chef-cookbooks/users — Issue #1: Empty Password by Default, Remove !
Author: rilindo
Created: 2012-01-23 05:28:09+00:00
State: open

The User recipe creates a login by default with no passwords. Generally, it appears to added the login to the /etc/shadow with the following:

bofh:!:15361:0:99999:7:::

Where the exclamation mark is, there is usually an encrypted password. If there is an exclamation mark in front of the password, it usually means that is it locked.

If there is just an exclamation mark (like this), then. . . the behavior varies. On Red Hat and Debian-type systems, you are able to login fine with the public key. HOWEVER, on OpenSUSE, attempts to login with the key with the exclamation mark results in the login being rejected with the following to the user via knife ssh:

knife ssh "id:*" "uptime" -x username
WARNING: Failed to connect to node[opensuse121.monzell.com] -- Net::SSH::Disconnect: connection closed by remote host

With a straight ssh connection, you will get:

yvaine:cookbooks rilindo$ ssh opensuse121.monzell.com -lbofh -i ~/.ssh/id_rsa
Connection closed by 192.168.15.75

To address it, the recipe will have to empty the password with:

passwd -d username

After the login is created. The the user is able to successfully login with the keys (Whether manually or via Knife).