cleartext 2014-02-05 12:49:36 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core unspecified x86 Multiple VERIFIED FIXED Medium enhancement 1.6 M1 1 jack Qi.Chen bluelightning ke.zou lpapp meta.mr.watcher meta.watcher Qi.Chen --- --- Yes (doc changes required) oldest_to_newest 38034 0 jack 2013-10-18 09:59:58 +0000 Setting the root password currently involves generating your password hash using crypt and adding the following to your local.conf/distro.conf INHERIT += "extrausers" EXTRA_USERS_PARAMS = "\ usermod -p '\$6\$1BBHm9j1\$Kq6cRYht.cgAEF9DMZg6x2CmnFuJh6R64awVujE60ghOA9rl5TqmPDTRzXFlJ1gQur6mKUSGBMQuqvOTveLto1' root; \ " This is rife with issues. There should be a defined way to set a default, cleartext root password. Issues I encountered when trying this: - $ signs were emitted I assume due to the code thinking they were variables - I generated the hash wrong, multiple times. - I had to learn how shadow and passwd worked together (which IMO shouldn't be a requiste for setting a default root password.) 39070 1 lpapp 2013-11-25 14:59:04 +0000 You did not mention what exactly you would like or it is unclear to me. My problem is that I do not have a dedicated variable this, but I am fine with the hash. You would like to cover here both? Could you please provide an expected output you desire to have? Currently, the title is not in sync with the content for me. If I read the title, it suggest that the only problem is that you need to type hash, not clear text. 39087 2 jack 2013-11-26 11:29:34 +0000 To currently set the root password you must do this: INHERIT += "extrausers" EXTRA_USERS_PARAMS = "\ usermod -p '\$6\$1BBHm9j1\$Kq6cRYht.cgAEF9DMZg6x2CmnFuJh6R64awVujE60ghOA9rl5TqmPDTRzXFlJ1gQur6mKUSGBMQuqvOTveLto1' root; \ " ROOTFS_POSTPROCESS_COMMAND_append = " \ sed -i 's/*/x/' \ ${IMAGE_ROOTFS}/etc/passwd ;" What I would like to be able to do is set a variable with the root password. Root is a special case so I don't think something like: inherit useradd USERADD_PACKAGES = "${PN}" USERADD_ROOT_PASSWD = "password" is unreasonable, but to be honest as long as I can set it in cleartext without manually hacking the rootfs, I will be happy. 39088 3 lpapp 2013-11-26 11:32:00 +0000 But clear text would impose security risk IMHO, so I think it should accept hashes, too, not just clear text if this feature is implemented... 39090 4 jack 2013-11-26 11:43:12 +0000 Yes, hash and cleartext would be fine. However if you don't do anything then the password is empty by default... isn't that the greater security risk? I would also worry about who gets to see the password in clear text if you deem that a security risk. You don't go sharing your internal corporate layers with the general public, so anyone who sees it, will probably already know the password.... 39096 5 lpapp 2013-11-26 14:38:48 +0000 Well, security attacks are not black and white. Someone may realize it on your monitor who should not. It is not hypothetical, but a daily situation in many companies people come and go. There are also silent malicious people and programs which attack when you do not expect (accidentally in the worst moments with stealing the most secret stuff...). So, in general, clear text should not be exclusively available. Sha support would still be nice alongside. I do not comment on the no password scenario much because that is not the question here. We are both here to say that, that is not OK. 39437 6 Qi.Chen 2013-12-17 07:15:23 +0000 merged into poky/master: 36fe775672d66e3d83575eb532eb6ab5109343b4 c38fee231b42b9123dd1fd102235eac6240ba4c8 7b58b5feaa22c82e997165fc130c8545f5b1a129 http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=31dee7946340bf0f1e94e4e714191d3d6ca3bf6a //Chen Qi 39439 7 lpapp 2013-12-17 07:21:35 +0000 Well, one of two concerns is still unresolved. Shall I open a separate bugreport for that? I think there could be a better interface than usermod -p with EXTRA_USERS_PARAMS since it is a common operation in my opinion. Currently, it is a bit raw. 39440 8 Qi.Chen 2013-12-17 07:29:46 +0000 (In reply to comment #7) > Well, one of two concerns is still unresolved. Shall I open a separate > bugreport for that? I think there could be a better interface than usermod > -p with EXTRA_USERS_PARAMS since it is a common operation in my opinion. > Currently, it is a bit raw. Yes. Please. Do you mean a better interface to set root password? Something like ROOT_PASSWD = "xxx" image recipes or configuration file? Regards, Chen Qi 39441 9 Qi.Chen 2013-12-17 07:31:49 +0000 (In reply to comment #8) > (In reply to comment #7) > > Well, one of two concerns is still unresolved. Shall I open a separate > > bugreport for that? I think there could be a better interface than usermod > > -p with EXTRA_USERS_PARAMS since it is a common operation in my opinion. > > Currently, it is a bit raw. > > Yes. Please. > Do you mean a better interface to set root password? > Something like ROOT_PASSWD = "xxx" image recipes or configuration file? > Something like ROOT_PASSWD = "xxx" in image recipes or configuration files? > Regards, > Chen Qi 39443 10 lpapp 2013-12-17 07:36:12 +0000 Yes, that is what exactly I had in mind as well, thanks. Reported: https://bugzilla.yoctoproject.org/show_bug.cgi?id=5675 Also, thanks for working on this bug to be able to set clear text password. 39579 11 ke.zou 2013-12-24 05:26:28 +0000 verified with poky master:005af45191ded6185c618c708181b31281e43092 Test steps: add following lines in build/conf/local.conf INHERIT += "extrausers" EXTRA_USERS_PARAMS = "\ useradd -p '' -u 1200 -d /home/user1 -r -s /bin/bash user1; \ useradd -p 'vz4kBbiMF9z6E' -u 1201 -d /home/user2 -r -s /bin/bash user2; \ useradd -u 1202 -d /home/user3 -r -s /bin/bash -P 'user3' user3; \ " build sato image and boot, You can login with user3:user3 39582 12 lpapp 2013-12-24 08:18:32 +0000 Great, thanks! 40066 13 lpapp 2014-01-28 17:42:59 +0000 Chen, do you mind implementing this one, too? https://bugzilla.yoctoproject.org/show_bug.cgi?id=5675 IMO, that would be a great progress. Currently, any Linux installation I have used out there, has an easy "root" password setting step included. It is a pity that Yocto does not have it yet. 40192 14 lpapp 2014-02-05 12:49:36 +0000 For the record, "extrausers" was not available in dylan, so it is a dora only and on feature. :-/ Perhaps, someone could backport it if it is just mostly about the extrausers class.