Red Hat Bugzilla – Bug 1030626
forces user creation in kickstart
Last modified: 2015-03-05 08:56:32 EST
Description of problem:
I have a kickstart with:
It's intended for a cloud image.
Anaconda stops during installation (virt-install, presumably also with livemedia-creator or oz) and forces me to create a user
Version-Release number of selected component (if applicable):
You need to have either root or a user defined (or both). spins typically setup root with a password and then remove it in %post, you could setup a password and then in %post lock it with passwd -l
Brian, could you reconsider? Given the security issue with not having a locked password, we'd _really_ like the main command to say "locked" and not depend on %post.
I can envision non-cloud use cases for this as well, where the root password should be locked and no users created, because user accounts are provided by a network service and root access by sudo. This is a common scenario in large university deployments, for example.
I'm moving this one to rhel-7.1.0? for now. I understand the use case, but I'm wondering if should expose the functionality requested through a different command so it is more obvious for use creating cloud images. I feel we may be setting up non-cloud users for potentially locking themselves out of systems if they accidentally add 'rootpw --lock' and don't also create a user account. That's sort of the thing we want to prevent in general.
Isn't "rootpw --iscrypted !!" an acceptable workaround?
I've sent a patch to the list for comment. After pondering this, I think a kickstart with rootpw --lock is safe enough. It is something that they user has done explicitly, and if they did it on accident it's easy enough for them to edit their kickstart and not do it again.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.