Reminder: Has anyone /not/ changed the default passwords in your kickstarts?

[Michael DeHaan]

As you are probably aware the sample kickstarts contain a default 
password of "cobbler".

Cobbler check will warn you if any kickstarts use this password.  

# "cobbler check"

If you have any kickstarts using this password, you should change them.
If you have any systems that might be using those passwords already 
installed, you should change them.

A future idea for /usr/bin/cobbler setup is probably to ask the user 
what they want the default password for the sample kickstarts to be and 
then add that to the sample kickstarts.

--Michael

[Javier Palacios]

>  A future idea for /usr/bin/cobbler setup is probably to ask the user
>  what they want the default password for the sample kickstarts to be and
>  then add that to the sample kickstarts. 
Ask for password does not match well with rpm install.
What about just take the hash from /etc/shadow from an existing user?
(either a cobbler user or simply root)

JaviP

[Michael DeHaan]

Javier Palacios wrote:
> > A future idea for /usr/bin/cobbler setup is probably to ask the
> user
> > what they want the default password for the sample kickstarts to be and
> > then add that to the sample kickstarts.
> >     
>
>  Ask for password does not match well with rpm install.
>  What about just take the hash from /etc/shadow from an existing user?
>  (either a cobbler user or simply root)
>
>  JaviP
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>     
The RPM install of course will not ask for the password.

/usr/bin/cobbler-setup is just a tool to run that sets up your 
modules.conf and settings file for you, after RPM install.

I would prefer to ask in that case, doing something automatically would 
be non-obvious and probably not correct for most folks.

I definitely don't want my main install server to have the same root 
password as every machine in my datacenter.

The /usr/bin/cobbler-setup tool asking is a good idea, "cobbler check" 
will still warn if folks set things up manually.

--Michael

[Dustin Black]

How about simply generating a random password at RPM installation time, and noting
strongly in the comments of the default kickstart files that it is so?

________________________________________
From: cobbler-bounces(a)lists.fedorahosted.org [cobbler-bounces(a)lists.fedorahosted.org] On
Behalf Of Javier Palacios [javiplx(a)gmail.com]
Sent: Thursday, October 16, 2008 1:41 PM
To: cobbler mailing list
Subject: Re: Reminder: Has anyone /not/ changed the default passwords in your  
kickstarts?

>  A future idea for /usr/bin/cobbler setup is probably to ask the user
>  what they want the default password for the sample kickstarts to be and
>  then add that to the sample kickstarts. 
Ask for password does not match well with rpm install.
What about just take the hash from /etc/shadow from an existing user?
(either a cobbler user or simply root)

JaviP
_______________________________________________
cobbler mailing list
cobbler(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler

[Michael DeHaan]

Dustin Black wrote:
>  How about simply generating a random password at RPM installation
> time, and noting strongly in the comments of the default kickstart files that it is so?
>     
The issue I have is that I don't think all of our users are clueful 
enough on how to replace the password hash.

Cobbler walks a line between being a very powerful tool for complex 
installations but something that's also trivially easy to use out of the 
box.

--Michael


>  ________________________________________
>  From: cobbler-bounces(a)lists.fedorahosted.org [cobbler-bounces(a)lists.fedorahosted.org] On
> Behalf Of Javier Palacios [javiplx(a)gmail.com]
>  Sent: Thursday, October 16, 2008 1:41 PM
>  To: cobbler mailing list
>  Subject: Re: Reminder: Has anyone /not/ changed the default passwords in your  
> kickstarts?
>
>    
> > A future idea for /usr/bin/cobbler setup is probably to ask the user
> > what they want the default password for the sample kickstarts to be and
> > then add that to the sample kickstarts.
> >     
>
>  Ask for password does not match well with rpm install.
>  What about just take the hash from /etc/shadow from an existing user?
>  (either a cobbler user or simply root)
>
>  JaviP
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>

[Michael DeHaan]

Michael DeHaan wrote:
>  Dustin Black wrote:
>    
> > How about simply generating a random password at RPM installation time, and noting
> strongly in the comments of the default kickstart files that it is so?
> >   
> >     
>
>  The issue I have is that I don't think all of our users are clueful 
>  enough on how to replace the password hash.
>     
Slight reading comprehension error on my part. Yes, this is doable, but 
we still need a way to retrieve what the password used was, which gets 
complicated. It also leaves the user without a way to log in on a 
"stock" install.

