vyos-cloud-init.git/cloudinit/config/cc_set_passwords.py, branch rolling

Adopt Black and isort (SC-700) (#1157)

2021-12-16T02:16:38+00:00

Applied Black and isort, fixed any linting issues, updated tox.ini and CI.

Leave the details of service management to the distro (#1074)

2021-10-20T20:58:27+00:00

Various modules restart services and they all have logic to try and detect if they are running on a system that needs 'systemctl' or 'service', and then have code to decide which order the arguments need to be etc. On top of that, not all modules do this in the same way. The duplication and different approaches are not ideal but this also makes it hard to add support for a new distribution that does not use either 'systemctl' or 'service'. This change adds a new manage_service() method to the distro class and updates several modules to use it.

Improve ug_util.py (#1013)

2021-09-13T19:41:45+00:00

No functional changes.

write passwords only to serial console, lock down cloud-init-output.log (#847)

2021-03-19T14:06:42+00:00

Prior to this commit, when a user specified configuration which would generate random passwords for users, cloud-init would cause those passwords to be written to the serial console by emitting them on stderr. In the default configuration, any stdout or stderr emitted by cloud-init is also written to `/var/log/cloud-init-output.log`. This file is world-readable, meaning that those randomly-generated passwords were available to be read by any user with access to the system. This presents an obvious security issue. This commit responds to this issue in two ways: * We address the direct issue by moving from writing the passwords to sys.stderr to writing them directly to /dev/console (via util.multi_log); this means that the passwords will never end up in cloud-init-output.log * To avoid future issues like this, we also modify the logging code so that any files created in a log sink subprocess will only be owner/group readable and, if it exists, will be owned by the adm group. This results in `/var/log/cloud-init-output.log` no longer being world-readable, meaning that if there are other parts of the codebase that are emitting sensitive data intended for the serial console, that data is no longer available to all users of the system. LP: #1918303

Move subp into its own module. (#416)

2020-06-08T16:49:12+00:00

This was painful, but it finishes a TODO from cloudinit/subp.py. It moves the following from util to subp: ProcessExecutionError subp which target_path I moved subp_blob_in_tempfile into cc_chef, which is its only caller. That saved us from having to deal with it using write_file and temp_utils from subp (which does not import any cloudinit things now). It is arguable that 'target_path' could be moved to a 'path_utils' or something, but in order to use it from subp and also from utils, we had to get it out of utils.

set_passwords: avoid chpasswd on BSD (#268)

2020-03-25T17:44:10+00:00

Avoid chpasswd on all the BSD variants.

cc_set_password: increase random pwlength from 9 to 20 (#189)

2020-01-24T19:33:12+00:00

Increasing the bits of security from 52 to 115. LP: #1860795

cloud-init: fix capitalisation of SSH (#126)

2019-12-18T21:22:02+00:00

* cc_ssh: fix capitalisation of SSH * doc: fix capitalisation of SSH * cc_keys_to_console: fix capitalisation of SSH * ssh_util: fix capitalisation of SSH * DataSourceIBMCloud: fix capitalisation of SSH * DataSourceAzure: fix capitalisation of SSH * cs_utils: fix capitalisation of SSH * distros/__init__: fix capitalisation of SSH * cc_set_passwords: fix capitalisation of SSH * cc_ssh_import_id: fix capitalisation of SSH * cc_users_groups: fix capitalisation of SSH * cc_ssh_authkey_fingerprints: fix capitalisation of SSH

set_passwords: support for FreeBSD (#46)

2019-11-26T16:44:21+00:00

Allow setting of user passwords on FreeBSD The www/chpasswd utility which we depended on for FreeBSD installations does *not* do the same thing as the equally named Linux utility. For FreeBSD, we now use the pw(8) utility (which can only process one user at a time) Additionally, we abstract expire passwd into a function, and override it in the FreeBSD distro class. Co-Authored-By: Chad Smith

replace any deprecated log.warn with log.warning

2019-10-17T14:36:40+00:00

Commit 6797e822959b84c98cf73e02b2a6e3d6ab3fd4fe replaced the LOG.warn calls that linters were warning about; this also replaces calls that linters would not have recognised (as `log` is generally a parameter in these scenarios). LP: #1508442