9

I want Puppet not to manage a password (i.e., reset it when it's changed) but to set the initial password when Puppet creates the user.

I was thinking of doing a notify to an Exec resource that sets the password but this is triggered when any property that Puppet manages is modified (e.g., group membership, home directory, etc.). I do not want that.

Any ideas?

9

Puppet itself doesn't natively support "set password at user creation but not otherwise".

One option would be to set up an external auth source, such as LDAP.

Another would be your notify to an Exec idea, but the make the Exec a little smarter.

exec {
  "/usr/sbin/usermod -p '${password}' ${user}":
    onlyif => "/bin/egrep -q '^${user}:[*!]' /etc/shadow",
    require => User[$user];
}

I haven't tested that, but by checking if the password hasn't been set in the Exec resource, you should get the result you were looking for. I think set up that way, the notify/refreshonly stuff isn't necessary, but probably wouldn't hurt.

  • 1
    I've seen some machines use ! for no-password-set, in which case egrep -q '^${user}:[*!]:' /etc/shadow works better. – leedm777 May 14 '12 at 15:12
  • 1
    For RHEL/Cent: egrep '^${username}:!!:.*:' /etc/shadow – rfelsburg Jul 27 '13 at 15:24
  • 1
    grep -Eq '^${user}:[*!]!?:' /etc/shadow" seems to be the most portable, and won't reset users with a locked password. – CodeGnome Jul 24 '14 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.