Changing root password via script fails but reports success

Question

I have a project which requires me to make a script / sequence of commands to change the root password on a CentOS 7 installation.

I can assume the user that will be executing the script is already root.

Currently, I'm using the following, and getting a success message:

[root@localhost]# echo -e ‘password\npassword’ | (passwd --stdin root)
Changing password for user root.
passwd: all authentication tokens updated successfully.

However, this doesn't actually change the password. Upon further inspection (manually setting the password), I notice the password password fails a dictionary check, but still reports success at the end:

[root@localhost]# passwd
Changing password for user root.
New password:
BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word
Retype new password:
passwd: all authentication tokens updated successfully.

One possible solution is to try hashing the given password based on the method and salt provided in /etc/shadow, but I would like to avoid an overly complicated solution. I could also check whether the value in /etc/shadow actually changed, but that ignores the case in which the password is set to what it already was, which I would like to support.

Does anyone have a suggestion on trying to validate the password before actually setting it, or, preferably, getting the FULL output from passwd ?

Answer 1

When using passwd --stdin you only need to send the password once. So correct version is

echo password | passwd --stdin

If your code sample is accurate then (a) you've got smart quotes there when you need straightforward forward quotes and (b) the password is probably being set to something like `password\npassword' (possibly with smart quotes either side).

Answer 2

Making things work with the passwd command is impressive, since it traditionally is interactive and a pain to automate. (Yay for the gnu generation for making it relatively painless.) But if you're doing automation why not use commands that are more automation friendly, like chpasswd?

echo root:password | chpasswd

will do what you're doing above. And if you want to do 50 at once, just send more lines of username:password.