I generate password for new users with apg


$password = generate('/etc/puppet/utils/gen_password')

The only problem with this command is that I need it only once, but it's evaluated every time puppet is run.

This variable is used inside of one Exec declaration.

Is there any possibility, to evaluate varable only if it's necessary? For example if it's used first time.

  • What is the problem with this running more then once? What exactly is your script doing? Can you pass the hostname parameter to the script so that it can repeatably generate a password? Are you sure you can't just skip the password generation altogether and use some kind of key/cert-based authentication?
    – Zoredache
    Dec 16, 2013 at 20:20

2 Answers 2


You can use several options to run exec conditionally. Choose which one suits your needs:

  • unless - If this parameter is set, then this exec will run unless the command returns 0.
  • creates - A file to look for before running the command. The command will only run if the file doesn’t exist.
  • onlyif - If this parameter is set, then this exec will only run if the command returns 0.
  • refreshonly - The command should only be run as a refresh mechanism for when a dependent object is changed.
  • You can not use it as parameter, because parameter needs to be filled every time a puppet runs. Unless you save your passwords in recoverable format, what is not a very good advice :) Dec 16, 2013 at 14:22

If you are not using the password in an Exec, then the methods suggested by Kazimieras Aliulis may not work for you.

If it were me, I would probably just modify the /etc/puppet/utils/gen_password script to always return the same password per-service/host. You would have puppet call the generte like this generate("/etc/puppet/utils/gen_password $::clientcert").

Then in the script you would check to see if a password had been generated for that system, and if it had return it. If not then generate a new one, store it in and return it.

If at all possible don't store and return the unecrypted password. Instead generate and return the salted password hash.

Of course if you could skip using passwords altogether and instead use certificates or keys for authentication that would be even better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.