9

I want Puppet not to manage a password (i.e., reset it when it's changed) but to set the initial password when Puppet creates the user.

I was thinking of doing a notify to an Exec resource that sets the password but this is triggered when any property that Puppet manages is modified (e.g., group membership, home directory, etc.). I do not want that.

Any ideas?

Improve this question

1 Answer 1

Reset to default
9

Puppet itself doesn't natively support "set password at user creation but not otherwise".

One option would be to set up an external auth source, such as LDAP.

Another would be your notify to an Exec idea, but the make the Exec a little smarter.

exec {
  "/usr/sbin/usermod -p '${password}' ${user}":
    onlyif => "/bin/egrep -q '^${user}:[*!]' /etc/shadow",
    require => User[$user];
}

I haven't tested that, but by checking if the password hasn't been set in the Exec resource, you should get the result you were looking for. I think set up that way, the notify/refreshonly stuff isn't necessary, but probably wouldn't hurt.

Improve this answer
3
  • 1
    I've seen some machines use ! for no-password-set, in which case egrep -q '^${user}:[*!]:' /etc/shadow works better.
    – leedm777
    May 14, 2012 at 15:12
  • 1
    For RHEL/Cent: egrep '^${username}:!!:.*:' /etc/shadow
    – rfelsburg
    Jul 27, 2013 at 15:24
  • 1
    grep -Eq '^${user}:[*!]!?:' /etc/shadow" seems to be the most portable, and won't reset users with a locked password.
    – CodeGnome
    Jul 24, 2014 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .