| Summary: | ability to set root password in cleartext | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Jack Mitchell <jack> |
| Component: | core | Assignee: | Chen Qi <Qi.Chen> |
| Status: | VERIFIED FIXED | QA Contact: | |
| Severity: | enhancement | ||
| Priority: | Medium | CC: | bluelightning, ke.zou, lpapp, meta.mr.watcher, meta.watcher, Qi.Chen |
| Version: | unspecified | ||
| Target Milestone: | 1.6 M1 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Yes (doc changes required) | |
You did not mention what exactly you would like or it is unclear to me. My problem is that I do not have a dedicated variable this, but I am fine with the hash. You would like to cover here both? Could you please provide an expected output you desire to have? Currently, the title is not in sync with the content for me. If I read the title, it suggest that the only problem is that you need to type hash, not clear text. To currently set the root password you must do this:
INHERIT += "extrausers"
EXTRA_USERS_PARAMS = "\
usermod -p '\$6\$1BBHm9j1\$Kq6cRYht.cgAEF9DMZg6x2CmnFuJh6R64awVujE60ghOA9rl5TqmPDTRzXFlJ1gQur6mKUSGBMQuqvOTveLto1' root; \
"
ROOTFS_POSTPROCESS_COMMAND_append = " \
sed -i 's/*/x/' \
${IMAGE_ROOTFS}/etc/passwd ;"
What I would like to be able to do is set a variable with the root password. Root is a special case so I don't think something like:
inherit useradd
USERADD_PACKAGES = "${PN}"
USERADD_ROOT_PASSWD = "password"
is unreasonable, but to be honest as long as I can set it in cleartext without manually hacking the rootfs, I will be happy.
But clear text would impose security risk IMHO, so I think it should accept hashes, too, not just clear text if this feature is implemented... Yes, hash and cleartext would be fine. However if you don't do anything then the password is empty by default... isn't that the greater security risk? I would also worry about who gets to see the password in clear text if you deem that a security risk. You don't go sharing your internal corporate layers with the general public, so anyone who sees it, will probably already know the password.... Well, security attacks are not black and white. Someone may realize it on your monitor who should not. It is not hypothetical, but a daily situation in many companies people come and go. There are also silent malicious people and programs which attack when you do not expect (accidentally in the worst moments with stealing the most secret stuff...). So, in general, clear text should not be exclusively available. Sha support would still be nice alongside. I do not comment on the no password scenario much because that is not the question here. We are both here to say that, that is not OK. merged into poky/master: 36fe775672d66e3d83575eb532eb6ab5109343b4 c38fee231b42b9123dd1fd102235eac6240ba4c8 7b58b5feaa22c82e997165fc130c8545f5b1a129 http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=31dee7946340bf0f1e94e4e714191d3d6ca3bf6a //Chen Qi Well, one of two concerns is still unresolved. Shall I open a separate bugreport for that? I think there could be a better interface than usermod -p with EXTRA_USERS_PARAMS since it is a common operation in my opinion. Currently, it is a bit raw. (In reply to comment #7) > Well, one of two concerns is still unresolved. Shall I open a separate > bugreport for that? I think there could be a better interface than usermod > -p with EXTRA_USERS_PARAMS since it is a common operation in my opinion. > Currently, it is a bit raw. Yes. Please. Do you mean a better interface to set root password? Something like ROOT_PASSWD = "xxx" image recipes or configuration file? Regards, Chen Qi (In reply to comment #8) > (In reply to comment #7) > > Well, one of two concerns is still unresolved. Shall I open a separate > > bugreport for that? I think there could be a better interface than usermod > > -p with EXTRA_USERS_PARAMS since it is a common operation in my opinion. > > Currently, it is a bit raw. > > Yes. Please. > Do you mean a better interface to set root password? > Something like ROOT_PASSWD = "xxx" image recipes or configuration file? > Something like ROOT_PASSWD = "xxx" in image recipes or configuration files? > Regards, > Chen Qi Yes, that is what exactly I had in mind as well, thanks. Reported: https://bugzilla.yoctoproject.org/show_bug.cgi?id=5675 Also, thanks for working on this bug to be able to set clear text password. verified with poky master:005af45191ded6185c618c708181b31281e43092 Test steps: add following lines in build/conf/local.conf INHERIT += "extrausers" EXTRA_USERS_PARAMS = "\ useradd -p '' -u 1200 -d /home/user1 -r -s /bin/bash user1; \ useradd -p 'vz4kBbiMF9z6E' -u 1201 -d /home/user2 -r -s /bin/bash user2; \ useradd -u 1202 -d /home/user3 -r -s /bin/bash -P 'user3' user3; \ " build sato image and boot, You can login with user3:user3 Great, thanks! Chen, do you mind implementing this one, too? https://bugzilla.yoctoproject.org/show_bug.cgi?id=5675 IMO, that would be a great progress. Currently, any Linux installation I have used out there, has an easy "root" password setting step included. It is a pity that Yocto does not have it yet. For the record, "extrausers" was not available in dylan, so it is a dora only and on feature. :-/ Perhaps, someone could backport it if it is just mostly about the extrausers class. |
Setting the root password currently involves generating your password hash using crypt and adding the following to your local.conf/distro.conf INHERIT += "extrausers" EXTRA_USERS_PARAMS = "\ usermod -p '\$6\$1BBHm9j1\$Kq6cRYht.cgAEF9DMZg6x2CmnFuJh6R64awVujE60ghOA9rl5TqmPDTRzXFlJ1gQur6mKUSGBMQuqvOTveLto1' root; \ " This is rife with issues. There should be a defined way to set a default, cleartext root password. Issues I encountered when trying this: - $ signs were emitted I assume due to the code thinking they were variables - I generated the hash wrong, multiple times. - I had to learn how shadow and passwd worked together (which IMO shouldn't be a requiste for setting a default root password.)