1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
cc_set_passwords:
description: |
This module consumes three top-level config keys: ``ssh_pwauth``,
``chpasswd`` and ``password``.
The ``ssh_pwauth`` config key determines whether or not sshd will be
configured to accept password authentication. Disabling SSH password
authentication is limited to setting the specific sshd_config value
``PasswordAuthentication no`` in sshd_config.
.. note::
If your image uses PAM for authentication, providing
``PasswordAuthentication no`` may not be sufficient if your
distribution default is to provide ``KbdInteractiveAuthentication yes``
in sshd_config. See Example 3 for suggested user-data in this case.
The ``chpasswd`` config key accepts a dictionary containing either (or
both) of ``users`` and ``expire``.
- The ``users`` key is used to assign a password to a corresponding
pre-existing user.
- The ``expire`` key is used to set whether to expire all user passwords
specified by this module, such that a password will need to be reset on
the user's next login.
.. note::
Prior to cloud-init 22.3, the ``expire`` key only applies to plain text
(including ``RANDOM``) passwords. Post-22.3, the ``expire`` key applies
to both plain text and hashed passwords.
The ``password`` config key is used to set the default user's password. It
is ignored if the ``chpasswd`` ``users`` is used. Note that the ``list``
keyword is deprecated in favor of ``users``.
examples:
- comment: |
Example 1: Set a default password, to be changed at first login.
file: cc_set_passwords/example1.yaml
- comment: |
Example 2:
- Disable SSH password authentication.
- Don't require users to change their passwords on next login.
- Set the password for user1 to be 'password1' (OS does hashing).
- Set the password for user2 to a pre-hashed password.
- Set the password for user3 to be a randomly generated password, which
will be written to the system console.
file: cc_set_passwords/example2.yaml
- comment: |
Example 3: Disable SSH password authentication and PAM interactive
password authentication by manually supplementing cloud-init's default
sshd_config.
file: cc_set_passwords/example3.yaml
name: Set Passwords
title: Set user passwords and enable/disable SSH password auth
|
