User story #3435: Password not optional in "User management" technique - Rudder - Issue Tracker

Actions

Copy link

User story #3435

closed

Password not optional in "User management" technique

Added by Dennis Cabooter over 11 years ago. Updated almost 10 years ago.

Status:

Rejected

Priority:

Assignee:

Benoît PECCATTE

Category:

Techniques

Target version:

2.10.11

Pull Request:

UX impact:

Suggestion strength:

User visibility:

Effort required:

Name check:

Fix check:

Regression:

Description

Cfengine tries to set a new line as password, when password is not set in the "User management" technique:

 !! Finished command related to promiser "/bin/echo -e "\n" | /usr/bin/passwd foo" -- an error occurred (returned 10)
Q: ".../bin/echo -e "\": Enter new UNIX password: Retype new UNIX password: passwd: Authentication token manipulation error
 !! Finished command related to promiser "/bin/echo -e "\n" | /usr/bin/passwd bar" -- an error occurred (returned 10)
Q: ".../bin/echo -e "\": Enter new UNIX password: Retype new UNIX password: passwd: Authentication token manipulation error

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Nicolas PERRON over 11 years ago

Target version changed from 2.5.2 to 2.5.3

Actions

Copy link

Updated by Vincent MEMBRÉ over 11 years ago

Category set to Techniques
Status changed from New to 8
Assignee set to Jonathan CLARKE

We should probably add a way to add user without password.

I see two ways to handle this:

Add a checkbox to create a user without password.
The form should not be validated if the field is empty and the checkbox is unchecked

Handle the empty case of that field to create a user with an empty password.

Actions

Copy link

Updated by Jonathan CLARKE over 11 years ago

Assignee changed from Jonathan CLARKE to Dennis Cabooter

This brings up the interesting question of what the intent is here. When you define a Directive to create a user without a password, does this mean:
a) Create the user with an empty password, so just typing in the login name lets you log in
b) Create the user but without a password, so that he can't login
c) Something else?

Dennis, what do you think? What was your original use case when using this?

Actions

Copy link

Updated by Jonathan CLARKE over 11 years ago

Actually, #3461 just introduced a version 2.0 of this Technique, that no longer echoes strings through the passwd command, but instead does the hashing when you enter the password in the web UI (so it is never stored in cleartext). This is available in the 2.6.0 release of Rudder (or will be when it's released later today).

This doesn't fix the bug you describe in version 1.0, but since the code has been replaced in version 2.0 it will no longer apply. We still need to work around this in 1.0.

Actions

Copy link

Updated by Dennis Cabooter over 11 years ago

My original use case is to create a user with a ssh key. This user doesn't need a password. I propose that, if the password field is left emtpy, a random password will be set for the user.

Actions

Copy link

Updated by Dennis Cabooter over 11 years ago

I'm using Rudder 2.5 in production, and afaik it is recommended to not use 2.6 in production yet.

Actions

Copy link

Updated by Nicolas PERRON over 11 years ago

Target version changed from 2.5.3 to 2.5.4

Actions

Copy link

Updated by Matthieu CERDA over 11 years ago

Status changed from 8 to In progress
Assignee changed from Dennis Cabooter to Matthieu CERDA
Priority changed from N/A to 2

Actions

Copy link

Updated by Matthieu CERDA over 11 years ago

Status changed from In progress to 8
Assignee deleted (~~Matthieu CERDA~~)

I tried to work a bit on this, but this is complicated and I do not currently have the ressources to finish this. It should impact even the old versions (2.3).

Actions

Copy link

#10