hackportland/scripts
Watch
5
0
Fork
You've already forked scripts
 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hp-create-user: remove password-setting #5

Merged
dym merged 1 commit from passwordless into main 2026-09-07 22:42:17 +00:00
Conversation 7 Commits 1 Files changed 1 +3 -2
dym commented 2026-09-07 19:41:24 +00:00
Member
Copy link

This should allow the script to be fully noninteractive.

--disabled-password eliminates the prompt for a password in the adduser invocation, but sets the password hash to !. passwd --delete deletes the hash entirely, which allows the user to set a new password without knowing the previous password, because it goes down this code path instead.

This should allow the script to be fully noninteractive. `--disabled-password` eliminates the prompt for a password in the `adduser` invocation, but sets the password hash to `!`. `passwd --delete` deletes the hash entirely, which allows the user to set a new password without knowing the previous password, because it goes down [this](https://github.com/linux-pam/linux-pam/blob/f5a50902abeacb10f9b5b0a08a05a091d07c9957/modules/pam_unix/pam_unix_passwd.c#L666-L667) code path instead.
This should allow the script to be fully noninteractive.
jacob commented 2026-09-07 19:50:37 +00:00
Owner
Copy link

I like this, only thing worth noting is it boots the user, luckily we get a warning here like so but I think it's fine (as long as people read it)

Last login: Mon Sep  7 01:39:04 2026 from 98.2.227.233
WARNING: Your password has expired.
You must change your password now and log in again!
New password:
Retype new password:
passwd: password updated successfully
Connection to hackportland.club closed.
I like this, only thing worth noting is it boots the user, luckily we get a warning here like so but I think it's fine (as long as people read it) ``` Last login: Mon Sep 7 01:39:04 2026 from 98.2.227.233 WARNING: Your password has expired. You must change your password now and log in again! New password: Retype new password: passwd: password updated successfully Connection to hackportland.club closed. ```
jacob approved these changes 2026-09-07 19:50:50 +00:00
jacob commented 2026-09-07 19:52:40 +00:00
Owner
Copy link

Hmm this does pose a potential issue where someone else logged in can su newuser before that user has a chance to set there password. That is one nice thing about the initial password approach. Not sure if thats super a concern or not though, let me know what you think

Hmm this does pose a potential issue where someone else logged in can `su newuser` before that user has a chance to set there password. That is one nice thing about the initial password approach. Not sure if thats super a concern or not though, let me know what you think
dym commented 2026-09-07 20:03:19 +00:00
Author
Member
Copy link

@jacob wrote in #5 (comment):

I like this, only thing worth noting is it boots the user, luckily we get a warning here like so but I think it's fine (as long as people read it)

Isn't forcing a second login the current behavior already, for all forced password changes? That text is straight from openssh.

@jacob wrote in #5 (comment):

Hmm this does pose a potential issue where someone else logged in can su newuser before that user has a chance to set there password.

I thought leaving nullok off in PAM (the default) would prevent this. Are you sure that works?

@jacob wrote in https://git.hackportland.club/hackportland/scripts/pulls/5#issuecomment-29: > I like this, only thing worth noting is it boots the user, luckily we get a warning here like so but I think it's fine (as long as people read it) Isn't forcing a second login the current behavior already, for all forced password changes? That text is straight from [openssh](https://salsa.debian.org/ssh-team/openssh/-/blob/c9e128bb62dc0f26dad7c7090ea6661766608076/session.c#L1402-1405). @jacob wrote in https://git.hackportland.club/hackportland/scripts/pulls/5#issuecomment-31: > Hmm this does pose a potential issue where someone else logged in can `su newuser` before that user has a chance to set there password. I thought leaving `nullok` off in PAM (the default) would prevent this. Are you sure that works?
jacob commented 2026-09-07 20:17:13 +00:00
Owner
Copy link

Isn't forcing a second login the current behavior already, for all forced password changes?

Ha! it certainly is, I was misremembering.

As for the second part:

[0] hackportland hackportland-scripts >> git log HEAD -1
commit 58e875e95f87a1f0d956ba5b765f11840f96e34d (HEAD -> passwordless, origin/passwordless)
Author: dym <dym@noreply.localhost>
Date:   Mon Sep 7 19:40:04 2026 +0000

    hp-create-user: remove password-setting

    This should allow the script to be fully noninteractive.
    word changed.

[2] hackportland hackportland-scripts >> sudo deluser --remove-home test
[0] hackportland hackportland-scripts >> sudo ./hp-create-user test ../pubkeys/jacob.pub
warn: The user `test' is already a member of `users'.
passwd: password changed.
[0] hackportland hackportland-scripts >> whoami
jacob
[0] hackportland hackportland-scripts >> su test
You are required to change your password immediately (administrator enforced).
New password:
Retype new password:
[0] hackportland hackportland-scripts >> whoami
test
[0] hackportland hackportland-scripts >>

It appears to work for me, though this may be because I am in a sudo adjacent mode? I will check we actually have nullok off in our pam config.

> Isn't forcing a second login the current behavior already, for all forced password changes? Ha! it certainly is, I was misremembering. As for the second part: ``` [0] hackportland hackportland-scripts >> git log HEAD -1 commit 58e875e95f87a1f0d956ba5b765f11840f96e34d (HEAD -> passwordless, origin/passwordless) Author: dym <dym@noreply.localhost> Date: Mon Sep 7 19:40:04 2026 +0000 hp-create-user: remove password-setting This should allow the script to be fully noninteractive. word changed. [2] hackportland hackportland-scripts >> sudo deluser --remove-home test [0] hackportland hackportland-scripts >> sudo ./hp-create-user test ../pubkeys/jacob.pub warn: The user `test' is already a member of `users'. passwd: password changed. [0] hackportland hackportland-scripts >> whoami jacob [0] hackportland hackportland-scripts >> su test You are required to change your password immediately (administrator enforced). New password: Retype new password: [0] hackportland hackportland-scripts >> whoami test [0] hackportland hackportland-scripts >> ``` It appears to work for me, though this may be because I am in a sudo adjacent mode? I will check we actually have nullok off in our pam config.
dym commented 2026-09-07 20:52:13 +00:00
Author
Member
Copy link

PAM's upstream default is off, but it turns out Debian has historically enabled nullok by default.

https://www.debian.org/doc/manuals/securing-debian-manual/restrict-console-login.en.html

PAM's upstream default is off, but it turns out Debian has historically enabled `nullok` by default. https://www.debian.org/doc/manuals/securing-debian-manual/restrict-console-login.en.html
dym commented 2026-09-07 22:42:05 +00:00
Author
Member
Copy link

RIP undisclosed default password system

RIP undisclosed default password system
❤️ 1
dym merged commit 58e875e95f into main 2026-09-07 22:42:17 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
jacob
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
hackportland/scripts!5
No description provided.