Use usermod(8) on OpenBSD to unbreak password management#294
Conversation
|
This is a cleaner version of what is already committed to OpenBSD's openvox package: https://github.com/openbsd/ports/blob/e3c8d71c07071f2171821b5b2bfb6f1702ce3466/sysutils/ruby-openvox/8/patches/patch-lib_puppet_provider_user_useradd_rb |
bf7bb72 to
372aa8f
Compare
|
Linters are happy, tests used in CI seem broken and report failures entirely unrelated to this PR. |
372aa8f to
1d8bd7a
Compare
|
@bastelfreak OK to merge? |
|
@buzzdeee Perhaps you want to take a look at this, too? We're already running with a slightly different patch in our port/package, behaviour is identical, though. |
|
in the port/package, we have it addressed in lib/puppet/provider/user/useradd_rb which likely breaks other OS. This is much cleaner, tested creating users, and updating password: works for me. |
0f3c99b to
c750d9b
Compare
f1e77c2 "(PUP-3634) Hide password hash from process list for useradd" introduced `chpasswd -e` which does not exist on OpenBSD, thus `user` resources managing `password` would always fail: ``` Notice: Compiled catalog for atar in environment production in 0.02 seconds rror: Could not set password on user[test]: No command chpasswd defined for provider openbsd Error: /Stage[main]/Main/User[test]/password: change from [redacted] to [redacted] failed: Could not set password on user[test]: No command chpasswd defined for provider openbsd Notice: Applied catalog in 0.01 seconds ``` Use https://man.openbsd.org/usermod.8#p instead: ``` Notice: Compiled catalog for atar in environment production in 0.01 seconds Notice: /Stage[main]/Main/User[test]/password: changed [redacted] to [redacted] Notice: Applied catalog in 0.21 seconds ``` `password` values now do show up briefly in the process list, but given they must be encrypted in order to work, this does not seem critical.
c750d9b to
8a2d027
Compare
|
@klemensn 8.26.0 has been released with this fix. |
f1e77c2 "(PUP-3634) Hide password hash from process list for useradd"
introduced
chpasswd -ewhich does not exist on OpenBSD, thususerresources managing
passwordwould always fail:Use https://man.openbsd.org/usermod.8#p instead:
passwordvalues now do show up briefly in the process list, but giventhey must be encrypted in order to work, this does not seem critical.