Bug 1242959 - Empty default sysprep password (LocalAdminPassword)
Summary: Empty default sysprep password (LocalAdminPassword)
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: Setup.Engine
Version: ---
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ovirt-3.6.0-rc
: 3.6.0
Assignee: Shahar Havivi
QA Contact: Jiri Belka
URL:
Whiteboard: virt
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-07-14 13:30 UTC by Alon Bar-Lev
Modified: 2016-02-10 19:23 UTC (History)
11 users (show)

Fixed In Version: 3.6.0-4_alpha3
Clone Of:
Environment:
Last Closed: 2015-11-04 11:23:32 UTC
oVirt Team: Virt
Embargoed:
rule-engine: ovirt-3.6.0+
ylavi: planning_ack+
rule-engine: devel_ack+
pnovotny: testing_ack+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 43585 0 master ABANDONED packaging: setup: set LocalAdminPassword using static password 2020-12-29 09:57:08 UTC
oVirt gerrit 43713 0 master MERGED core: remove LocalAdminPassword 2020-12-29 09:57:08 UTC

Description Alon Bar-Lev 2015-07-14 13:30:15 UTC
Currently the sysprep password is set to be the engine admin password, the engine admin password should not be used to anything else but login into engine.

The sysprep password is set to static password 'password'.

Comment 1 Michal Skrivanek 2015-07-15 06:23:54 UTC
we're now testing empty password

The current behavior was not really documented anywhere.
For clarity we'll rather have an empty one when one doesn't fill anything in UI, than some magic string.

one more patch needed for database upgrade

Comment 2 Alon Bar-Lev 2015-07-15 06:47:53 UTC
(In reply to Michal Skrivanek from comment #1)
> we're now testing empty password
> 
> The current behavior was not really documented anywhere.
> For clarity we'll rather have an empty one when one doesn't fill anything in
> UI, than some magic string.
> 
> one more patch needed for database upgrade

why? setup can encrypt empty password. just modify the patch to use "" instead of "password".

Comment 3 Alon Bar-Lev 2015-07-16 10:52:28 UTC
Even better, we remove the LocalAdminPassword entirely.

Comment 4 Jiri Belka 2015-09-08 10:17:49 UTC
Could you please explain how would this influence customers' environments where they used to use LocalAdminPassword in vdc_options for their syspreps?

https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=commitdiff;h=5dac9c3368fa7199aebbb3028a2bab361cec2072#patch5

I suppose if they won't change their work process their VMs would end with empty password even they would expect to have the password set from LocalAdminPassword option value from vdc_options.

(IIUC: At least this change should be highlighted so users get informed about change of default behaviour and IIUC they would need to explicitly define password for every initial run.)

Comment 5 Shahar Havivi 2015-09-08 11:07:51 UTC
There is a comment in the doc test.
Removed the default password that was stored in LocalAdminPassword.
ie the default login to windows is no password.

Comment 6 Jiri Belka 2015-09-08 12:16:13 UTC
This will break environment using sysprep with LocalAdminPassword value in the DB.

I am not sure if LocalAdminPassword removal from the DB (and thus engine-config) was thought through (I'm OK with "unlinking" it with admin@internal password of course).

This is going to be regression and it needs re-thinking.

Comment 8 Jiri Belka 2015-09-08 12:38:00 UTC
The LocalAdminPassword used to be configurable and if anybody known that, it could be used...

Comment 10 Jiri Belka 2015-10-27 16:56:06 UTC
ok, rhevm-backend-3.6.0.2-0.1.el6.noarch

LocalAdminPassword got removed from db during upgrade (3.5.5 -> 3.6.0-17) and in final sysprep there's empty passwd if not defined in initial run dialogs.


            <UserAccounts>
                <AdministratorPassword>
                    <Value><![CDATA[]]></Value>
                    <PlainText>true</PlainText>
                </AdministratorPassword>
                <LocalAccounts>
                    <LocalAccount wcm:action="add">
                        <Password>
                            <Value><![CDATA[]]></Value>
                            <PlainText>true</PlainText>
                        </Password>
                        <Group>administrators</Group>
                        <Name>user</Name>
                        <DisplayName>user</DisplayName>
                    </LocalAccount>
                </LocalAccounts>
            </UserAccounts>

Comment 11 Sandro Bonazzola 2015-11-04 11:23:32 UTC
oVirt 3.6.0 has been released on November 4th, 2015 and should fix this issue.
If problems still persist, please open a new BZ and reference this one.


Note You need to log in before you can comment on or make changes to this bug.