public inbox for isar-users@googlegroups.com
 help / color / mirror / Atom feed
From: Gylstorff Quirin <quirin.gylstorff@siemens.com>
To: Claudius Heine <ch@denx.de>,
	"Kiszka, Jan (CT RDA IOT SES-DE)" <jan.kiszka@siemens.com>,
	isar-users <isar-users@googlegroups.com>
Subject: Expired root user
Date: Thu, 5 May 2022 17:27:05 +0200	[thread overview]
Message-ID: <6b5d5d99-a53e-9370-c893-252ffbf0b25a@siemens.com> (raw)

Hi all,

in meta-iot2050[1] the password of the root user is set to expired to 
force the user to reset the password during the first boot. This 
currently done in a postinst [2] by calling:

```
passwd --expire root
```

An alternative way would be the setting:

```
USER_root[expire] = "1970-01-01"
```

Both variants have the issue that the installation of packages which add
new users will fail with a error message similar to:

```
Setting up systemd (247.3-7) ...
Created symlink 
/etc/systemd/system/getty.target.wants/getty@tty1.service -> 
/lib/systemd/system/getty@.service.
Created symlink 
/etc/systemd/system/multi-user.target.wants/remote-fs.target -> 
/lib/systemd/system/remote-fs.target.
Created symlink 
/etc/systemd/system/sysinit.target.wants/systemd-pstore.service -> 
/lib/systemd/system/systemd-pstore.service.
Initializing machine ID from random generator.
Your account has expired; please contact your system administrator.
chfn: PAM: Authentication failure
adduser: `/bin/chfn -f systemd Network Management systemd-network' 
returned error code 1. Exiting.
dpkg: error processing package systemd (--configure):
installed systemd package post-installation script subprocess returned 
error exit status 1
Setting up dmsetup (2:1.02.175-2.1) ...
Errors were encountered while processing:
systemd
E: Sub-process /usr/bin/dpkg returned an error code (1)
WARNING: exit code 100 from a shell command.
```

Possible solutions are:
- moving the account creation / modification to the rootfs postprocessing
- using the systemd first boot service[3] for changing the root password

Claudius was there are reason why the accounts are created/modified 
before installing the rootfs? You add the functionality with
163f50 meta/classes: add image-account-extension class

Quirin

[1]: https://github.com/siemens/meta-iot2050
[2]: 
https://github.com/siemens/meta-iot2050/blob/master/recipes-core/customizations-example/files/postinst
[3]: 
https://www.freedesktop.org/software/systemd/man/systemd-firstboot.html#

             reply	other threads:[~2022-05-05 15:27 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-05 15:27 Gylstorff Quirin [this message]
2022-05-05 16:18 ` Claudius Heine

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6b5d5d99-a53e-9370-c893-252ffbf0b25a@siemens.com \
    --to=quirin.gylstorff@siemens.com \
    --cc=ch@denx.de \
    --cc=isar-users@googlegroups.com \
    --cc=jan.kiszka@siemens.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox