From ad170db966492e845b9dc23346cc7297e8a99032 Mon Sep 17 00:00:00 2001
From: Marlin Cremers <marlin@true.nl>
Date: Tue, 15 Jan 2019 23:22:05 +0000
Subject: cc_set_passwords: Fix regex when parsing hashed passwords

Correct invalid regex to match hashes starting with the following:
  - $1, $2a, $2y, $5 or $6

LP: #1811446
---
 cloudinit/config/cc_set_passwords.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'cloudinit/config/cc_set_passwords.py')

diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
index 5ef97376..4585e4d3 100755
--- a/cloudinit/config/cc_set_passwords.py
+++ b/cloudinit/config/cc_set_passwords.py
@@ -160,7 +160,7 @@ def handle(_name, cfg, cloud, log, args):
         hashed_users = []
         randlist = []
         users = []
-        prog = re.compile(r'\$[1,2a,2y,5,6](\$.+){2}')
+        prog = re.compile(r'\$(1|2a|2y|5|6)(\$.+){2}')
         for line in plist:
             u, p = line.split(':', 1)
             if prog.match(p) is not None and ":" not in p:
-- 
cgit v1.2.3


From 88092eeae2c91e265c603025c87beda4c7d72bd4 Mon Sep 17 00:00:00 2001
From: Daniel Watkins <daniel.watkins@canonical.com>
Date: Wed, 7 Aug 2019 14:32:13 +0000
Subject: cc_set_passwords: rewrite documentation

What we had previously was inaccurate in a few respects.

LP: #1838794
---
 cloudinit/config/cc_set_passwords.py | 53 +++++++++++++++++++++++-------------
 1 file changed, 34 insertions(+), 19 deletions(-)

(limited to 'cloudinit/config/cc_set_passwords.py')

diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
index 4585e4d3..cf9b5ab5 100755
--- a/cloudinit/config/cc_set_passwords.py
+++ b/cloudinit/config/cc_set_passwords.py
@@ -9,27 +9,40 @@
 """
 Set Passwords
 -------------
-**Summary:** Set user passwords
-
-Set system passwords and enable or disable ssh password authentication.
-The ``chpasswd`` config key accepts a dictionary containing a single one of two
-keys, either ``expire`` or ``list``. If ``expire`` is specified and is set to
-``false``, then the ``password`` global config key is used as the password for
-all user accounts. If the ``expire`` key is specified and is set to ``true``
-then user passwords will be expired, preventing the default system passwords
-from being used.
-
-If the ``list`` key is provided, a list of
-``username:password`` pairs can be specified. The usernames specified
-must already exist on the system, or have been created using the
-``cc_users_groups`` module. A password can be randomly generated using
-``username:RANDOM`` or ``username:R``. A hashed password can be specified
-using ``username:$6$salt$hash``. Password ssh authentication can be
-enabled, disabled, or left to system defaults using ``ssh_pwauth``.
+**Summary:** Set user passwords and enable/disable SSH password authentication
+
+This module consumes three top-level config keys: ``ssh_pwauth``, ``chpasswd``
+and ``password``.
+
+The ``ssh_pwauth`` config key determines whether or not sshd will be configured
+to accept password authentication.  True values will enable password auth,
+false values will disable password auth, and the literal string ``unchanged``
+will leave it unchanged.  Setting no value will also leave the current setting
+on-disk unchanged.
+
+The ``chpasswd`` config key accepts a dictionary containing either or both of
+``expire`` and ``list``.
+
+If the ``list`` key is provided, it should contain a list of
+``username:password`` pairs.  This can be either a YAML list (of strings), or a
+multi-line string with one pair per line.  Each user will have the
+corresponding password set.  A password can be randomly generated by specifying
+``RANDOM`` or ``R`` as a user's password.  A hashed password, created by a tool
+like ``mkpasswd``, can be specified; a regex
+(``r'\\$(1|2a|2y|5|6)(\\$.+){2}'``) is used to determine if a password value
+should be treated as a hash.
 
 .. note::
-    if using ``expire: true`` then a ssh authkey should be specified or it may
-    not be possible to login to the system
+    The users specified must already exist on the system.  Users will have been
+    created by the ``cc_users_groups`` module at this point.
+
+By default, all users on the system will have their passwords expired (meaning
+that they will have to be reset the next time the user logs in).  To disable
+this behaviour, set ``expire`` under ``chpasswd`` to a false value.
+
+If a ``list`` of user/password pairs is not specified under ``chpasswd``, then
+the value of the ``password`` config key will be used to set the default user's
+password.
 
 **Internal name:** ``cc_set_passwords``
 
@@ -160,6 +173,8 @@ def handle(_name, cfg, cloud, log, args):
         hashed_users = []
         randlist = []
         users = []
+        # N.B. This regex is included in the documentation (i.e. the module
+        # docstring), so any changes to it should be reflected there.
         prog = re.compile(r'\$(1|2a|2y|5|6)(\$.+){2}')
         for line in plist:
             u, p = line.split(':', 1)
-- 
cgit v1.2.3


From 7e699256b319cdf41e747211763e593a6b5f3393 Mon Sep 17 00:00:00 2001
From: Dominic Schlegel <dominic.schlegel@hostpoint.ch>
Date: Thu, 17 Oct 2019 14:36:40 +0000
Subject: replace any deprecated log.warn with log.warning

Commit 6797e822959b84c98cf73e02b2a6e3d6ab3fd4fe replaced
the LOG.warn calls that linters were warning about; this
also replaces calls that linters would not have recognised
(as `log` is generally a parameter in these scenarios).

LP: #1508442
---
 cloudinit/config/cc_apt_pipelining.py                |  2 +-
 cloudinit/config/cc_byobu.py                         |  6 +++---
 cloudinit/config/cc_chef.py                          | 20 ++++++++++----------
 cloudinit/config/cc_emit_upstart.py                  |  2 +-
 cloudinit/config/cc_final_message.py                 |  2 +-
 cloudinit/config/cc_growpart.py                      |  2 +-
 cloudinit/config/cc_keys_to_console.py               |  6 +++---
 cloudinit/config/cc_lxd.py                           | 15 +++++++--------
 cloudinit/config/cc_mounts.py                        | 14 +++++++-------
 .../config/cc_package_update_upgrade_install.py      |  7 ++++---
 cloudinit/config/cc_phone_home.py                    | 12 ++++++------
 cloudinit/config/cc_power_state_change.py            | 13 ++++++-------
 cloudinit/config/cc_puppet.py                        | 10 +++++-----
 cloudinit/config/cc_resizefs.py                      | 17 ++++++++---------
 cloudinit/config/cc_resolv_conf.py                   |  4 ++--
 cloudinit/config/cc_rightscale_userdata.py           |  4 ++--
 cloudinit/config/cc_rsyslog.py                       |  2 +-
 cloudinit/config/cc_scripts_per_boot.py              |  4 ++--
 cloudinit/config/cc_scripts_per_instance.py          |  4 ++--
 cloudinit/config/cc_scripts_per_once.py              |  4 ++--
 cloudinit/config/cc_scripts_user.py                  |  4 ++--
 cloudinit/config/cc_scripts_vendor.py                |  4 ++--
 cloudinit/config/cc_seed_random.py                   |  2 +-
 cloudinit/config/cc_set_passwords.py                 |  2 +-
 cloudinit/config/cc_update_etc_hosts.py              |  8 ++++----
 cloudinit/config/cc_yum_add_repo.py                  | 10 +++++-----
 .../test_handler/test_handler_power_state.py         |  2 +-
 27 files changed, 90 insertions(+), 92 deletions(-)

(limited to 'cloudinit/config/cc_set_passwords.py')

diff --git a/cloudinit/config/cc_apt_pipelining.py b/cloudinit/config/cc_apt_pipelining.py
index 459332ab..225d0905 100644
--- a/cloudinit/config/cc_apt_pipelining.py
+++ b/cloudinit/config/cc_apt_pipelining.py
@@ -59,7 +59,7 @@ def handle(_name, cfg, _cloud, log, _args):
     elif apt_pipe_value_s in [str(b) for b in range(0, 6)]:
         write_apt_snippet(apt_pipe_value_s, log, DEFAULT_FILE)
     else:
-        log.warn("Invalid option for apt_pipelining: %s", apt_pipe_value)
+        log.warning("Invalid option for apt_pipelining: %s", apt_pipe_value)
 
 
 def write_apt_snippet(setting, log, f_name):
diff --git a/cloudinit/config/cc_byobu.py b/cloudinit/config/cc_byobu.py
index 8570da15..0b4352c8 100755
--- a/cloudinit/config/cc_byobu.py
+++ b/cloudinit/config/cc_byobu.py
@@ -60,7 +60,7 @@ def handle(name, cfg, cloud, log, args):
     valid = ("enable-user", "enable-system", "enable",
              "disable-user", "disable-system", "disable")
     if value not in valid:
-        log.warn("Unknown value %s for byobu_by_default", value)
+        log.warning("Unknown value %s for byobu_by_default", value)
 
     mod_user = value.endswith("-user")
     mod_sys = value.endswith("-system")
@@ -80,8 +80,8 @@ def handle(name, cfg, cloud, log, args):
         (users, _groups) = ug_util.normalize_users_groups(cfg, cloud.distro)
         (user, _user_config) = ug_util.extract_default(users)
         if not user:
-            log.warn(("No default byobu user provided, "
-                      "can not launch %s for the default user"), bl_inst)
+            log.warning(("No default byobu user provided, "
+                         "can not launch %s for the default user"), bl_inst)
         else:
             shcmd += " sudo -Hu \"%s\" byobu-launcher-%s" % (user, bl_inst)
             shcmd += " || X=$(($X+1)); "
diff --git a/cloudinit/config/cc_chef.py b/cloudinit/config/cc_chef.py
index a6240306..0ad6b7f1 100644
--- a/cloudinit/config/cc_chef.py
+++ b/cloudinit/config/cc_chef.py
@@ -196,7 +196,7 @@ def handle(name, cfg, cloud, log, _args):
     # If there isn't a chef key in the configuration don't do anything
     if 'chef' not in cfg:
         log.debug(("Skipping module named %s,"
-                  " no 'chef' key in configuration"), name)
+                   " no 'chef' key in configuration"), name)
         return
     chef_cfg = cfg['chef']
 
