canonical / canonical/cloud-init

Unclear reason for cc_users_groups supporting both "passwd" and "hashed_passwd" options for users

Open
#5,294 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

# Bug report

It is unclear why cc_users_groups supports both the "passwd and "hashed_passwd" user options. Specifying either in user-data for new users ends up with the same resultant configuration.

The [documentation](https://cloudinit.readthedocs.io/en/latest/reference/modules.html#users-and-groups) does indicate that only "hashed_passwd" can be used for existing users, however that doesn't explain why "passwd" exists at all as an option.

There's also another note there:

```
Specifying a hash of a user’s password with passwd is a security risk if the cloud-config can be intercepted. SSH authentication is preferred.
```

which doesn't mention why the same warning shouldn't apply to "hashed_passwd" also (and also doesn't warn about "plain_text_passwd" too).

The schema states:

```
passwd: (string) Hash of user password applied when user does not exist. This will NOT be applied if the user already exists.

hashed_passwd: (string) Hash of user password to be applied. This will be applied even if the user is preexisting.
```

Is there any reason why "passwd" should not be deprecated as "hashed_passwd" supports everything "passwd" does and more (i.e. setting password for existing users).

## Steps to reproduce the problem

User-data excerpt:

```
users:
- name: user1
hashed_passwd: $6$abcdef
- name: user2
passwd: $6$abcdef
```

Results in cc_users_groups running the following commands:

```
useradd user1 -m
chpasswd -e
user1:$6$abcdef

useradd user2 --password $6$abcdef -m
```

Whilst the precise commands run differ the end result is the same:

```
$ grep user /etc/shadow
user1:$6$abcdef:19847:::::20118:
user2:$6$abcdef:19847:::::20118:
```

## Environment details
- Cloud-init version: git main
- Operating System Distribution: Alpine
- Cloud provider, platform or installer type: NoCloud

## cloud-init logs

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.