3

I'm using the user cookbook, which is working fine for all other user accounts.

I'm able to populate the root user's authorized_keys file with the keys listed in the data bag, however the password is remaining unset.

Here's the contents of my data bag (data_bags/users/root.json) for the root user:

{
  "id": "root",
  "uid": 0,
  "home": "/root",
  "home_dir_mode": "0700",
  "password": "shadowpasswordhash",
  "ssh_keys": [
    "ssh-rsa averylongkey"    
  ],
  "ssh_keygen": false
}
tommarshall
  • 2,038
  • 5
  • 23
  • 36

2 Answers2

1

It could be a bug in that cookbook.

I'd use the "official" community cookbook (http://community.opscode.com/cookbooks/users) maintained by Seth Vargo rather than that one.

For the record, I successfully use the standard user resource to manage the root user password. Given the sensitivity, it might be better to handle the root account separately from other user accounts.

For example, you can use the built-in user resource set the root password like this:

  password_hash = ...

  user "Setting root password" do
    username 'root'
    password password_hash
    action :modify
  end

Setting an SSH key entails making sure that the /root/.ssh/ directory exists, and has the correct permissions, and then creating /root/.ssh/authorized_keys containing the public key and with the correct permissions. Something like this:

 public_key = ...

 directory "/root/.ssh" do
    owner "root"
    mode 0700
 end

 file "/root/.ssh/authorized_keys" do
    owner "root"
    mode "600"
    content public_key
 end
Stephen C
  • 698,415
  • 94
  • 811
  • 1,216
  • Thanks for the advice, I'll take a look at the `users` cookbook for sure. Would you possibly be able to edit your answer to give an example of how the `user` **resource** can be used to set the root user's password and key? – tommarshall Jul 18 '14 at 08:21
0

In order to set the shadow passwords of users, you need to have the ruby-shadow gem available to chef (which is not installed by default). This is documented on the default user resource of which the linked cookbook is merely a wrapper.

In order to install the gem, just add this to a recipe which is included in the runlist before you setup the users:

chef_gem "ruby-shadow"
Holger Just
  • 52,918
  • 14
  • 115
  • 123
  • I don't think this is the issue as the user cookbook (which no doubt uses the user resource) is able to set the shadow passwords for all other users, it's just root that is proving resistant. – tommarshall Jul 17 '14 at 14:23