openstack
/
diskimage-builder
Code Issues Proposed changes
diskimage-builder/diskimage_builder/elements/dynamic-login
History
Dmitry Tantsur 19378bbd9d Fix dynamic-login with grub2 
Grub2 messes up arguments with double quotes in them, changing from
key="value" to "key=value" [1]. Support this format as well.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=950760

Change-Id: Icf4c9f86009d29a342d6e0e21644af680066b0b2
 		2020-11-20 15:00:54 +01:00
..
init-scripts Release 1.25.2 2017-02-02 11:20:00 +11:00
install.d Move elements & lib relative to diskimage_builder package 2016-11-01 17:27:41 -07:00
static/usr/local/bin Fix dynamic-login with grub2 2020-11-20 15:00:54 +01:00
README.rst Move elements & lib relative to diskimage_builder package 2016-11-01 17:27:41 -07:00
element-deps Merge remote-tracking branch 'origin/master' into merge-branch 2016-11-29 07:43:46 +11:00

README.rst

dynamic-login

This element insert a helper script in the image that allows users to dynamically configure credentials at boot time. This is specially useful for troubleshooting.

Troubleshooting an image can be quite hard, specially if you can not get a prompt you can enter commands to find out what went wrong. By default, the images (specially ramdisks) doesn't have any SSH key or password for any user. Of course one could use the devuser element to generate an image with SSH keys and user/password in the image but that would be a massive security hole and very it's discouraged to run in production with a ramdisk like that.

This element allows the operator to inject a SSH key and/or change the root password dynamically when the image boots. Two kernel command line parameters are used to do it:

sshkey
Description

If the operator append sshkey="$PUBLIC_SSH_KEY" to the kernel command line on boot, the helper script will append this key to the root user authorized_keys.

rootpwd
Description

If the operator append rootpwd="$ENCRYPTED_PASSWORD" to the kernel command line on boot, the helper script will set the root password to the one specified by this option. Note that this password must be encrypted. Encrypted passwords can be generated using the openssl command, e.g: openssl passwd -1.

Note

The value of these parameters must be quoted, e.g: sshkey="ssh-rsa BBBA1NBzaC1yc2E ..."

Warning

Some base operational systems might require selinux to be in permissive or disabled mode so that you can log in the image. This can be achieved by building the image with the selinux-permissive element for diskimage-builder or by passing selinux=0 in the kernel command line. RHEL/CentOS are examples of OSs which this is true.