diff options
| author | John Southworth <john.southworth@vyatta.com> | 2012-09-04 16:36:24 -0700 |
|---|---|---|
| committer | John Southworth <john.southworth@vyatta.com> | 2012-09-04 16:36:24 -0700 |
| commit | 918bd40d3e3f238a800b1486f70e2d5ee1d71a72 (patch) | |
| tree | 38763bbaf267d6a5ecf0dbd417628dce5c92a18e /templates | |
| parent | 8faaec7b1b9bd034449348b693c5216e349a04ec (diff) | |
| download | vyatta-cfg-system-918bd40d3e3f238a800b1486f70e2d5ee1d71a72.tar.gz vyatta-cfg-system-918bd40d3e3f238a800b1486f70e2d5ee1d71a72.zip | |
Bugfix 8290
Don't allow default password to persist after first boot.
Due to the numerous ways a user can get a vyatta system this required
a lot of changes.
1. Don't allow a user to set a password to 'vyatta' after first login,
but allow it on the initial boot otherwise the system will have no
user.
2. Don't allow the password to be set to vyatta in installer.
3. Force password change on first login. under the following
conditions:
3.a. User is an admin level user. Operators do not have the abillity
to change the config so they can't change passwords. Allow 'vyatta' to
be the password until an admin logs in.
3.b. This is not the livecd, its silly to force a password change
before install.
Diffstat (limited to 'templates')
| -rw-r--r-- | templates/system/login/user/node.tag/authentication/plaintext-password/node.def | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/templates/system/login/user/node.tag/authentication/plaintext-password/node.def b/templates/system/login/user/node.tag/authentication/plaintext-password/node.def index 12a74a36..5f1d09ed 100644 --- a/templates/system/login/user/node.tag/authentication/plaintext-password/node.def +++ b/templates/system/login/user/node.tag/authentication/plaintext-password/node.def @@ -4,6 +4,11 @@ help: Plaintext password for encryption # and do nothing. to set password to empty, user needs to set the # "encrypted-password" to an empty string (which actually allows login without # password). +syntax:expression: exec "\ + if [[ -e /opt/vyatta/etc/.nofirstpasswd && $VAR(@) == 'vyatta' ]]; then \ + echo 'Invalid password [$VAR(@)]';\ + exit 1;\ + fi" update:expression: $VAR(@) == "" \ || ($VAR(../encrypted-password/@) \ = `/usr/bin/mkpasswd -H md5 '$VAR(@)' | tr -d \\\\n` \ |