spec: fix passwd permissions.
spec: fix order of config noreplace.