Bug 1867170
| Summary: | [cloud-init][rhel-8.3] User password lockout when the instance cache folder re-created | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Huijuan Zhao <huzhao> |
| Component: | cloud-init | Assignee: | Eduardo Otubo <eterrell> |
| Status: | CLOSED NOTABUG | QA Contact: | Huijuan Zhao <huzhao> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.3 | CC: | eterrell, jgreguske, ribarry, xiachen, xiliang, yacao, yuxisun |
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-09-24 02:53:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Huijuan Zhao
2020-08-07 15:00:21 UTC
(In reply to Huijuan Zhao from comment #0) > Description of problem: > Create VM on openstack and set password for cloud-user, delete the instance > cache folder /var/lib/cloud/instances/<id> in VM, reboot VM, the > cloud-user's password is locked. > > Version-Release number of selected component (if applicable): > cloud-init-19.4-7.el8.noarch > > How reproducible: > 100% > > Steps to Reproduce: > 1. Create a VM on openstack > 2. Config password for user "cloud-user" > 2.1 Set "ssh_pwauth: 1" in /etc/cloud/cloud.cfg > 2.2 Set password for cloud-user: > # passwd cloud-user > 3. Reboot VM, check can login VM with "cloud-user/<password>" > 4. Remove the instance cache folder > # rm -rf /var/lib/cloud/instances/<id> > 5. Reboot VM > 6. Try to login with "cloud-user" and <password> > > > Actual results: > After step 6, login VM failed: Permission denied, please try again. > > Check the "cloud-user" <password> status: > > # passwd -S cloud-user > > cloud-user LK 2020-08-05 0 99999 7 -1 (Password locked.) > > Expected results: > After step 6, login VM with "cloud-user/<password>" successful. > > Additional info: > Also meet this issue on AWS VM. > The same issue on Azure is tracked by bug 1865715. After some reading I got to some conclusions: 1) According to the documentation here[0], `ssh_pwauth' should contain values <yes/no/unchanged> 2) Manually deleting the iid with `rm -rf /var/lib/cloud/instances/<id>' is not really a scenario. It's almost like performing `manual_cache_clean' on the instance, but not telling cloud-init you actually did it. I suppose that if that happens we'll end up with a broken state where /var/lib/cloud/instance points to an instance-id which was manually deleted. Which is different from the Azure scenario linked by Rick - in this case the same DataSource (CDROM) would be used for other instances and before deploying them the password needs to be redacted. 3) You were trying to login via SSH, but tried to check the password status with `passwd' and terminal logins are locked by default with cloud-init. 4) I believe you can't login via SSH because you manually removed the instance folder and it probably got configured with default values, as before before step 1. (from your scenario) If you agree we can close it as NOTABUG. [0] https://cloudinit.readthedocs.io/en/latest/topics/modules.html#set-passwords |