Skip to content

Commit 372aa8f

Browse files
committed
Use usermod(8) on OpenBSD to unbreak password management
f1e77c2 "(PUP-3634) Hide password hash from process list for useradd" introduced `chpasswd -e` which does not exist on OpenBSD, thus `user` resources managing `password` would always fail: ``` Notice: Compiled catalog for atar in environment production in 0.02 seconds rror: Could not set password on user[test]: No command chpasswd defined for provider openbsd Error: /Stage[main]/Main/User[test]/password: change from [redacted] to [redacted] failed: Could not set password on user[test]: No command chpasswd defined for provider openbsd Notice: Applied catalog in 0.01 seconds ``` Use https://man.openbsd.org/usermod.8#p instead: ``` Notice: Compiled catalog for atar in environment production in 0.01 seconds Notice: /Stage[main]/Main/User[test]/password: changed [redacted] to [redacted] Notice: Applied catalog in 0.21 seconds ``` `password` values now do show up briefly in the process list, but given they must be encrypted in order to work, this does not seem critical.
1 parent 9336df1 commit 372aa8f

File tree

1 file changed

+15
-0
lines changed

1 file changed

+15
-0
lines changed

lib/puppet/provider/user/openbsd.rb

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,4 +76,19 @@ def modifycmd(param, value)
7676
end
7777
cmd
7878
end
79+
80+
def password=(value)
81+
user = @resource.name
82+
begin
83+
cmd = [command(:modify), '-p', value, user]
84+
execute_options = {
85+
:failonfail => true,
86+
:combine => true,
87+
:sensitive => has_sensitive_data?
88+
}
89+
execute(cmd, execute_options)
90+
rescue => detail
91+
raise Puppet::Error, "Could not set password on #{@resource.class.name}[#{@resource.name}]: #{detail}", detail.backtrace
92+
end
93+
end
7994
end

0 commit comments

Comments
 (0)