Bug 2033849

Summary:	Allow enabling root access via ssh with password for kickstart installations - anaconda part
Product:	Red Hat Enterprise Linux 9	Reporter:	Parikshit Khedekar <pkhedeka>
Component:	anaconda	Assignee:	Radek Vykydal <rvykydal>
Status:	CLOSED ERRATA	QA Contact:	Release Test Team <release-test-team-automation>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	9.0	CC:	bcl, jkonecny, jstodola, sbarcomb
Target Milestone:	rc	Keywords:	FutureFeature, TestCaseNeeded, Triaged
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	anaconda-34.25.1.7-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2083269 (view as bug list)		Environment:
Last Closed:	2022-11-15 09:58:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2083269
Bug Blocks:

Description Parikshit Khedekar 2021-12-18 04:31:54 UTC

Description of problem:

When we do a RHEL 9 install, we need to allow root for ssh based logins by
marking the checkbox. This thing is not recorded to the kickstart generated
for the installation and further it blocks the root account if the kickstart
is used as reference kickstart.

The installation works fine with original install and root login works but
when the resultant kickstart is used for other install the root can't loging
with ssh.

This is common practice administrators follow to have a procedure recorded to
kickstart so will create impact on automated installations and post
installation things.


Version-Release number of selected component (if applicable):

RHEL 9 Beta

How reproducible:

Everytime installing RHEL9 from kickstart recorded from a manual install.

Steps to Reproduce:
1. Install RHEL 9
2. In user section allow ssh based login for root
3. Copy the /root/anaconda-ks.cfg file for another install
4. The another install will not allow root login with ssh

Actual results:

Fails to record kickstart properly.

Expected results:

Shall record the option.

Additional info:

We don't see this to RHEL 8 so probably addition of this feature needs some
work in RHEL 9

Comment 1 Jan Stodola 2022-01-14 14:26:16 UTC

There is a workaround via %post script for kickstart installations:

%post
echo "PermitRootLogin yes" > /etc/ssh/sshd_config.d/01-permitrootlogin.conf
%end

Comment 2 Jan Stodola 2022-01-17 15:41:26 UTC

FYI, the workaround has been also added to the official documentation:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9-beta/html-single/9.0_release_notes/index#BZ-1940653
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9-beta/html-single/performing_an_advanced_rhel_installation/index#rootpw-required_kickstart-commands-for-system-configuration

Comment 3 Jiri Konecny 2022-01-21 10:57:21 UTC

Proposing to 9.1.0 planning.

Comment 4 Jan Stodola 2022-05-09 15:06:27 UTC

pykickstart part: bug 2083269

Comment 7 Radek Vykydal 2022-05-31 13:33:38 UTC

Upstream PR: https://github.com/rhinstaller/anaconda/pull/4154

Comment 8 Radek Vykydal 2022-06-01 11:47:36 UTC

(In reply to Jan Stodola from comment #6)
> Talked to Radek, an automated test should be implement as part of the
> feature in kickstart-tests, where the installed system can try to ssh
> root@localhost (currently it's not possible in RHEL-9.0 without changing the
> sshd configuration manually).

Kickstart test: https://github.com/rhinstaller/kickstart-tests/pull/730

Comment 9 Radek Vykydal 2022-06-08 08:32:30 UTC

https://github.com/rhinstaller/anaconda/pull/4178

Comment 10 Jan Stodola 2022-06-22 17:00:48 UTC

Confirmed that root ssh login via ssh can be enabled via kickstart: "rootpw --allow-ssh .."
If the new option is not specified, root login using password via ssh is still disabled, as expected.
Also confirmed that the generated kickstart contains the "--allow-ssh" option if password-based SSH root login is enabled during interactive graphical installation.

The new kickstart option will be documented in bug 2083269.

Marking as Verified:Tested using anaconda-34.25.1.7-1.el9.

Comment 13 Jan Stodola 2022-06-23 15:05:06 UTC

Checked that anaconda-34.25.1.7-1.el9 is in nightly compose RHEL-9.1.0-20220623.0

Moving to VERIFIED

Comment 15 errata-xmlrpc 2022-11-15 09:58:06 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (anaconda bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7977