@@ -215,9 +215,9 @@ def handle(name, cfg, cloud, log, _args):
         if vcert != "system":
             util.write_file(vkey_path, vcert)
         elif not os.path.isfile(vkey_path):
-            log.warn("chef validation_cert provided as 'system', but "
-                     "validation_key path '%s' does not exist.",
-                     vkey_path)
+            log.warning("chef validation_cert provided as 'system', but "
+                        "validation_key path '%s' does not exist.",
+                        vkey_path)
 
     # Create the chef config from template
     template_fn = cloud.get_template_filename('chef_client.rb')
@@ -234,8 +234,8 @@ def handle(name, cfg, cloud, log, _args):
         util.ensure_dirs(param_paths)
         templater.render_to_file(template_fn, CHEF_RB_PATH, params)
     else:
-        log.warn("No template found, not rendering to %s",
-                 CHEF_RB_PATH)
+        log.warning("No template found, not rendering to %s",
+                    CHEF_RB_PATH)
 
     # Set the firstboot json
     fb_filename = util.get_cfg_option_str(chef_cfg, 'firstboot_path',
@@ -276,9 +276,9 @@ def run_chef(chef_cfg, log):
         elif isinstance(cmd_args, six.string_types):
             cmd.append(cmd_args)
         else:
-            log.warn("Unknown type %s provided for chef"
-                     " 'exec_arguments' expected list, tuple,"
-                     " or string", type(cmd_args))
+            log.warning("Unknown type %s provided for chef"
+                        " 'exec_arguments' expected list, tuple,"
+                        " or string", type(cmd_args))
             cmd.extend(CHEF_EXEC_DEF_ARGS)
     else:
         cmd.extend(CHEF_EXEC_DEF_ARGS)
@@ -334,7 +334,7 @@ def install_chef(cloud, chef_cfg, log):
             retries=util.get_cfg_option_int(chef_cfg, "omnibus_url_retries"),
             omnibus_version=omnibus_version)
     else:
-        log.warn("Unknown chef install type '%s'", install_type)
+        log.warning("Unknown chef install type '%s'", install_type)
         run = False
     return run
 
diff --git a/cloudinit/config/cc_emit_upstart.py b/cloudinit/config/cc_emit_upstart.py
index eb9fbe66..b342e04d 100644
--- a/cloudinit/config/cc_emit_upstart.py
+++ b/cloudinit/config/cc_emit_upstart.py
@@ -69,6 +69,6 @@ def handle(name, _cfg, cloud, log, args):
             util.subp(cmd)
         except Exception as e:
             # TODO(harlowja), use log exception from utils??
-            log.warn("Emission of upstart event %s failed due to: %s", n, e)
+            log.warning("Emission of upstart event %s failed due to: %s", n, e)
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_final_message.py b/cloudinit/config/cc_final_message.py
index c61f03d4..fd141541 100644
--- a/cloudinit/config/cc_final_message.py
+++ b/cloudinit/config/cc_final_message.py
@@ -83,6 +83,6 @@ def handle(_name, cfg, cloud, log, args):
         util.logexc(log, "Failed to write boot finished file %s", boot_fin_fn)
 
     if cloud.datasource.is_disconnected:
-        log.warn("Used fallback datasource")
+        log.warning("Used fallback datasource")
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_growpart.py b/cloudinit/config/cc_growpart.py
index 564f376f..aa9716e7 100644
--- a/cloudinit/config/cc_growpart.py
+++ b/cloudinit/config/cc_growpart.py
@@ -321,7 +321,7 @@ def handle(_name, cfg, _cloud, log, _args):
 
     mycfg = cfg.get('growpart')
     if not isinstance(mycfg, dict):
-        log.warn("'growpart' in config was not a dict")
+        log.warning("'growpart' in config was not a dict")
         return
 
     mode = mycfg.get('mode', "auto")
diff --git a/cloudinit/config/cc_keys_to_console.py b/cloudinit/config/cc_keys_to_console.py
index aff4010e..8f8735ce 100644
--- a/cloudinit/config/cc_keys_to_console.py
+++ b/cloudinit/config/cc_keys_to_console.py
@@ -52,8 +52,8 @@ def _get_helper_tool_path(distro):
 def handle(name, cfg, cloud, log, _args):
     helper_path = _get_helper_tool_path(cloud.distro)
     if not os.path.exists(helper_path):
-        log.warn(("Unable to activate module %s,"
-                  " helper tool not found at %s"), name, helper_path)
+        log.warning(("Unable to activate module %s,"
+                     " helper tool not found at %s"), name, helper_path)
         return
 
     fp_blacklist = util.get_cfg_option_list(cfg,
@@ -68,7 +68,7 @@ def handle(name, cfg, cloud, log, _args):
         util.multi_log("%s\n" % (stdout.strip()),
                        stderr=False, console=True)
     except Exception:
-        log.warn("Writing keys to the system console failed!")
+        log.warning("Writing keys to the system console failed!")
         raise
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_lxd.py b/cloudinit/config/cc_lxd.py
index d9830770..151a9844 100644
--- a/cloudinit/config/cc_lxd.py
+++ b/cloudinit/config/cc_lxd.py
@@ -66,21 +66,21 @@ def handle(name, cfg, cloud, log, args):
                   name)
         return
     if not isinstance(lxd_cfg, dict):
-        log.warn("lxd config must be a dictionary. found a '%s'",
-                 type(lxd_cfg))
+        log.warning("lxd config must be a dictionary. found a '%s'",
+                    type(lxd_cfg))
         return
 
     # Grab the configuration
     init_cfg = lxd_cfg.get('init')
     if not isinstance(init_cfg, dict):
-        log.warn("lxd/init config must be a dictionary. found a '%s'",
-                 type(init_cfg))
+        log.warning("lxd/init config must be a dictionary. found a '%s'",
+                    type(init_cfg))
         init_cfg = {}
 
     bridge_cfg = lxd_cfg.get('bridge', {})
     if not isinstance(bridge_cfg, dict):
-        log.warn("lxd/bridge config must be a dictionary. found a '%s'",
-                 type(bridge_cfg))
+        log.warning("lxd/bridge config must be a dictionary. found a '%s'",
+                    type(bridge_cfg))
         bridge_cfg = {}
 
     # Install the needed packages
@@ -95,7 +95,7 @@ def handle(name, cfg, cloud, log, args):
         try:
             cloud.distro.install_packages(packages)
         except util.ProcessExecutionError as exc:
-            log.warn("failed to install packages %s: %s", packages, exc)
+            log.warning("failed to install packages %s: %s", packages, exc)
             return
 
     # Set up lxd if init config is given
@@ -301,5 +301,4 @@ def maybe_cleanup_default(net_name, did_init, create, attach,
                 raise e
             LOG.debug(msg, nic_name, profile, fail_assume_enoent)
 
-
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_mounts.py b/cloudinit/config/cc_mounts.py
index 123ffb84..c741c746 100644
--- a/cloudinit/config/cc_mounts.py
+++ b/cloudinit/config/cc_mounts.py
@@ -251,10 +251,10 @@ def setup_swapfile(fname, size=None, maxsize=None):
         util.ensure_dir(tdir)
         util.log_time(LOG.debug, msg, func=util.subp,
                       args=[['sh', '-c',
-                            ('rm -f "$1" && umask 0066 && '
-                             '{ fallocate -l "${2}M" "$1" || '
-                             ' dd if=/dev/zero "of=$1" bs=1M "count=$2"; } && '
-                             'mkswap "$1" || { r=$?; rm -f "$1"; exit $r; }'),
+                             ('rm -f "$1" && umask 0066 && '
+                              '{ fallocate -l "${2}M" "$1" || '
+                              'dd if=/dev/zero "of=$1" bs=1M "count=$2"; } && '
+                              'mkswap "$1" || { r=$?; rm -f "$1"; exit $r; }'),
                              'setup_swap', fname, mbsize]])
 
     except Exception as e:
@@ -347,8 +347,8 @@ def handle(_name, cfg, cloud, log, _args):
     for i in range(len(cfgmnt)):
         # skip something that wasn't a list
         if not isinstance(cfgmnt[i], list):
-            log.warn("Mount option %s not a list, got a %s instead",
-                     (i + 1), type_utils.obj_name(cfgmnt[i]))
+            log.warning("Mount option %s not a list, got a %s instead",
+                        (i + 1), type_utils.obj_name(cfgmnt[i]))
             continue
 
         start = str(cfgmnt[i][0])
@@ -495,7 +495,7 @@ def handle(_name, cfg, cloud, log, _args):
             util.subp(cmd)
             log.debug(fmt, "PASS")
         except util.ProcessExecutionError:
-            log.warn(fmt, "FAIL")
+            log.warning(fmt, "FAIL")
             util.logexc(log, fmt, "FAIL")
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_package_update_upgrade_install.py b/cloudinit/config/cc_package_update_upgrade_install.py
index 17b91011..86afffef 100644
--- a/cloudinit/config/cc_package_update_upgrade_install.py
+++ b/cloudinit/config/cc_package_update_upgrade_install.py
@@ -108,7 +108,8 @@ def handle(_name, cfg, cloud, log, _args):
     reboot_fn_exists = os.path.isfile(REBOOT_FILE)
     if (upgrade or pkglist) and reboot_if_required and reboot_fn_exists:
         try:
-            log.warn("Rebooting after upgrade or install per %s", REBOOT_FILE)
+            log.warning("Rebooting after upgrade or install per "
+                        "%s", REBOOT_FILE)
             # Flush the above warning + anything else out...
             logging.flushLoggers(log)
             _fire_reboot(log)
@@ -117,8 +118,8 @@ def handle(_name, cfg, cloud, log, _args):
             errors.append(e)
 
     if len(errors):
-        log.warn("%s failed with exceptions, re-raising the last one",
-                 len(errors))
+        log.warning("%s failed with exceptions, re-raising the last one",
+                    len(errors))
         raise errors[-1]
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_phone_home.py b/cloudinit/config/cc_phone_home.py
index 3be0d1c1..b8e27090 100644
--- a/cloudinit/config/cc_phone_home.py
+++ b/cloudinit/config/cc_phone_home.py
@@ -79,8 +79,8 @@ def handle(name, cfg, cloud, log, args):
         ph_cfg = cfg['phone_home']
 
     if 'url' not in ph_cfg:
-        log.warn(("Skipping module named %s, "
-                  "no 'url' found in 'phone_home' configuration"), name)
+        log.warning(("Skipping module named %s, "
+                     "no 'url' found in 'phone_home' configuration"), name)
         return
 
     url = ph_cfg['url']
@@ -91,7 +91,7 @@ def handle(name, cfg, cloud, log, args):
     except Exception:
         tries = 10
         util.logexc(log, "Configuration entry 'tries' is not an integer, "
-                    "using %s instead", tries)
+                         "using %s instead", tries)
 
     if post_list == "all":
         post_list = POST_LIST_ALL
@@ -112,7 +112,7 @@ def handle(name, cfg, cloud, log, args):
             all_keys[n] = util.load_file(path)
         except Exception:
             util.logexc(log, "%s: failed to open, can not phone home that "
-                        "data!", path)
+                             "data!", path)
 
     submit_keys = {}
     for k in post_list:
@@ -120,8 +120,8 @@ def handle(name, cfg, cloud, log, args):
             submit_keys[k] = all_keys[k]
         else:
             submit_keys[k] = None
-            log.warn(("Requested key %s from 'post'"
-                      " configuration list not available"), k)
+            log.warning(("Requested key %s from 'post'"
+                         " configuration list not available"), k)
 
     # Get them read to be posted
     real_submit_keys = {}
diff --git a/cloudinit/config/cc_power_state_change.py b/cloudinit/config/cc_power_state_change.py
index 50b37470..43a479cf 100644
--- a/cloudinit/config/cc_power_state_change.py
+++ b/cloudinit/config/cc_power_state_change.py
@@ -103,24 +103,23 @@ def check_condition(cond, log=None):
             return False
         else:
             if log:
-                log.warn(pre + "unexpected exit %s. " % ret +
-                         "do not apply change.")
+                log.warning(pre + "unexpected exit %s. " % ret +
+                            "do not apply change.")
             return False
     except Exception as e:
         if log:
-            log.warn(pre + "Unexpected error: %s" % e)
+            log.warning(pre + "Unexpected error: %s" % e)
         return False
 
 
 def handle(_name, cfg, _cloud, log, _args):
-
     try:
         (args, timeout, condition) = load_power_state(cfg)
         if args is None:
             log.debug("no power_state provided. doing nothing")
             return
     except Exception as e:
-        log.warn("%s Not performing power state change!" % str(e))
+        log.warning("%s Not performing power state change!" % str(e))
         return
 
     if condition is False:
@@ -131,7 +130,7 @@ def handle(_name, cfg, _cloud, log, _args):
 
     cmdline = givecmdline(mypid)
     if not cmdline:
-        log.warn("power_state: failed to get cmdline of current process")
+        log.warning("power_state: failed to get cmdline of current process")
         return
 
     devnull_fp = open(os.devnull, "w")
@@ -214,7 +213,7 @@ def run_after_pid_gone(pid, pidcmdline, timeout, log, condition, func, args):
 
     def fatal(msg):
         if log:
-            log.warn(msg)
+            log.warning(msg)
         doexit(EXIT_FAIL)
 
     known_errnos = (errno.ENOENT, errno.ESRCH)
diff --git a/cloudinit/config/cc_puppet.py b/cloudinit/config/cc_puppet.py
index 4190a20b..e26712e0 100644
--- a/cloudinit/config/cc_puppet.py
+++ b/cloudinit/config/cc_puppet.py
@@ -98,8 +98,8 @@ def _autostart_puppet(log):
     elif os.path.exists('/sbin/chkconfig'):
         util.subp(['/sbin/chkconfig', 'puppet', 'on'], capture=False)
     else:
-        log.warn(("Sorry we do not know how to enable"
-                  " puppet services on this system"))
+        log.warning(("Sorry we do not know how to enable"
+                     " puppet services on this system"))
 
 
 def handle(name, cfg, cloud, log, _args):
@@ -121,8 +121,8 @@ def handle(name, cfg, cloud, log, _args):
 
     p_constants = PuppetConstants(conf_file, ssl_dir, log)
     if not install and version:
-        log.warn(("Puppet install set false but version supplied,"
-                  " doing nothing."))
+        log.warning(("Puppet install set false but version supplied,"
+                     " doing nothing."))
     elif install:
         log.debug(("Attempting to install puppet %s,"),
                   version if version else 'latest')
@@ -141,7 +141,7 @@ def handle(name, cfg, cloud, log, _args):
         cleaned_lines = [i.lstrip() for i in contents.splitlines()]
         cleaned_contents = '\n'.join(cleaned_lines)
         # Move to puppet_config.read_file when dropping py2.7
-        puppet_config.readfp(   # pylint: disable=W1505
+        puppet_config.readfp(  # pylint: disable=W1505
             StringIO(cleaned_contents),
             filename=p_constants.conf_path)
         for (cfg_name, cfg) in puppet_cfg['conf'].items():
diff --git a/cloudinit/config/cc_resizefs.py b/cloudinit/config/cc_resizefs.py
index afd2e060..01dfc125 100644
--- a/cloudinit/config/cc_resizefs.py
+++ b/cloudinit/config/cc_resizefs.py
@@ -8,7 +8,6 @@
 
 """Resizefs: cloud-config module which resizes the filesystem"""
 
-
 import errno
 import getopt
 import os
@@ -183,7 +182,7 @@ def maybe_get_writable_device_path(devpath, info, log):
             not container):
         devpath = util.rootdev_from_cmdline(util.get_cmdline())
         if devpath is None:
-            log.warn("Unable to find device '/dev/root'")
+            log.warning("Unable to find device '/dev/root'")
             return None
         log.debug("Converted /dev/root to '%s' per kernel cmdline", devpath)
 
@@ -212,8 +211,8 @@ def maybe_get_writable_device_path(devpath, info, log):
             log.debug("Device '%s' did not exist in container. "
                       "cannot resize: %s", devpath, info)
         elif exc.errno == errno.ENOENT:
-            log.warn("Device '%s' did not exist. cannot resize: %s",
-                     devpath, info)
+            log.warning("Device '%s' did not exist. cannot resize: %s",
+                        devpath, info)
         else:
             raise exc
         return None
@@ -223,8 +222,8 @@ def maybe_get_writable_device_path(devpath, info, log):
             log.debug("device '%s' not a block device in container."
                       " cannot resize: %s" % (devpath, info))
         else:
-            log.warn("device '%s' not a block device. cannot resize: %s" %
-                     (devpath, info))
+            log.warning("device '%s' not a block device. cannot resize: %s" %
+                        (devpath, info))
         return None
     return devpath  # The writable block devpath
 
@@ -243,7 +242,7 @@ def handle(name, cfg, _cloud, log, args):
     resize_what = "/"
     result = util.get_mount_info(resize_what, log)
     if not result:
-        log.warn("Could not determine filesystem type of %s", resize_what)
+        log.warning("Could not determine filesystem type of %s", resize_what)
         return
 
