Optional password reset

[vholer]

If no PASSWORD* is specified, the user's password on the instance is always reset to '*'

addon-context-linux/src/etc/one-context.d/loc-20-set-username-password

Lines 61 to 63 in 8f74136

	else
	usermod -p '*' "${USERNAME}"
	fi

This behavior should be possible to disable (e.g. if PASSWORD_RESET=no)

[kvaps]

@vholer why you used this asterisk?

In my opinninon you should remove any password here, like:

passwd -d "${USERNAME}"

or

usermod -p '' "${USERNAME}" 

This is classic unix way for set no password.
It's also gives good opportunity for logon into machine via graphic console if password is not set, and set it via console for not store it in contextualization template info.

Also are you sure is that good idea for enable PASSWORD_RESET=YES option by default? - it is forces for store password in contextualization template that, in my opinnion, is not good practics fo users.
Anytime they should to set PASSWORD_RESET=NO for each template, otherwise it will overriden by asterisk. (refuse any password)

[vholer]

The provided options set the privileged account passwordless. From the security perspective, don't think this is a good default behavior.

[vholer]

Also are you sure is that good idea for enable PASSWORD_RESET=YES option by default?

I believe it is. Similar way we should also fix the user's authorized keys.

it is forces for store password in contextualization template

Yes, but you still can have a pretty secure password hash, I dare to say unbreakable, in the contextualization data, if you do enough hashing rounds (e.g. mkpasswd -m sha-512 -R 2000000)

Anytime they should to set PASSWORD_RESET=NO

I'm thinking about

1. separating all these defaults into own file on the guest
2. with option to override them from different configuration file on the guest

So, the person who is preparing images can easily override these defaults right in the image and not to depend on overrides from the contextualization.

[kvaps]

The provided options set the privileged account passwordless. From the security perspective, don't think this is a good default behavior.

@vholer, thanks for answer, seems you really right.
If user will not take care of about securing vnc console, passwordless login can be really dangerous.

1. separating all these defaults into own file on the guest

Great idea!
I think we can move all scripts into /usr/share/one-context.d/, in /etc/one-context.d/ leave only configuration for them

Thanks!

[2autunni]

Hi,
on centos 7.4
usermod -p '*' "${USERNAME}"
doesn't works: the user can't login.
instead using
passwd -d "${USERNAME}"
the result is to assign an empty password to the user

[vholer]

Hi @2autunni, that's expected behavior, not to unlock the account to be usable by anyone who has access to the VNC console. In new version, there will be a contextualization parameter USERNAME_PASSWORD_RESET to disable this behavior, already in Git. See the conversation above. Thank you, Vlastimil

[2autunni]

Thank you @vholer.

I misunderstood the use of USERNAME_PASSWORD_RESET