Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want Puppet not to manage a password (i.e., reset it when it's changed) but to set the initial password when Puppet creates the user.

I was thinking of doing a notify to an Exec resource that sets the password but this is triggered when any property that Puppet manages is modified (e.g., group membership, home directory, etc.). I do not want that.

Any ideas?

share|improve this question
up vote 9 down vote accepted

Puppet itself doesn't natively support "set password at user creation but not otherwise".

One option would be to set up an external auth source, such as LDAP.

Another would be your notify to an Exec idea, but the make the Exec a little smarter.

exec {
  "/usr/sbin/usermod -p '${password}' ${user}":
    onlyif => "/bin/egrep -q '^${user}:[*!]' /etc/shadow",
    require => User[$user];

I haven't tested that, but by checking if the password hasn't been set in the Exec resource, you should get the result you were looking for. I think set up that way, the notify/refreshonly stuff isn't necessary, but probably wouldn't hurt.

share|improve this answer
Thanks! Works great. – Belmin Fernandez Feb 14 '12 at 23:33
I've seen some machines use ! for no-password-set, in which case egrep -q '^${user}:[*!]:' /etc/shadow works better. – leedm777 May 14 '12 at 15:12
For RHEL/Cent: egrep '^${username}:!!:.*:' /etc/shadow – rfelsburg Jul 27 '13 at 15:24
grep -Eq '^${user}:[*!]!?:' /etc/shadow" seems to be the most portable, and won't reset users with a locked password. – CodeGnome Jul 24 '14 at 20:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.