     (devpth, fs_type, mount_point) = result
@@ -280,8 +279,8 @@ def handle(name, cfg, _cloud, log, args):
             break
 
     if not resizer:
-        log.warn("Not resizing unknown filesystem type %s for %s",
-                 fs_type, resize_what)
+        log.warning("Not resizing unknown filesystem type %s for %s",
+                    fs_type, resize_what)
         return
 
     resize_cmd = resizer(resize_what, devpth)
diff --git a/cloudinit/config/cc_resolv_conf.py b/cloudinit/config/cc_resolv_conf.py
index 9812562a..69f4768a 100644
--- a/cloudinit/config/cc_resolv_conf.py
+++ b/cloudinit/config/cc_resolv_conf.py
@@ -102,11 +102,11 @@ def handle(name, cfg, cloud, log, _args):
         return
 
     if "resolv_conf" not in cfg:
-        log.warn("manage_resolv_conf True but no parameters provided!")
+        log.warning("manage_resolv_conf True but no parameters provided!")
 
     template_fn = cloud.get_template_filename('resolv.conf')
     if not template_fn:
-        log.warn("No template found, not rendering /etc/resolv.conf")
+        log.warning("No template found, not rendering /etc/resolv.conf")
         return
 
     generate_resolv_conf(template_fn=template_fn, params=cfg["resolv_conf"])
diff --git a/cloudinit/config/cc_rightscale_userdata.py b/cloudinit/config/cc_rightscale_userdata.py
index 4e34c7e9..bd8ee89f 100644
--- a/cloudinit/config/cc_rightscale_userdata.py
+++ b/cloudinit/config/cc_rightscale_userdata.py
@@ -111,8 +111,8 @@ def handle(name, _cfg, cloud, log, _args):
         log.debug("%s urls were skipped or failed", skipped)
 
     if captured_excps:
-        log.warn("%s failed with exceptions, re-raising the last one",
-                 len(captured_excps))
+        log.warning("%s failed with exceptions, re-raising the last one",
+                    len(captured_excps))
         raise captured_excps[-1]
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_rsyslog.py b/cloudinit/config/cc_rsyslog.py
index 22b17532..ff211f65 100644
--- a/cloudinit/config/cc_rsyslog.py
+++ b/cloudinit/config/cc_rsyslog.py
@@ -432,7 +432,7 @@ def handle(name, cfg, cloud, log, _args):
             systemd=cloud.distro.uses_systemd()),
     except util.ProcessExecutionError as e:
         restarted = False
-        log.warn("Failed to reload syslog", e)
+        log.warning("Failed to reload syslog", e)
 
     if restarted:
         # This only needs to run if we *actually* restarted
diff --git a/cloudinit/config/cc_scripts_per_boot.py b/cloudinit/config/cc_scripts_per_boot.py
index b03255c7..588e1b03 100644
--- a/cloudinit/config/cc_scripts_per_boot.py
+++ b/cloudinit/config/cc_scripts_per_boot.py
@@ -40,8 +40,8 @@ def handle(name, _cfg, cloud, log, _args):
     try:
         util.runparts(runparts_path)
     except Exception:
-        log.warn("Failed to run module %s (%s in %s)",
-                 name, SCRIPT_SUBDIR, runparts_path)
+        log.warning("Failed to run module %s (%s in %s)",
+                    name, SCRIPT_SUBDIR, runparts_path)
         raise
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_scripts_per_instance.py b/cloudinit/config/cc_scripts_per_instance.py
index baee5cc4..2bc8a6ef 100644
--- a/cloudinit/config/cc_scripts_per_instance.py
+++ b/cloudinit/config/cc_scripts_per_instance.py
@@ -40,8 +40,8 @@ def handle(name, _cfg, cloud, log, _args):
     try:
         util.runparts(runparts_path)
     except Exception:
-        log.warn("Failed to run module %s (%s in %s)",
-                 name, SCRIPT_SUBDIR, runparts_path)
+        log.warning("Failed to run module %s (%s in %s)",
+                    name, SCRIPT_SUBDIR, runparts_path)
         raise
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_scripts_per_once.py b/cloudinit/config/cc_scripts_per_once.py
index 4943e9aa..3f27ee34 100644
--- a/cloudinit/config/cc_scripts_per_once.py
+++ b/cloudinit/config/cc_scripts_per_once.py
@@ -40,8 +40,8 @@ def handle(name, _cfg, cloud, log, _args):
     try:
         util.runparts(runparts_path)
     except Exception:
-        log.warn("Failed to run module %s (%s in %s)",
-                 name, SCRIPT_SUBDIR, runparts_path)
+        log.warning("Failed to run module %s (%s in %s)",
+                    name, SCRIPT_SUBDIR, runparts_path)
         raise
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_scripts_user.py b/cloudinit/config/cc_scripts_user.py
index 6c66481e..d940dbd6 100644
--- a/cloudinit/config/cc_scripts_user.py
+++ b/cloudinit/config/cc_scripts_user.py
@@ -44,8 +44,8 @@ def handle(name, _cfg, cloud, log, _args):
     try:
         util.runparts(runparts_path)
     except Exception:
-        log.warn("Failed to run module %s (%s in %s)",
-                 name, SCRIPT_SUBDIR, runparts_path)
+        log.warning("Failed to run module %s (%s in %s)",
+                    name, SCRIPT_SUBDIR, runparts_path)
         raise
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_scripts_vendor.py b/cloudinit/config/cc_scripts_vendor.py
index 0292eafb..faac9242 100644
--- a/cloudinit/config/cc_scripts_vendor.py
+++ b/cloudinit/config/cc_scripts_vendor.py
@@ -48,8 +48,8 @@ def handle(name, cfg, cloud, log, _args):
     try:
         util.runparts(runparts_path, exe_prefix=prefix)
     except Exception:
-        log.warn("Failed to run module %s (%s in %s)",
-                 name, SCRIPT_SUBDIR, runparts_path)
+        log.warning("Failed to run module %s (%s in %s)",
+                    name, SCRIPT_SUBDIR, runparts_path)
         raise
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_seed_random.py b/cloudinit/config/cc_seed_random.py
index 65f6e777..a5d7c73f 100644
--- a/cloudinit/config/cc_seed_random.py
+++ b/cloudinit/config/cc_seed_random.py
@@ -131,7 +131,7 @@ def handle(name, cfg, cloud, log, _args):
         env['RANDOM_SEED_FILE'] = seed_path
         handle_random_seed_command(command=command, required=req, env=env)
     except ValueError as e:
-        log.warn("handling random command [%s] failed: %s", command, e)
+        log.warning("handling random command [%s] failed: %s", command, e)
         raise e
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
index cf9b5ab5..1379428d 100755
--- a/cloudinit/config/cc_set_passwords.py
+++ b/cloudinit/config/cc_set_passwords.py
@@ -164,7 +164,7 @@ def handle(_name, cfg, cloud, log, args):
         if user:
             plist = ["%s:%s" % (user, password)]
         else:
-            log.warn("No default or defined user to change password for.")
+            log.warning("No default or defined user to change password for.")
 
     errors = []
     if plist:
diff --git a/cloudinit/config/cc_update_etc_hosts.py b/cloudinit/config/cc_update_etc_hosts.py
index c96eede1..03fffb96 100644
--- a/cloudinit/config/cc_update_etc_hosts.py
+++ b/cloudinit/config/cc_update_etc_hosts.py
@@ -62,8 +62,8 @@ def handle(name, cfg, cloud, log, _args):
     if util.translate_bool(manage_hosts, addons=['template']):
         (hostname, fqdn) = util.get_hostname_fqdn(cfg, cloud)
         if not hostname:
-            log.warn(("Option 'manage_etc_hosts' was set,"
-                     " but no hostname was found"))
+            log.warning(("Option 'manage_etc_hosts' was set,"
+                         " but no hostname was found"))
             return
 
         # Render from a template file
@@ -80,8 +80,8 @@ def handle(name, cfg, cloud, log, _args):
     elif manage_hosts == "localhost":
         (hostname, fqdn) = util.get_hostname_fqdn(cfg, cloud)
         if not hostname:
-            log.warn(("Option 'manage_etc_hosts' was set,"
-                     " but no hostname was found"))
+            log.warning(("Option 'manage_etc_hosts' was set,"
+                         " but no hostname was found"))
             return
 
         log.debug("Managing localhost in /etc/hosts")
diff --git a/cloudinit/config/cc_yum_add_repo.py b/cloudinit/config/cc_yum_add_repo.py
index 6a42f499..3b354a7d 100644
--- a/cloudinit/config/cc_yum_add_repo.py
+++ b/cloudinit/config/cc_yum_add_repo.py
@@ -113,16 +113,16 @@ def handle(name, cfg, _cloud, log, _args):
         missing_required = 0
         for req_field in ['baseurl']:
             if req_field not in repo_config:
-                log.warn(("Repository %s does not contain a %s"
-                          " configuration 'required' entry"),
-                         repo_id, req_field)
+                log.warning(("Repository %s does not contain a %s"
+                             " configuration 'required' entry"),
+                            repo_id, req_field)
                 missing_required += 1
         if not missing_required:
             repo_configs[canon_repo_id] = repo_config
             repo_locations[canon_repo_id] = repo_fn_pth
         else:
-            log.warn("Repository %s is missing %s required fields, skipping!",
-                     repo_id, missing_required)
+            log.warning("Repository %s is missing %s required fields, "
+                        "skipping!", repo_id, missing_required)
     for (c_repo_id, path) in repo_locations.items():
         repo_blob = _format_repository_config(c_repo_id,
                                               repo_configs.get(c_repo_id))
diff --git a/tests/unittests/test_handler/test_handler_power_state.py b/tests/unittests/test_handler/test_handler_power_state.py
index 3c726422..0d8d17b9 100644
--- a/tests/unittests/test_handler/test_handler_power_state.py
+++ b/tests/unittests/test_handler/test_handler_power_state.py
@@ -90,7 +90,7 @@ class TestCheckCondition(t_help.TestCase):
         mocklog = mock.Mock()
         self.assertEqual(
             psc.check_condition(self.cmd_with_exit(2), mocklog), False)
-        self.assertEqual(mocklog.warn.call_count, 1)
+        self.assertEqual(mocklog.warning.call_count, 1)
 
 
 def check_lps_ret(psc_return, mode=None):
-- 
cgit v1.2.3


From b6055c40189afba323986059434b8d8adc85bba3 Mon Sep 17 00:00:00 2001
From: Igor Galić <me+github@igalic.co>
Date: Tue, 26 Nov 2019 17:44:21 +0100
Subject: set_passwords: support for FreeBSD (#46)

Allow setting of user passwords on FreeBSD

The www/chpasswd utility which we depended on for FreeBSD installations
does *not* do the same thing as the equally named Linux utility.

