Fix a bug in ChagePassword task

[snf-image] / snf-image-helper / tasks / 50ChangePassword.in

diff --git a/snf-image-helper/tasks/50ChangePassword.in b/snf-image-helper/tasks/50ChangePassword.in
index 06cd3b9..5d01667 100644 (file)
--- a/snf-image-helper/tasks/50ChangePassword.in
+++ b/snf-image-helper/tasks/50ChangePassword.in
@@ -19,7 +19,7 @@
 
 ### BEGIN TASK INFO
 # Provides:            ChangePassword
-# RunBefore:            UmountImage
+# RunBefore:            EnforcePersonality
 # RunAfter:            InstallUnattend
 # Short-Description:   Changes Password for specified users
 ### END TASK INFO
@@ -27,16 +27,56 @@
 set -e
 . "@commondir@/common.sh"
 
+trap task_cleanup EXIT
+report_task_start
+
 # Check if the task should be prevented from running.
 check_if_excluded
 
+linux_shadow="/etc/shadow"
+freebsd_shadow="/etc/master.passwd"
+openbsd_shadow="/etc/master.passwd"
+netbsd_shadow="/etc/master.passwd"
+
+linux_change_shadow_entry() {
+    local line encrypted
+    line="$1"
+    encrypted="$2"
+
+    IFS=":" read -a entry <<< "$line"
+
+    echo "${entry[0]}:$encrypted:15103:0:99999:7:::"
+}
+
+freebsd_change_shadow_entry() {
+    local line encrypted
+    line="$1"
+    encrypted="$2"
+
+    IFS=":" read -a entry <<< "$line"
+
+    echo "${entry[0]}:$encrypted:${entry[2]}:${entry[3]}:${entry[4]}:${entry[5]}:0:${entry[7]}:${entry[8]}:${entry[9]}"
+}
+
+openbsd_change_shadow_entry() {
+    freebsd_change_shadow_entry "$@"
+}
+
+netbsd_change_shadow_entry() {
+    freebsd_change_shadow_entry "$@"
+}
+
 windows_password() {
-    local target="$1"
-    local password="$2"
+    local target password
+    target="$1"
+    password="$2"
 
     echo "@echo off" > "$target/Windows/SnfScripts/ChangeAdminPassword.cmd"
 
     if [ -z "$SNF_IMAGE_PROPERTY_USERS" ]; then
+        warn "Image property \`USERS' is missing or empty. " \
+            "Changing the password for default user: \`Administrator'."
+
         SNF_IMAGE_PROPERTY_USERS="Administrator"
     fi
 
@@ -48,41 +88,63 @@ windows_password() {
     done
 }
 
-linux_password() {
-    local target="$1"
-    local password="$2"
+unix_password() {
+    local flavor target password encrypted users tmp_shadow method default_method
+    flavor="$1"
+    target="$2"
+    password="$3"
 
-    local hash=$("@scriptsdir@/snf-passtohash.py" "$password")
-    if [ ! -e "$target/etc/shadow" ]; then
-       log_error "No /etc/shadow found!" 
+    shadow="${flavor}_shadow"
+    if [ ! -e "$target${!shadow}" ]; then
+       log_error "No ${!shadow} found!"
     fi
-    
-    declare -a users
+
+    case "$flavor" in
+        linux|freebsd)
+            default_method=sha512
+            ;;
+        openbsd)
+            default_method=blowfish
+            ;;
+        netbsd)
+            default_method=sha1
+            ;;
+        *)
+            log_error "Unknown unix flavor: \`$flavor'"
+            ;;
+    esac
+
+    method="${SNF_IMAGE_PROPERTY_PASSWORD_HASHING_METHOD:-$default_method}"
+    echo -n "Encrypting password with \`$method' method ... "
+    encrypted=$("@scriptsdir@/snf-passtohash.py" -m "$method" "$password")
+    echo "done"
+
+    users=()
     
