canonical / canonical/cloud-init
Unclear reason for cc_users_groups supporting both "passwd" and "hashed_passwd" options for users
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 1.1k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 18
Description
# Bug report
It is unclear why cc_users_groups supports both the "passwd and "hashed_passwd" user options. Specifying either in user-data for new users ends up with the same resultant configuration.
The [documentation](https://cloudinit.readthedocs.io/en/latest/reference/modules.html#users-and-groups) does indicate that only "hashed_passwd" can be used for existing users, however that doesn't explain why "passwd" exists at all as an option.
There's also another note there:
```
Specifying a hash of a user’s password with passwd is a security risk if the cloud-config can be intercepted. SSH authentication is preferred.
```
which doesn't mention why the same warning shouldn't apply to "hashed_passwd" also (and also doesn't warn about "plain_text_passwd" too).
The schema states:
```
passwd: (string) Hash of user password applied when user does not exist. This will NOT be applied if the user already exists.
hashed_passwd: (string) Hash of user password to be applied. This will be applied even if the user is preexisting.
```
Is there any reason why "passwd" should not be deprecated as "hashed_passwd" supports everything "passwd" does and more (i.e. setting password for existing users).
## Steps to reproduce the problem
User-data excerpt:
```
users:
- name: user1
hashed_passwd: $6$abcdef
- name: user2
passwd: $6$abcdef
```
Results in cc_users_groups running the following commands:
```
useradd user1 -m
chpasswd -e
user1:$6$abcdef
useradd user2 --password $6$abcdef -m
```
Whilst the precise commands run differ the end result is the same:
```
$ grep user /etc/shadow
user1:$6$abcdef:19847:::::20118:
user2:$6$abcdef:19847:::::20118:
```
## Environment details
- Cloud-init version: git main
- Operating System Distribution: Alpine
- Cloud provider, platform or installer type: NoCloud
## cloud-init logs
Contributor guide
Assessment
This issue has not been assessed yet.