For FreeBSD, we now use the pw(8) utility (which can only process one
user at a time)

Additionally, we abstract expire passwd into a function, and override it
in the FreeBSD distro class.

Co-Authored-By: Chad Smith <chad.smith@canonical.com>
---
 cloudinit/config/cc_set_passwords.py         | 21 ++++++++++----
 cloudinit/config/tests/test_set_passwords.py | 42 +++++++++++++++++++++++++++-
 cloudinit/distros/__init__.py                |  7 +++++
 cloudinit/distros/freebsd.py                 |  7 +++++
 tests/unittests/test_distros/test_generic.py | 18 ++++++++++++
 tools/build-on-freebsd                       |  1 -
 6 files changed, 89 insertions(+), 7 deletions(-)

(limited to 'cloudinit/config/cc_set_passwords.py')

diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
index 1379428d..c3c5b0ff 100755
--- a/cloudinit/config/cc_set_passwords.py
+++ b/cloudinit/config/cc_set_passwords.py
@@ -179,20 +179,21 @@ def handle(_name, cfg, cloud, log, args):
         for line in plist:
             u, p = line.split(':', 1)
             if prog.match(p) is not None and ":" not in p:
-                hashed_plist_in.append("%s:%s" % (u, p))
+                hashed_plist_in.append(line)
                 hashed_users.append(u)
             else:
+                # in this else branch, we potentially change the password
+                # hence, a deviation from .append(line)
                 if p == "R" or p == "RANDOM":
                     p = rand_user_password()
                     randlist.append("%s:%s" % (u, p))
                 plist_in.append("%s:%s" % (u, p))
                 users.append(u)
-
         ch_in = '\n'.join(plist_in) + '\n'
         if users:
             try:
                 log.debug("Changing password for %s:", users)
-                util.subp(['chpasswd'], ch_in)
+                chpasswd(cloud.distro, ch_in)
             except Exception as e:
                 errors.append(e)
                 util.logexc(
@@ -202,7 +203,7 @@ def handle(_name, cfg, cloud, log, args):
         if hashed_users:
             try:
                 log.debug("Setting hashed password for %s:", hashed_users)
-                util.subp(['chpasswd', '-e'], hashed_ch_in)
+                chpasswd(cloud.distro, hashed_ch_in, hashed=True)
             except Exception as e:
                 errors.append(e)
                 util.logexc(
@@ -218,7 +219,7 @@ def handle(_name, cfg, cloud, log, args):
             expired_users = []
             for u in users:
                 try:
-                    util.subp(['passwd', '--expire', u])
+                    cloud.distro.expire_passwd(u)
                     expired_users.append(u)
                 except Exception as e:
                     errors.append(e)
@@ -238,4 +239,14 @@ def handle(_name, cfg, cloud, log, args):
 def rand_user_password(pwlen=9):
     return util.rand_str(pwlen, select_from=PW_SET)
 
+
+def chpasswd(distro, plist_in, hashed=False):
+    if util.is_FreeBSD():
+        for pentry in plist_in.splitlines():
+            u, p = pentry.split(":")
+            distro.set_passwd(u, p, hashed=hashed)
+    else:
+        cmd = ['chpasswd'] + (['-e'] if hashed else [])
+        util.subp(cmd, plist_in)
+
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/tests/test_set_passwords.py b/cloudinit/config/tests/test_set_passwords.py
index a2ea5ec4..639fb9ea 100644
--- a/cloudinit/config/tests/test_set_passwords.py
+++ b/cloudinit/config/tests/test_set_passwords.py
@@ -74,7 +74,7 @@ class TestSetPasswordsHandle(CiTestCase):
 
     with_logs = True
 
-    def test_handle_on_empty_config(self):
+    def test_handle_on_empty_config(self, *args):
         """handle logs that no password has changed when config is empty."""
         cloud = self.tmp_cloud(distro='ubuntu')
         setpass.handle(
@@ -108,4 +108,44 @@ class TestSetPasswordsHandle(CiTestCase):
              '\n'.join(valid_hashed_pwds) + '\n')],
             m_subp.call_args_list)
 
+    @mock.patch(MODPATH + "util.is_FreeBSD")
+    @mock.patch(MODPATH + "util.subp")
+    def test_freebsd_calls_custom_pw_cmds_to_set_and_expire_passwords(
+            self, m_subp, m_is_freebsd):
+        """FreeBSD calls custom pw commands instead of chpasswd and passwd"""
+        m_is_freebsd.return_value = True
+        cloud = self.tmp_cloud(distro='freebsd')
+        valid_pwds = ['ubuntu:passw0rd']
+        cfg = {'chpasswd': {'list': valid_pwds}}
+        setpass.handle(
+            'IGNORED', cfg=cfg, cloud=cloud, log=self.logger, args=[])
+        self.assertEqual([
+            mock.call(['pw', 'usermod', 'ubuntu', '-h', '0'], data='passw0rd',
+                      logstring="chpasswd for ubuntu"),
+            mock.call(['pw', 'usermod', 'ubuntu', '-p', '01-Jan-1970'])],
+            m_subp.call_args_list)
+
+    @mock.patch(MODPATH + "util.is_FreeBSD")
+    @mock.patch(MODPATH + "util.subp")
+    def test_handle_on_chpasswd_list_creates_random_passwords(self, m_subp,
+                                                              m_is_freebsd):
+        """handle parses command set random passwords."""
+        m_is_freebsd.return_value = False
+        cloud = self.tmp_cloud(distro='ubuntu')
+        valid_random_pwds = [
+            'root:R',
+            'ubuntu:RANDOM']
+        cfg = {'chpasswd': {'expire': 'false', 'list': valid_random_pwds}}
+        with mock.patch(MODPATH + 'util.subp') as m_subp:
+            setpass.handle(
+                'IGNORED', cfg=cfg, cloud=cloud, log=self.logger, args=[])
+        self.assertIn(
+            'DEBUG: Handling input for chpasswd as list.',
+            self.logs.getvalue())
+        self.assertNotEqual(
+            [mock.call(['chpasswd'],
+             '\n'.join(valid_random_pwds) + '\n')],
+            m_subp.call_args_list)
+
+
 # vi: ts=4 expandtab
diff --git a/cloudinit/distros/__init__.py b/cloudinit/distros/__init__.py
index 00bdee3d..2ec79577 100644
--- a/cloudinit/distros/__init__.py
+++ b/cloudinit/distros/__init__.py
@@ -591,6 +591,13 @@ class Distro(object):
             util.logexc(LOG, 'Failed to disable password for user %s', name)
             raise e
 
+    def expire_passwd(self, user):
+        try:
+            util.subp(['passwd', '--expire', user])
+        except Exception as e:
+            util.logexc(LOG, "Failed to set 'expire' for %s", user)
+            raise e
+
     def set_passwd(self, user, passwd, hashed=False):
         pass_string = '%s:%s' % (user, passwd)
         cmd = ['chpasswd']
diff --git a/cloudinit/distros/freebsd.py b/cloudinit/distros/freebsd.py
index c55f8990..8e5ae96c 100644
--- a/cloudinit/distros/freebsd.py
+++ b/cloudinit/distros/freebsd.py
@@ -234,6 +234,13 @@ class Distro(distros.Distro):
         if passwd_val is not None:
             self.set_passwd(name, passwd_val, hashed=True)
 
+    def expire_passwd(self, user):
+        try:
+            util.subp(['pw', 'usermod', user, '-p', '01-Jan-1970'])
+        except Exception as e:
+            util.logexc(LOG, "Failed to set pw expiration for %s", user)
+            raise e
+
     def set_passwd(self, user, passwd, hashed=False):
         if hashed:
             hash_opt = "-H"
diff --git a/tests/unittests/test_distros/test_generic.py b/tests/unittests/test_distros/test_generic.py
index 791fe612..7e0da4f2 100644
--- a/tests/unittests/test_distros/test_generic.py
+++ b/tests/unittests/test_distros/test_generic.py
@@ -244,5 +244,23 @@ class TestGenericDistro(helpers.FilesystemMockingTestCase):
         with self.assertRaises(NotImplementedError):
             d.get_locale()
 
