I'd like to make an universal automated install script using Kickstart, which would be placed on a CD and used in conjunction with standard DVD installer, i.e. the user of this script would need to append inst.ks=cdrom
to boot options and then it'd install e.g. Fedora on the machine asking only for passwords.
It seems that standard practice is to generate Kickstart scripts with passwords (or password hashes) in them, which doesn't seem ideal if you intend to distribute the script to third parties. I also want to enable sshd service in the Kickstart script, which would make it possible for anyone on LAN with knowledge of default passwords to log in into the machine. Of course I can just disable password authentication in sshd but now it's getting messy, i.e. I'm trying to workaround public knowledge of default passwords (and I may very well be forgetting something).
I'm new to Kickstart, I'd like to make the install script to ask/prompt/input for site-specific passwords, and so far I figured out two options:
- Ask for passwords in
%pre
section and then generate e.g.accounts.ks
withrootpw
anduser
commands which will be included from main command section. - Use static default passwords and run interactive script on first boot that'll force user to change default passwords. (Or possibly use
chage
in%post
.)
My worry is that, based on my Google searches, no one is doing that, no one is even asking for that. :-) Everyone seem to be placing final passwords/hashes directly into Kickstart scripts. So this leaves me with making my own interactive script for both options, which, I fear, will end up bad. Or perhaps, I'm getting the whole concept of (semi-) automated installs with Kickstart wrong.
What is the standard practice for creating universal Kickstart scripts for scenarios like this, where you need to distribute the script and not force users to edit it?