puppetlabs/razor-server — pull request #83 by daniel-pittman (2013-11-07 21:45:22+00:00)
Title: ESXi: add, and always use, encrypted password support

This updates the ESXi kickstart file to use encrypted passwords. Since we can
robustly identify an encrypted password in the policy, we test for that and
either ship the pre-encrypted password, or encrypt it ourselves on the server.

That way the data crossing the wire, which is not secured, contains only a
reasonably secure password hash. This is a step up from sending a plain-text
password, at the very least.

This also makes the root password from the policy actually *work* on ESXi,
replacing the previously hard-coded password.

Signed-off-by: Daniel Pittman