+    def test_expire_passwd_uses_chpasswd(self):
+        """Test ubuntu.expire_passwd uses the passwd command."""
+        for d_name in ("ubuntu", "rhel"):
+            cls = distros.fetch(d_name)
+            d = cls(d_name, {}, None)
+            with mock.patch("cloudinit.util.subp") as m_subp:
+                d.expire_passwd("myuser")
+            m_subp.assert_called_once_with(["passwd", "--expire", "myuser"])
+
+    def test_expire_passwd_freebsd_uses_pw_command(self):
+        """Test FreeBSD.expire_passwd uses the pw command."""
+        cls = distros.fetch("freebsd")
+        d = cls("freebsd", {}, None)
+        with mock.patch("cloudinit.util.subp") as m_subp:
+            d.expire_passwd("myuser")
+        m_subp.assert_called_once_with(
+            ["pw", "usermod", "myuser", "-p", "01-Jan-1970"])
+
 
 # vi: ts=4 expandtab
diff --git a/tools/build-on-freebsd b/tools/build-on-freebsd
index 8ae64567..876368a9 100755
--- a/tools/build-on-freebsd
+++ b/tools/build-on-freebsd
@@ -18,7 +18,6 @@ py_prefix=$(${PYTHON} -c 'import sys; print("py%d%d" % (sys.version_info.major,
 depschecked=/tmp/c-i.dependencieschecked
 pkgs="
     bash
-    chpasswd
     dmidecode
     e2fsprogs
     $py_prefix-Jinja2
-- 
cgit v1.2.3


From 8116493950e7c47af0ce66fc1bb5d799ce5e477a Mon Sep 17 00:00:00 2001
From: Daniel Watkins <oddbloke@ubuntu.com>
Date: Wed, 18 Dec 2019 16:22:02 -0500
Subject: cloud-init: fix capitalisation of SSH (#126)

* cc_ssh: fix capitalisation of SSH

* doc: fix capitalisation of SSH

* cc_keys_to_console: fix capitalisation of SSH

* ssh_util: fix capitalisation of SSH

* DataSourceIBMCloud: fix capitalisation of SSH

* DataSourceAzure: fix capitalisation of SSH

* cs_utils: fix capitalisation of SSH

* distros/__init__: fix capitalisation of SSH

* cc_set_passwords: fix capitalisation of SSH

* cc_ssh_import_id: fix capitalisation of SSH

* cc_users_groups: fix capitalisation of SSH

* cc_ssh_authkey_fingerprints: fix capitalisation of SSH
---
 cloudinit/config/cc_keys_to_console.py            |  6 +++---
 cloudinit/config/cc_set_passwords.py              |  6 +++---
 cloudinit/config/cc_ssh.py                        | 12 ++++++------
 cloudinit/config/cc_ssh_authkey_fingerprints.py   |  6 +++---
 cloudinit/config/cc_ssh_import_id.py              |  8 ++++----
 cloudinit/config/cc_users_groups.py               |  6 +++---
 cloudinit/config/tests/test_set_passwords.py      |  4 ++--
 cloudinit/cs_utils.py                             |  2 +-
 cloudinit/distros/__init__.py                     |  4 ++--
 cloudinit/sources/DataSourceAzure.py              |  6 +++---
 cloudinit/sources/DataSourceIBMCloud.py           |  2 +-
 cloudinit/ssh_util.py                             |  8 ++++----
 doc/examples/cloud-config-ssh-keys.txt            |  4 +---
 doc/rtd/topics/datasources.rst                    |  2 +-
 doc/rtd/topics/datasources/cloudstack.rst         |  2 +-
 doc/rtd/topics/examples.rst                       |  2 +-
 doc/rtd/topics/format.rst                         |  2 +-
 doc/rtd/topics/instancedata.rst                   |  2 +-
 tests/unittests/test_distros/test_create_users.py |  2 +-
 19 files changed, 42 insertions(+), 44 deletions(-)

(limited to 'cloudinit/config/cc_set_passwords.py')

diff --git a/cloudinit/config/cc_keys_to_console.py b/cloudinit/config/cc_keys_to_console.py
index 8f8735ce..3d2ded3d 100644
--- a/cloudinit/config/cc_keys_to_console.py
+++ b/cloudinit/config/cc_keys_to_console.py
@@ -9,10 +9,10 @@
 """
 Keys to Console
 ---------------
-**Summary:** control which ssh keys may be written to console
+**Summary:** control which SSH keys may be written to console
 
-For security reasons it may be desirable not to write ssh fingerprints and keys
-to the console. To avoid the fingerprint of types of ssh keys being written to
+For security reasons it may be desirable not to write SSH fingerprints and keys
+to the console. To avoid the fingerprint of types of SSH keys being written to
 console the ``ssh_fp_console_blacklist`` config key can be used. By default all
 types of keys will have their fingerprints written to console. To avoid keys
 of a key type being written to console the ``ssh_key_console_blacklist`` config
diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
index c3c5b0ff..e3b39d8b 100755
--- a/cloudinit/config/cc_set_passwords.py
+++ b/cloudinit/config/cc_set_passwords.py
@@ -112,7 +112,7 @@ def handle_ssh_pwauth(pw_auth, service_cmd=None, service_name="ssh"):
     elif util.is_false(pw_auth):
         cfg_val = 'no'
     else:
-        bmsg = "Leaving ssh config '%s' unchanged." % cfg_name
+        bmsg = "Leaving SSH config '%s' unchanged." % cfg_name
         if pw_auth is None or pw_auth.lower() == 'unchanged':
             LOG.debug("%s ssh_pwauth=%s", bmsg, pw_auth)
         else:
@@ -121,7 +121,7 @@ def handle_ssh_pwauth(pw_auth, service_cmd=None, service_name="ssh"):
 
     updated = update_ssh_config({cfg_name: cfg_val})
     if not updated:
-        LOG.debug("No need to restart ssh service, %s not updated.", cfg_name)
+        LOG.debug("No need to restart SSH service, %s not updated.", cfg_name)
         return
 
     if 'systemctl' in service_cmd:
@@ -129,7 +129,7 @@ def handle_ssh_pwauth(pw_auth, service_cmd=None, service_name="ssh"):
     else:
         cmd = list(service_cmd) + [service_name, "restart"]
     util.subp(cmd)
-    LOG.debug("Restarted the ssh daemon.")
+    LOG.debug("Restarted the SSH daemon.")
 
 
 def handle(_name, cfg, cloud, log, args):
diff --git a/cloudinit/config/cc_ssh.py b/cloudinit/config/cc_ssh.py
index bb26fb2b..163cce99 100755
--- a/cloudinit/config/cc_ssh.py
+++ b/cloudinit/config/cc_ssh.py
@@ -9,9 +9,9 @@
 """
 SSH
 ---
-**Summary:** configure ssh and ssh keys (host and authorized)
+**Summary:** configure SSH and SSH keys (host and authorized)
 
-This module handles most configuration for ssh and both host and authorized ssh
+This module handles most configuration for SSH and both host and authorized SSH
 keys.
 
 Authorized Keys
@@ -24,7 +24,7 @@ account's home directory. Authorized keys for the default user defined in
 should be specified as a list of public keys.
 
 .. note::
-    see the ``cc_set_passwords`` module documentation to enable/disable ssh
+    see the ``cc_set_passwords`` module documentation to enable/disable SSH
     password authentication
 
 Root login can be enabled/disabled using the ``disable_root`` config key. Root
@@ -39,7 +39,7 @@ Host Keys
 ^^^^^^^^^
 
 Host keys are for authenticating a specific instance. Many images have default
-host ssh keys, which can be removed using ``ssh_deletekeys``. This prevents
+host SSH keys, which can be removed using ``ssh_deletekeys``. This prevents
 re-use of a private host key from an image on multiple machines. Since
 removing default host keys is usually the desired behavior this option is
 enabled by default.
@@ -225,7 +225,7 @@ def handle(_name, cfg, cloud, log, _args):
         if util.get_cfg_option_bool(cfg, 'allow_public_ssh_keys', True):
             keys = cloud.get_public_ssh_keys() or []
         else:
-            log.debug('Skipping import of publish ssh keys per '
+            log.debug('Skipping import of publish SSH keys per '
                       'config setting: allow_public_ssh_keys=False')
 
         if "ssh_authorized_keys" in cfg:
@@ -234,7 +234,7 @@ def handle(_name, cfg, cloud, log, _args):
 
         apply_credentials(keys, user, disable_root, disable_root_opts)
     except Exception:
-        util.logexc(log, "Applying ssh credentials failed!")
+        util.logexc(log, "Applying SSH credentials failed!")
 
 
 def apply_credentials(keys, user, disable_root, disable_root_opts):
diff --git a/cloudinit/config/cc_ssh_authkey_fingerprints.py b/cloudinit/config/cc_ssh_authkey_fingerprints.py
index 98b0e665..dcf86fdc 100755
--- a/cloudinit/config/cc_ssh_authkey_fingerprints.py
+++ b/cloudinit/config/cc_ssh_authkey_fingerprints.py
@@ -7,7 +7,7 @@
 """
 SSH Authkey Fingerprints
 ------------------------
-**Summary:** log fingerprints of user ssh keys
+**Summary:** log fingerprints of user SSH keys
 
