Skip to content

L
lxc
Commit 826cde7c by Michael H. Warfield Committed by Stéphane Graber
Options

Added root_password_expired password control tuning knob.

Added the environment variable "root_password_expired" to control if the initial, temporary, root password is initially set up as "expired". If set to "yes" (default), the root password is set as "expired" and the user must change it at first login. Signed-off-by: 's avatarMichael H. Warfield <mhw@WittsEnd.com> Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
parent 779b47fd
Showing with 28 additions and 2 deletions
templates/lxc-centos.in
...@@ -29,7 +29,7 @@ ...@@ -29,7 +29,7 @@
#Configurations #Configurations
default_path=@LXCPATH@ default_path=@LXCPATH@
# Some combinations of the tunning knobs below do not exactly make sense. # Some combinations of the tuning knobs below do not exactly make sense.
# but that's ok. # but that's ok.
# #
# If the "root_password" is non-blank, use it, else set a default. # If the "root_password" is non-blank, use it, else set a default.
...@@ -45,6 +45,8 @@ default_path=@LXCPATH@ ...@@ -45,6 +45,8 @@ default_path=@LXCPATH@
# If root_store_password = yes, store it in the configuration directory # If root_store_password = yes, store it in the configuration directory
# If root_prompt_password = yes, invoke "passwd" to force the user to change # If root_prompt_password = yes, invoke "passwd" to force the user to change
# the root password after the container is created. # the root password after the container is created.
# If root_expire_password = yes, you will be prompted to change the root
# password at the first login.
# #
# These are conditional assignments... The can be overridden from the # These are conditional assignments... The can be overridden from the
# preexisting environment variables... # preexisting environment variables...
...@@ -61,6 +63,10 @@ default_path=@LXCPATH@ ...@@ -61,6 +63,10 @@ default_path=@LXCPATH@
# with users running under the API... Don't default to "yes" # with users running under the API... Don't default to "yes"
: ${root_prompt_password='no'} : ${root_prompt_password='no'}
# Expire root password? Default to yes, but can be overridden from
# the environment variable
: ${root_expire_password='yes'}
# These are only going into comments in the resulting config... # These are only going into comments in the resulting config...
lxc_network_type=veth lxc_network_type=veth
lxc_network_link=lxcbr0 lxc_network_link=lxcbr0
...@@ -346,8 +352,12 @@ EOF ...@@ -346,8 +352,12 @@ EOF
fi fi
echo "root:$root_password" | chroot $rootfs_path chpasswd echo "root:$root_password" | chroot $rootfs_path chpasswd
if [ ${root_expire_password} = "yes" ]
then
# Also set this password as expired to force the user to change it! # Also set this password as expired to force the user to change it!
chroot $rootfs_path passwd -e root chroot $rootfs_path passwd -e root
fi
# This will need to be enhanced for CentOS 7 when systemd # This will need to be enhanced for CentOS 7 when systemd
# comes into play... /\/\|=mhw=|\/\/ # comes into play... /\/\|=mhw=|\/\/
...@@ -900,6 +910,8 @@ then ...@@ -900,6 +910,8 @@ then
" "
chroot ${rootfs_path} passwd chroot ${rootfs_path} passwd
else else
if [ ${root_expire_password} = "yes" ]
then
echo " echo "
The root password is set up as "expired" and will require it to be changed The root password is set up as "expired" and will require it to be changed
at first login, which you should do as soon as possible. If you lose the at first login, which you should do as soon as possible. If you lose the
...@@ -909,4 +921,5 @@ also reset the expired flag): ...@@ -909,4 +921,5 @@ also reset the expired flag):
chroot ${rootfs_path} passwd chroot ${rootfs_path} passwd
" "
fi
fi fi
templates/lxc-fedora.in
...@@ -29,7 +29,7 @@ ...@@ -29,7 +29,7 @@
#Configurations #Configurations
default_path=@LXCPATH@ default_path=@LXCPATH@
# Some combinations of the tunning knobs below do not exactly make sense. # Some combinations of the tuning knobs below do not exactly make sense.
# but that's ok. # but that's ok.
# #
# If the "root_password" is non-blank, use it, else set a default. # If the "root_password" is non-blank, use it, else set a default.
...@@ -45,6 +45,8 @@ default_path=@LXCPATH@ ...@@ -45,6 +45,8 @@ default_path=@LXCPATH@
# If root_store_password = yes, store it in the configuration directory # If root_store_password = yes, store it in the configuration directory
# If root_prompt_password = yes, invoke "passwd" to force the user to change # If root_prompt_password = yes, invoke "passwd" to force the user to change
# the root password after the container is created. # the root password after the container is created.
# If root_expire_password = yes, you will be prompted to change the root
# password at the first login.
# #
# These are conditional assignments... The can be overridden from the # These are conditional assignments... The can be overridden from the
# preexisting environment variables... # preexisting environment variables...
...@@ -61,6 +63,10 @@ default_path=@LXCPATH@ ...@@ -61,6 +63,10 @@ default_path=@LXCPATH@
# with users running under the API... Don't default to "yes" # with users running under the API... Don't default to "yes"
: ${root_prompt_password='no'} : ${root_prompt_password='no'}
# Expire root password? Default to yes, but can be overridden from
# the environment variable
: ${root_expire_password='yes'}
# These are only going into comments in the resulting config... # These are only going into comments in the resulting config...
lxc_network_type=veth lxc_network_type=veth
lxc_network_link=lxcbr0 lxc_network_link=lxcbr0
...@@ -294,8 +300,12 @@ EOF ...@@ -294,8 +300,12 @@ EOF
fi fi
echo "root:$root_password" | chroot $rootfs_path chpasswd echo "root:$root_password" | chroot $rootfs_path chpasswd
if [ ${root_expire_password} = "yes" ]
then
# Also set this password as expired to force the user to change it! # Also set this password as expired to force the user to change it!
chroot $rootfs_path passwd -e root chroot $rootfs_path passwd -e root
fi
# specifying this in the initial packages doesn't always work. # specifying this in the initial packages doesn't always work.
# Even though it should have... # Even though it should have...
...@@ -1412,6 +1422,8 @@ then ...@@ -1412,6 +1422,8 @@ then
" "
chroot ${rootfs_path} passwd chroot ${rootfs_path} passwd
else else
if [ ${root_expire_password} = "yes" ]
then
echo " echo "
The root password is set up as "expired" and will require it to be changed The root password is set up as "expired" and will require it to be changed
at first login, which you should do as soon as possible. If you lose the at first login, which you should do as soon as possible. If you lose the
...@@ -1421,4 +1433,5 @@ also reset the expired flag): ...@@ -1421,4 +1433,5 @@ also reset the expired flag):
chroot ${rootfs_path} passwd chroot ${rootfs_path} passwd
" "
fi
fi fi
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment