I've been assigned to use Puppet to synchronize user passwords across an arbitrary number of servers, so that a user can change their password once and have that change pushed out to an arbitrary number of servers. Most of the advice I've seen has been to use something else, like LDAP, but I've been specifically instructed to use Puppet.
All I have so far is a class that, when run, sets a user's password. It should take the user id from facter to prevent someone from changing someone else's password.
class pwdchange ($newpassword = '') {
user {"$::id":
ensure => present
password => $encryptednewpassword
}
}
What I'm looking for is how to take a cleartext argument, check it to make sure it's a good password, and encrypt it with md5. I'll do that to get from newpassword
to encryptednewpassword
. Do I need to use an exec resource with the md5sum
command? Or should I have a template that encrypts the password using ruby code? Or is there an easy, simple way to do this that I'm not seeing?