 Write fingerprints of authorized keys for each user to log. This is enabled by
 default, but can be disabled using ``no_ssh_fingerprints``. The hash type for
@@ -68,7 +68,7 @@ def _is_printable_key(entry):
 def _pprint_key_entries(user, key_fn, key_entries, hash_meth='md5',
                         prefix='ci-info: '):
     if not key_entries:
-        message = ("%sno authorized ssh keys fingerprints found for user %s.\n"
+        message = ("%sno authorized SSH keys fingerprints found for user %s.\n"
                    % (prefix, user))
         util.multi_log(message)
         return
@@ -98,7 +98,7 @@ def _pprint_key_entries(user, key_fn, key_entries, hash_meth='md5',
 def handle(name, cfg, cloud, log, _args):
     if util.is_true(cfg.get('no_ssh_fingerprints', False)):
         log.debug(("Skipping module named %s, "
-                   "logging of ssh fingerprints disabled"), name)
+                   "logging of SSH fingerprints disabled"), name)
         return
 
     hash_meth = util.get_cfg_option_str(cfg, "authkey_hash", "md5")
diff --git a/cloudinit/config/cc_ssh_import_id.py b/cloudinit/config/cc_ssh_import_id.py
index 6b46dafe..63f87298 100755
--- a/cloudinit/config/cc_ssh_import_id.py
+++ b/cloudinit/config/cc_ssh_import_id.py
@@ -9,9 +9,9 @@
 """
 SSH Import Id
 -------------
-**Summary:** import ssh id
+**Summary:** import SSH id
 
-This module imports ssh keys from either a public keyserver, usually launchpad
+This module imports SSH keys from either a public keyserver, usually launchpad
 or github using ``ssh-import-id``. Keys are referenced by the username they are
 associated with on the keyserver. The keyserver can be specified by prepending
 either ``lp:`` for launchpad or ``gh:`` for github to the username.
@@ -98,12 +98,12 @@ def import_ssh_ids(ids, user, log):
         raise exc
 
     cmd = ["sudo", "-Hu", user, "ssh-import-id"] + ids
-    log.debug("Importing ssh ids for user %s.", user)
+    log.debug("Importing SSH ids for user %s.", user)
 
     try:
         util.subp(cmd, capture=False)
     except util.ProcessExecutionError as exc:
-        util.logexc(log, "Failed to run command to import %s ssh ids", user)
+        util.logexc(log, "Failed to run command to import %s SSH ids", user)
         raise exc
 
 # vi: ts=4 expandtab
diff --git a/cloudinit/config/cc_users_groups.py b/cloudinit/config/cc_users_groups.py
index c32a743a..13764e60 100644
--- a/cloudinit/config/cc_users_groups.py
+++ b/cloudinit/config/cc_users_groups.py
@@ -51,14 +51,14 @@ config keys for an entry in ``users`` are as follows:
       a Snappy user through ``snap create-user``. If an Ubuntu SSO account is
       associated with the address, username and SSH keys will be requested from
       there. Default: none
-    - ``ssh_authorized_keys``: Optional. List of ssh keys to add to user's
+    - ``ssh_authorized_keys``: Optional. List of SSH keys to add to user's
       authkeys file. Default: none. This key can not be combined with
       ``ssh_redirect_user``.
     - ``ssh_import_id``: Optional. SSH id to import for user. Default: none.
       This key can not be combined with ``ssh_redirect_user``.
     - ``ssh_redirect_user``: Optional. Boolean set to true to disable SSH
-      logins for this user. When specified, all cloud meta-data public ssh
-      keys will be set up in a disabled state for this username. Any ssh login
+      logins for this user. When specified, all cloud meta-data public SSH
+      keys will be set up in a disabled state for this username. Any SSH login
       as this username will timeout and prompt with a message to login instead
       as the configured <default_username> for this instance. Default: false.
       This key can not be combined with ``ssh_import_id`` or
diff --git a/cloudinit/config/tests/test_set_passwords.py b/cloudinit/config/tests/test_set_passwords.py
index 639fb9ea..85e2f1fe 100644
--- a/cloudinit/config/tests/test_set_passwords.py
+++ b/cloudinit/config/tests/test_set_passwords.py
@@ -45,7 +45,7 @@ class TestHandleSshPwauth(CiTestCase):
         """If config is not updated, then no system restart should be done."""
         setpass.handle_ssh_pwauth(True)
         m_subp.assert_not_called()
-        self.assertIn("No need to restart ssh", self.logs.getvalue())
+        self.assertIn("No need to restart SSH", self.logs.getvalue())
 
     @mock.patch(MODPATH + "update_ssh_config", return_value=True)
     @mock.patch(MODPATH + "util.subp")
@@ -80,7 +80,7 @@ class TestSetPasswordsHandle(CiTestCase):
         setpass.handle(
             'IGNORED', cfg={}, cloud=cloud, log=self.logger, args=[])
         self.assertEqual(
-            "DEBUG: Leaving ssh config 'PasswordAuthentication' unchanged. "
+            "DEBUG: Leaving SSH config 'PasswordAuthentication' unchanged. "
             'ssh_pwauth=None\n',
             self.logs.getvalue())
 
diff --git a/cloudinit/cs_utils.py b/cloudinit/cs_utils.py
index 51c09582..8bac9c44 100644
--- a/cloudinit/cs_utils.py
+++ b/cloudinit/cs_utils.py
@@ -14,7 +14,7 @@ Having the server definition accessible by the VM can ve useful in various
 ways. For example it is possible to easily determine from within the VM,
 which network interfaces are connected to public and which to private network.
 Another use is to pass some data to initial VM setup scripts, like setting the
-hostname to the VM name or passing ssh public keys through server meta.
+hostname to the VM name or passing SSH public keys through server meta.
 
 For more information take a look at the Server Context section of CloudSigma
 API Docs: http://cloudsigma-docs.readthedocs.org/en/latest/server_context.html
diff --git a/cloudinit/distros/__init__.py b/cloudinit/distros/__init__.py
index 2b559fe6..6d69e6ca 100755
--- a/cloudinit/distros/__init__.py
+++ b/cloudinit/distros/__init__.py
@@ -385,7 +385,7 @@ class Distro(object):
         Add a user to the system using standard GNU tools
         """
         # XXX need to make add_user idempotent somehow as we
-        # still want to add groups or modify ssh keys on pre-existing
+        # still want to add groups or modify SSH keys on pre-existing
         # users in the image.
         if util.is_user(name):
             LOG.info("User %s already exists, skipping.", name)
@@ -561,7 +561,7 @@ class Distro(object):
             cloud_keys = kwargs.get('cloud_public_ssh_keys', [])
             if not cloud_keys:
                 LOG.warning(
-                    'Unable to disable ssh logins for %s given'
+                    'Unable to disable SSH logins for %s given'
                     ' ssh_redirect_user: %s. No cloud public-keys present.',
                     name, kwargs['ssh_redirect_user'])
             else:
diff --git a/cloudinit/sources/DataSourceAzure.py b/cloudinit/sources/DataSourceAzure.py
index 24f448c5..61ec522a 100755
--- a/cloudinit/sources/DataSourceAzure.py
+++ b/cloudinit/sources/DataSourceAzure.py
@@ -355,16 +355,16 @@ class DataSourceAzure(sources.DataSource):
         for pk in self.cfg.get('_pubkeys', []):
             if pk.get('value', None):
                 key_value = pk['value']
-                LOG.debug("ssh authentication: using value from fabric")
+                LOG.debug("SSH authentication: using value from fabric")
             else:
                 bname = str(pk['fingerprint'] + ".crt")
                 fp_files += [os.path.join(ddir, bname)]
-                LOG.debug("ssh authentication: "
+                LOG.debug("SSH authentication: "
                           "using fingerprint from fabric")
 
         with events.ReportEventStack(
                 name="waiting-for-ssh-public-key",
-                description="wait for agents to retrieve ssh keys",
+                description="wait for agents to retrieve SSH keys",
                 parent=azure_ds_reporter):
             # wait very long for public SSH keys to arrive
             # https://bugs.launchpad.net/cloud-init/+bug/1717611
diff --git a/cloudinit/sources/DataSourceIBMCloud.py b/cloudinit/sources/DataSourceIBMCloud.py
index 21e6ae6b..e0c714e8 100644
--- a/cloudinit/sources/DataSourceIBMCloud.py
+++ b/cloudinit/sources/DataSourceIBMCloud.py
@@ -83,7 +83,7 @@ creates 6 boot scenarios.
 
     There is no information available to identify this scenario.
 
