Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want Puppet not to manage a password (i.e., reset it when it's changed) but to set the initial password when Puppet creates the user.

I was thinking of doing a notify to an Exec resource that sets the password but this is triggered when any property that Puppet manages is modified (e.g., group membership, home directory, etc.). I do not want that.

Any ideas?

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

Puppet itself doesn't natively support "set password at user creation but not otherwise".

One option would be to set up an external auth source, such as LDAP.

Another would be your notify to an Exec idea, but the make the Exec a little smarter.

exec {
  "usermod -p '${password}' ${user}":
    onlyif => "egrep -q '^${user}:[*!]' /etc/shadow",
    require => User[$user];

I haven't tested that, but by checking if the password hasn't been set in the Exec resource, you should get the result you were looking for. I think set up that way, the notify/refreshonly stuff isn't necessary, but probably wouldn't hurt.

share|improve this answer
Thanks! Works great. –  Belmin Fernandez Feb 14 '12 at 23:33
I've seen some machines use ! for no-password-set, in which case egrep -q '^${user}:[*!]:' /etc/shadow works better. –  dave May 14 '12 at 15:12
For RHEL/Cent: egrep '^${username}:!!:.*:' /etc/shadow –  rfelsburg Jul 27 '13 at 15:24
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.