From 1e4be728442a782e3dbfaa877104e879c9022f61 Mon Sep 17 00:00:00 2001
From: Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io>
Date: Wed, 3 Jun 2026 15:11:37 +0300
Subject: password-reset: T8346: Fix password recovery when only
 `plaintext-password` is set

When a user account was provisioned with only `plaintext-password` (e.g.
via cloud-init), the password recovery tool failed to persist the new
password across reboots. On the next boot, VyOS would re-apply the
`plaintext-password` from config.boot, silently overwriting the recovered
encrypted password.
---
 src/system/standalone_root_pw_reset | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/system/standalone_root_pw_reset b/src/system/standalone_root_pw_reset
index 9a7da8e4c..aa712ad52 100755
--- a/src/system/standalone_root_pw_reset
+++ b/src/system/standalone_root_pw_reset
@@ -27,8 +27,23 @@ CF=/opt/vyatta/etc/config/config.boot
 ADMIN=vyos
 
 set_encrypted_password() {
-    sed -i \
-       -e "/ user $1 {/,/encrypted-password/s/encrypted-password .*\$/encrypted-password \"$2\"/" $3
+    local user=$1 epwd=$2 file=$3
+
+    # Check if encrypted-password exists within this specific user's block
+    if awk "/ user $user \{/{f=1} f && /encrypted-password/{found=1; exit} f && /^        }/{exit} END{exit !found}" "$file"; then
+        # Replace existing encrypted-password line
+        sed -i \
+           -e "/ user $user {/,/encrypted-password/s/encrypted-password .*\$/encrypted-password \"$epwd\"/" "$file"
+    else
+        # Insert encrypted-password after plaintext-password
+        sed -i \
+           -e "/ user $user {/,/plaintext-password/s/\(plaintext-password .*\)\$/\1\n                encrypted-password \"$epwd\"/" "$file"
+    fi
+}
+
+clear_plaintext_password() {
+   sed -i \
+      -e "/ user $1 {/,/plaintext-password/s/plaintext-password .*\$/plaintext-password \"\"/" $2
 }
 
 
@@ -58,6 +73,11 @@ change_password() {
     # escape any slashes in resulting password
     local eepwd=$(sed 's:/:\\/:g' <<< $epwd)
     set_encrypted_password $user $eepwd $CF
+
+    # There is issue that 'set_encrypted_password' only handles the 'encrypted-password' line,
+    # but leaves any existing 'plaintext-password' untouched (T8346).
+    # We need to clear 'plaintext-password' for the user during the password change flow.
+    clear_plaintext_password $user $CF
 }
 
 # System is so messed up that doing anything would be a mistake
-- 
cgit v1.2.3