I spend a lot of time doing IRC support, so solutions that are obvious 
out of the box are preferred, so we don't have to keep answering the "I 
can't log in" problem. So this may involve a more complicated solution, 
and at that point, perhaps it's best solved by site-specific policy/plans.

Shipping a snippet to create a random password is reasonable and 
probably a good thing to do -- enabling it by default, not so sure.



>  Cobbler walks a line between being a very powerful tool for complex 
>  installations but something that's also trivially easy to use out of the 
>  box.
>
>  --Michael
>
>
>    
> > ________________________________________
> > From: cobbler-bounces(a)lists.fedorahosted.org [cobbler-bounces(a)lists.fedorahosted.org]
> On Behalf Of Javier Palacios [javiplx(a)gmail.com]
> > Sent: Thursday, October 16, 2008 1:41 PM
> > To: cobbler mailing list
> > Subject: Re: Reminder: Has anyone /not/ changed the default passwords in your  
> kickstarts?
> >
> >   
> >     
> >> A future idea for /usr/bin/cobbler setup is probably to ask the user
> >> what they want the default password for the sample kickstarts to be and
> >> then add that to the sample kickstarts.
> >>     
> >>       
> > Ask for password does not match well with rpm install.
> > What about just take the hash from /etc/shadow from an existing user?
> > (either a cobbler user or simply root)
> >
> > JaviP
> > _______________________________________________
> > cobbler mailing list
> > cobbler(a)lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/cobbler
> > _______________________________________________
> > cobbler mailing list
> > cobbler(a)lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/cobbler
> >   
> >     
>
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>

[Koelewijn, Marcel - Acision]

>  Michael DeHaan wrote:
>  > Dustin Black wrote:
>  >
>  >> How about simply generating a random password at RPM installation
>  time, and noting strongly in the comments of the default kickstart
>  files that it is so?
>  >>
>  >>
>  >
>  > The issue I have is that I don't think all of our users are clueful
>  > enough on how to replace the password hash.
>  >
>
>  Slight reading comprehension error on my part. Yes, this is doable, but
>  we still need a way to retrieve what the password used was, which gets
>  complicated. It also leaves the user without a way to log in on a
>  "stock" install.
>
>  I spend a lot of time doing IRC support, so solutions that are obvious
>  out of the box are preferred, so we don't have to keep answering the "I
>  can't log in" problem. So this may involve a more complicated solution,
>  and at that point, perhaps it's best solved by site-specific
>  policy/plans.
>
>  Shipping a snippet to create a random password is reasonable and
>  probably a good thing to do -- enabling it by default, not so sure.
>  
IMHO: enabling by default is not a good idea so I'm with Michael. The snippet approach
suits my environment just fine.

/marcel

This e-mail and any attachment is for authorised use by the intended recipient(s) only. It
may contain proprietary material, confidential information and/or be subject to legal
privilege. It should not be copied, disclosed to, retained or used by, any other party. If
you are not an intended recipient then please promptly delete this e-mail and any
attachment and all copies and inform the sender. Thank you.

[Mathieu Sauve-Frankel]

On Thu, Oct 16, 2008 at 01:59:53PM -0400, Michael DeHaan wrote:
>  Dustin Black wrote:
>  > How about simply generating a random password at RPM installation time, and noting
> strongly in the comments of the default kickstart files that it is so?
>  >   
>  
>  The issue I have is that I don't think all of our users are clueful 
>  enough on how to replace the password hash. 
If this is the case, then why not build a command into cobbler itself that 
allows you to modify the password in all or a subset of your kickstarts 
easily ?  

