when I install a box for a user that I know will not be taken into use on a hostile network, I generally have this in my kickstarts

[...]
# create a user
user --name=user --password=geheim
[...]
%post
(
#
# set a full name
chfn -f 'test user' user
#
# set empty password
passwd -d user
#
# force password change
chage -d 0 user
# the two steps above of course only make sense if you install in a trusted network
# and then log in once to set password BEFORE you put the machine in an untrusted network.
# If you can not do this, set a decent password higher up in this file and disable the -d step
[...]


It would be nice if anaconda's user option was able to achieve this, e.g. with a --passwordsetonfirstlogin option.

The aim is that after installation the user is given the machine (which is set up to come up in run level 5) she/he can click her/his username in gdm and is then be prompted to set a password of their choice.