-    The user will be able to ssh in as as root with their public keys that
+    The user will be able to SSH in as as root with their public keys that
     have been installed into /root/ssh/.authorized_keys
     during the provisioning stage.
 
diff --git a/cloudinit/ssh_util.py b/cloudinit/ssh_util.py
index bcb23a5a..c3a9b5b7 100644
--- a/cloudinit/ssh_util.py
+++ b/cloudinit/ssh_util.py
@@ -17,7 +17,7 @@ LOG = logging.getLogger(__name__)
 # See: man sshd_config
 DEF_SSHD_CFG = "/etc/ssh/sshd_config"
 
-# taken from openssh source openssh-7.3p1/sshkey.c:
+# taken from OpenSSH source openssh-7.3p1/sshkey.c:
 # static const struct keytype keytypes[] = { ... }
 VALID_KEY_TYPES = (
     "dsa",
@@ -207,7 +207,7 @@ def update_authorized_keys(old_entries, keys):
 def users_ssh_info(username):
     pw_ent = pwd.getpwnam(username)
     if not pw_ent or not pw_ent.pw_dir:
-        raise RuntimeError("Unable to get ssh info for user %r" % (username))
+        raise RuntimeError("Unable to get SSH info for user %r" % (username))
     return (os.path.join(pw_ent.pw_dir, '.ssh'), pw_ent)
 
 
@@ -245,7 +245,7 @@ def extract_authorized_keys(username, sshd_cfg_file=DEF_SSHD_CFG):
         except (IOError, OSError):
             # Give up and use a default key filename
             auth_key_fns[0] = default_authorizedkeys_file
-            util.logexc(LOG, "Failed extracting 'AuthorizedKeysFile' in ssh "
+            util.logexc(LOG, "Failed extracting 'AuthorizedKeysFile' in SSH "
                         "config from %r, using 'AuthorizedKeysFile' file "
                         "%r instead", DEF_SSHD_CFG, auth_key_fns[0])
 
@@ -349,7 +349,7 @@ def update_ssh_config(updates, fname=DEF_SSHD_CFG):
 
 
 def update_ssh_config_lines(lines, updates):
-    """Update the ssh config lines per updates.
+    """Update the SSH config lines per updates.
 
     @param lines: array of SshdConfigLine.  This array is updated in place.
     @param updates: dictionary of desired values {Option: value}
diff --git a/doc/examples/cloud-config-ssh-keys.txt b/doc/examples/cloud-config-ssh-keys.txt
index 235a114f..aad8b683 100644
--- a/doc/examples/cloud-config-ssh-keys.txt
+++ b/doc/examples/cloud-config-ssh-keys.txt
@@ -6,7 +6,7 @@ ssh_authorized_keys:
   - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEA3FSyQwBI6Z+nCSjUUk8EEAnnkhXlukKoUPND/RRClWz2s5TCzIkd3Ou5+Cyz71X0XmazM3l5WgeErvtIwQMyT1KjNoMhoJMrJnWqQPOt5Q8zWd9qG7PBl9+eiH5qV7NZ mykey@host
   - ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3I7VUf2l5gSn5uavROsc5HRDpZdQueUq5ozemNSj8T7enqKHOEaFoU2VoPgGEWC9RyzSQVeyD6s7APMcE82EtmW4skVEgEGSbDc1pvxzxtchBj78hJP6Cf5TCMFSXw+Fz5rF1dR23QDbN1mkHs7adr8GW4kSWqU7Q7NDwfIrJJtO7Hi42GyXtvEONHbiRPOe8stqUly7MvUoN+5kfjBM8Qqpfl2+FNhTYWpMfYdPUnE7u536WqzFmsaqJctz3gBxH9Ex7dFtrxR4qiqEr9Qtlu3xGn7Bw07/+i1D+ey3ONkZLN+LQ714cgj8fRS4Hj29SCmXp5Kt5/82cD/VN3NtHw== smoser@brickies
 
-# Send pre-generated ssh private keys to the server
+# Send pre-generated SSH private keys to the server
 # If these are present, they will be written to /etc/ssh and
 # new random keys will not be generated
 #  in addition to 'rsa' and 'dsa' as shown below, 'ecdsa' is also supported
@@ -42,5 +42,3 @@ ssh_keys:
     -----END DSA PRIVATE KEY-----
 
   dsa_public: ssh-dss AAAAB3NzaC1kc3MAAACBAM/Ycu7ulMTEvz1RLIzTbrhELJZf8Iwua6TFfQl1ubb1rHwUElOkus7xMhdVjms8AmbV1Meem7ImE69T0bszy09QAG3NImHgZVIeXBoJ/JzByku/1NcOBYilKP7oSIcLJpGUHX8IGn1GJoH7XRBwVub6Vqm4RP78C7q9IOn0hG2VAAAAFQCDEfCrnL1GGzhCPsr/uS1vbt8/wQAAAIEAjSrok/4m8mbBkVp4IwxXFdRuqJKSj8/WWxos00Ednn/ww5QibysHYULrOKJ1+54mmpMyp5CZICUQELCfCt5ScZ9GsqgmnI80Q1h3Xkwbo3kn7PzWwRwcV6muvJn4PcZ71WM+rdN/c2EorAINDTbjRo97NueM94WbiYdtjHFxn0YAAACAXmLIFSQgiAPu459rCKxT46tHJtM0QfnNiEnQLbFluefZ/yiI4DI38UzTCOXLhUA7ybmZha+D/csj15Y9/BNFuO7unzVhikCQV9DTeXX46pG4s1o23JKC/QaYWNMZ7kTRv+wWow9MhGiVdML4ZN4XnifuO5krqAybngIy66PMEoQ= smoser@localhost
-
-
diff --git a/doc/rtd/topics/datasources.rst b/doc/rtd/topics/datasources.rst
index 0b3a385e..3d026143 100644
--- a/doc/rtd/topics/datasources.rst
+++ b/doc/rtd/topics/datasources.rst
@@ -140,7 +140,7 @@ The current interface that a datasource object must provide is the following:
     # because cloud-config content would be handled elsewhere
     def get_config_obj(self)
 
-    #returns a list of public ssh keys
+    # returns a list of public SSH keys
     def get_public_ssh_keys(self)
 
     # translates a device 'short' name into the actual physical device
diff --git a/doc/rtd/topics/datasources/cloudstack.rst b/doc/rtd/topics/datasources/cloudstack.rst
index 95b95874..da183226 100644
--- a/doc/rtd/topics/datasources/cloudstack.rst
+++ b/doc/rtd/topics/datasources/cloudstack.rst
@@ -4,7 +4,7 @@ CloudStack
 ==========
 
 `Apache CloudStack`_ expose user-data, meta-data, user password and account
-sshkey thru the Virtual-Router. The datasource obtains the VR address via
+SSH key thru the Virtual-Router. The datasource obtains the VR address via
 dhcp lease information given to the instance.
 For more details on meta-data and user-data,
 refer the `CloudStack Administrator Guide`_.
diff --git a/doc/rtd/topics/examples.rst b/doc/rtd/topics/examples.rst
index 94e6ed18..81860f85 100644
--- a/doc/rtd/topics/examples.rst
+++ b/doc/rtd/topics/examples.rst
@@ -128,7 +128,7 @@ Reboot/poweroff when finished
    :language: yaml
    :linenos:
 
-Configure instances ssh-keys
+Configure instances SSH keys
 ============================
 
 .. literalinclude:: ../../examples/cloud-config-ssh-keys.txt
diff --git a/doc/rtd/topics/format.rst b/doc/rtd/topics/format.rst
index a6e9b44e..2b60bdd3 100644
--- a/doc/rtd/topics/format.rst
+++ b/doc/rtd/topics/format.rst
@@ -113,7 +113,7 @@ These things include:
 - apt upgrade should be run on first boot
 - a different apt mirror should be used
 - additional apt sources should be added
-- certain ssh keys should be imported
+- certain SSH keys should be imported
 - *and many more...*
 
 .. note::
diff --git a/doc/rtd/topics/instancedata.rst b/doc/rtd/topics/instancedata.rst
index c17d0a0e..e7dd0d62 100644
--- a/doc/rtd/topics/instancedata.rst
+++ b/doc/rtd/topics/instancedata.rst
@@ -165,7 +165,7 @@ Examples output:
 
 v1.public_ssh_keys
 ------------------
-A list of ssh keys provided to the instance by the datasource metadata.
+A list of SSH keys provided to the instance by the datasource metadata.
 
 Examples output:
 
diff --git a/tests/unittests/test_distros/test_create_users.py b/tests/unittests/test_distros/test_create_users.py
index 40624952..ef11784d 100644
--- a/tests/unittests/test_distros/test_create_users.py
+++ b/tests/unittests/test_distros/test_create_users.py
@@ -206,7 +206,7 @@ class TestCreateUser(CiTestCase):
         user = 'foouser'
         self.dist.create_user(user, ssh_redirect_user='someuser')
         self.assertIn(
-            'WARNING: Unable to disable ssh logins for foouser given '
+            'WARNING: Unable to disable SSH logins for foouser given '
             'ssh_redirect_user: someuser. No cloud public-keys present.\n',
             self.logs.getvalue())
         m_setup_user_keys.assert_not_called()
-- 
cgit v1.2.3


From 42788bf24a1a0a5421a2d00a7f59b59e38ba1a14 Mon Sep 17 00:00:00 2001
From: Ryan Harper <ryan.harper@canonical.com>
Date: Fri, 24 Jan 2020 21:33:12 +0200
Subject: cc_set_password: increase random pwlength from 9 to 20 (#189)

Increasing the bits of security from 52 to 115.

LP: #1860795
---
 cloudinit/config/cc_set_passwords.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'cloudinit/config/cc_set_passwords.py')

diff --git a/cloudinit/config/cc_set_passwords.py b/cloudinit/config/cc_set_passwords.py
index e3b39d8b..4943d545 100755
--- a/cloudinit/config/cc_set_passwords.py
+++ b/cloudinit/config/cc_set_passwords.py
@@ -236,7 +236,7 @@ def handle(_name, cfg, cloud, log, args):
         raise errors[-1]
 
 
-def rand_user_password(pwlen=9):
+def rand_user_password(pwlen=20):
     return util.rand_str(pwlen, select_from=PW_SET)
 
 
-- 
cgit v1.2.3