>  Cobbler walks a line between being a very powerful tool for complex 
>  installations but something that's also trivially easy to use out of the 
>  box. 
-- 
Mathieu Sauve-Frankel

[Michael DeHaan]

Mathieu Sauve-Frankel wrote:
>  On Thu, Oct 16, 2008 at 01:59:53PM -0400, Michael DeHaan wrote:
>    
> > Dustin Black wrote:
> >     
> >> How about simply generating a random password at RPM installation time, and
> noting strongly in the comments of the default kickstart files that it is so?
> >>   
> >>       
> > The issue I have is that I don't think all of our users are clueful 
> > enough on how to replace the password hash.
> >     
>
>  If this is the case, then why not build a command into cobbler itself that 
>  allows you to modify the password in all or a subset of your kickstarts 
>  easily ?  
>
>     
I like this.

cobbler passwd --template=path

or:

cobbler passwd --all

or

cobbler passwd --stock-templates-only


Saves the trouble of launching system-config-kickstart just to generate 
a hash and see what it would look like.


> > Cobbler walks a line between being a very powerful tool for
> complex 
> > installations but something that's also trivially easy to use out of the 
> > box.
> >     
>
>

[Mike M]

On Fri, Oct 17, 2008 at 10:18 AM, Michael DeHaan <mdehaan(a)redhat.com&gt; wrote:
>  I like this.
>
>  cobbler passwd --template=path
>
>  or:
>
>  cobbler passwd --all
>
>  or
>
>  cobbler passwd --stock-templates-only
>
>
>  Saves the trouble of launching system-config-kickstart just to generate
>  a hash and see what it would look like. 

+1 - This would be *sweet*!  Managing encrypted passwords in Kickstart
is a real pain, especially if you have a lot of them and your
passwords change regularly.

Mike

[Michael DeHaan]

Mike M wrote:
>  On Fri, Oct 17, 2008 at 10:18 AM, Michael DeHaan
> <mdehaan(a)redhat.com&gt; wrote:
>    
> > I like this.
> >
> > cobbler passwd --template=path
> >
> > or:
> >
> > cobbler passwd --all
> >
> > or
> >
> > cobbler passwd --stock-templates-only
> >
> >
> > Saves the trouble of launching system-config-kickstart just to generate
> > a hash and see what it would look like.
> >     
>
>
>  +1 - This would be *sweet*!  Managing encrypted passwords in Kickstart
>  is a real pain, especially if you have a lot of them and your
>  passwords change regularly.
>
>  Mike
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>     
Cool. It's just some light regular expression magic.

I'll do this.

--Michael.

[Harry Hoffman]

root password hash is a bad idea! cobbler doesn't really protect those
directories and if the errant badguy would able to download the hash
they might be able to get the password through rainbow tables or brute
force.

what we do for our local users is use apg to create a default new
password. We drop the plaintext version of this in their homedir and
ensure it's chmod 600 chown user.user

something along these lines might be a bit better.

Cheers,
Harry


On Thu, 2008-10-16 at 19:41 +0200, Javier Palacios wrote:
>  > A future idea for /usr/bin/cobbler setup is probably to ask the
> user
>  > what they want the default password for the sample kickstarts to be and
>  > then add that to the sample kickstarts.
>  
>  Ask for password does not match well with rpm install.
>  What about just take the hash from /etc/shadow from an existing user?
>  (either a cobbler user or simply root)
>  
>  JaviP
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler

[Michael DeHaan]

Harry Hoffman wrote:
>  root password hash is a bad idea! cobbler doesn't really protect
> those
>  directories and if the errant badguy would able to download the hash
>  they might be able to get the password through rainbow tables or brute
>  force.
>
>  what we do for our local users is use apg to create a default new
>  password. We drop the plaintext version of this in their homedir and
>  ensure it's chmod 600 chown user.user
>
>  something along these lines might be a bit better.
>
>  Cheers,
>  Harry
>     
We could perhaps generate one on an install by install basis (using the 
magic of Cheetah), but we also then need to store that in cobbler in a 
way that is retrievable by the admin so they can know it if they need to 
log in. Cobbler's storage is read-only for this, so that is suboptimal.

Of course a user can, if they so wish, modify the password in %post.

It's hard to pick something that is good for everyone that still works 
cleanly for fully automated installs without a lot of extra setup and 
confusion. So right now the docs say "run cobbler check" and that will 
warn you about the default.

Naturally the passwords are readable, but it's a hash, and there is a 
well known tradeoff between the ability to automate a deployment that is 
administerable and the security of that deployment. Files deployed are 
by their very nature public, but if the user wants to scramble passwords 
in %post, that's fair game.

However apg is not in RHEL.