     if [ -n "$SNF_IMAGE_PROPERTY_USERS" ]; then
         for usr in $SNF_IMAGE_PROPERTY_USERS; do
             users+=("$usr")
         done
     else
+        warn "Image property \`USERS' is missing or empty. " \
+            "Changing the password for default user: \`root'."
         users+=("root")
-
-        local distro=$(get_distro $target)
-
-        if [ "x$distro" = "xubuntu" -o \
-             "x$distro" = "xfedora" ] ; then
-            users+=("user")
-        fi
     fi
 
     for i in $(seq 0 1 $((${#users[@]}-1))); do
-        local tmp_shadow="$(mktemp)"
+        tmp_shadow="$(mktemp)"
         add_cleanup rm "$tmp_shadow"
 
-        echo -n "Setting ${users[$i]} password..."
-    
-        echo "${users[$i]}:$hash:15103:0:99999:7:::" > "$tmp_shadow"
-        grep -v "${users[$i]}" "$target/etc/shadow" >> "$tmp_shadow"
-        cat "$tmp_shadow" > "$target/etc/shadow"
+        echo -n "Setting ${users[$i]} password ... "
+        entry=$(grep "^${users[$i]}:" "$target${!shadow}")
+        if [ -z "$entry" ]; then
+            log_error "User: \`${users[$i]}' does not exist."
+        fi
+
+        new_entry="$(${flavor}_change_shadow_entry "$entry" "$encrypted")"
+        grep -v "^${users[$i]}:" "$target${!shadow}" > "$tmp_shadow"
+        echo "$new_entry" >> "$tmp_shadow"
+        cat "$tmp_shadow" > "$target${!shadow}"
         echo "done"
     done
 }
@@ -100,8 +162,46 @@ SNF_IMAGE_PROPERTY_USERS=$(echo $SNF_IMAGE_PROPERTY_USERS)
 
 if [ "$SNF_IMAGE_PROPERTY_OSFAMILY" = "windows" ]; then
     windows_password "$SNF_IMAGE_TARGET" "$SNF_IMAGE_PASSWORD"
-elif [ "$SNF_IMAGE_PROPERTY_OSFAMILY" = "linux" ]; then
-    linux_password "$SNF_IMAGE_TARGET" "$SNF_IMAGE_PASSWORD"
+else
+    unix_password "$SNF_IMAGE_PROPERTY_OSFAMILY" "$SNF_IMAGE_TARGET" "$SNF_IMAGE_PASSWORD"
+fi
+
+# For FreeBSD, OpenBSD and NetBSD we need to recreate the password databases too
+if [[ "$SNF_IMAGE_PROPERTY_OSFAMILY" == *bsd ]]; then
+    rm -f "$SNF_IMAGE_TARGET/etc/spwd.db"
+
+    # NetBSD is very strict about the existence & non-existence of the db files
+    if [ "$SNF_IMAGE_PROPERTY_OSFAMILY" = "netbsd" ]; then
+        rm -f "$SNF_IMAGE_TARGET/etc/pwd.db.tmp"
+        rm -f "$SNF_IMAGE_TARGET/etc/spwd.db.tmp"
+
+        touch "$SNF_IMAGE_TARGET/etc/spwd.db"
+    fi
+
+
+    # Make sure /etc/spwd.db is recreated on first boot
+    rc_local=$(cat <<EOF
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin
+export PATH
+
+pwd_mkdb -p /etc/master.passwd
+EOF
+)
+    if [ -e "$SNF_IMAGE_TARGET/etc/rc.local" ]; then
+        orig_local="/etc/rc.local.snf_image_$RANDOM"
+        mv "$SNF_IMAGE_TARGET/etc/rc.local" "$SNF_IMAGE_TARGET$orig_local"
+        cat > "$SNF_IMAGE_TARGET/etc/rc.local" <<EOF
+$rc_local
+mv $orig_local /etc/rc.local
+. /etc/rc.local
+EOF
+    else
+        cat > "$SNF_IMAGE_TARGET/etc/rc.local" <<EOF
+$rc_local
+rm -f /etc/rc.local
+exit 0
+EOF
+    fi
 fi
 
 exit 0