If we were to tighten permissions on Cobbler state files and make it 
impossible to retrieve the password stored in cobbler via XMLRPC, we 
could do per-system root password generation as an option, though that's 
a pretty major RFE that we'd probably need to look at for 1.4

Much of this is more of a documentation item as each site will have 
their own preferences.

--Michael
>  On Thu, 2008-10-16 at 19:41 +0200, Javier Palacios wrote:
>    
> >> A future idea for /usr/bin/cobbler setup is probably to ask the user
> >> what they want the default password for the sample kickstarts to be and
> >> then add that to the sample kickstarts.
> >>       
> > Ask for password does not match well with rpm install.
> > What about just take the hash from /etc/shadow from an existing user?
> > (either a cobbler user or simply root)
> >
> > JaviP
> > _______________________________________________
> > cobbler mailing list
> > cobbler(a)lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/cobbler
> >     
>
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>

[Jeroen van Meeuwen]

Michael DeHaan wrote:
>  Harry Hoffman wrote:
> > root password hash is a bad idea! cobbler doesn't really protect those
> > directories and if the errant badguy would able to download the hash
> > they might be able to get the password through rainbow tables or brute
> > force.
> >
> > what we do for our local users is use apg to create a default new
> > password. We drop the plaintext version of this in their homedir and
> > ensure it's chmod 600 chown user.user
> >
>  We could perhaps generate one on an install by install basis (using the 
>  magic of Cheetah), but we also then need to store that in cobbler in a 
>  way that is retrievable by the admin so they can know it if they need to 
>  log in. Cobbler's storage is read-only for this, so that is suboptimal.
>   
mysql-server spits out the notice when the service starts, maybe that's 
a way to give notice.

Kind regards,

Jeroen van Meeuwen
-kanarip

[Ashley Penney]

Is this really a big problem?  I assume most people using cobbler
either have a post-configuration tool (like us), or immediately jump
in to configure the server.  It doesn't really seem like cobbler
should concern itself too heavily with security, people shouldn't be
building on public networks with ssh over root enabled by default.  I
don't plan to change away from the default of 'cobbler' because puppet
kicks in within a few minutes to set it to something else.

On Thu, Oct 16, 2008 at 11:56 AM, Michael DeHaan <mdehaan(a)redhat.com&gt; wrote:
>  As you are probably aware the sample kickstarts contain a default
>  password of "cobbler".
>
>  Cobbler check will warn you if any kickstarts use this password.
>
>  # "cobbler check"
>
>  If you have any kickstarts using this password, you should change them.
>  If you have any systems that might be using those passwords already
>  installed, you should change them.
>
>  A future idea for /usr/bin/cobbler setup is probably to ask the user
>  what they want the default password for the sample kickstarts to be and
>  then add that to the sample kickstarts.
>
>  --Michael
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>

[Michael DeHaan]

Ashley Penney wrote:
>  Is this really a big problem?  I assume most people using cobbler
>  either have a post-configuration tool (like us), or immediately jump
>  in to configure the server.  It doesn't really seem like cobbler
>  should concern itself too heavily with security, people shouldn't be
>  building on public networks with ssh over root enabled by default.  I
>  don't plan to change away from the default of 'cobbler' because puppet
>  kicks in within a few minutes to set it to something else.
>     
Yet you have a window. It's much better to install it correctly than 
depend on Puppet to fix it.

--Michael


>  On Thu, Oct 16, 2008 at 11:56 AM, Michael DeHaan
> <mdehaan(a)redhat.com&gt; wrote:
>    
> > As you are probably aware the sample kickstarts contain a default
> > password of "cobbler".
> >
> > Cobbler check will warn you if any kickstarts use this password.
> >
> > # "cobbler check"
> >
> > If you have any kickstarts using this password, you should change them.
> > If you have any systems that might be using those passwords already
> > installed, you should change them.
> >
> > A future idea for /usr/bin/cobbler setup is probably to ask the user
> > what they want the default password for the sample kickstarts to be and
> > then add that to the sample kickstarts.
> >
> > --Michael
> > _______________________________________________
> > cobbler mailing list
> > cobbler(a)lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/cobbler
> >
> >     
>  _______________________________________________
>  cobbler mailing list
>  cobbler(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler
>