Skip to content

Commit

Permalink
Fix sudo command failed because root user password expired by passwor…
Browse files Browse the repository at this point in the history
…d hardening feature issue. (#221)

Fix sudo command failed because root user password expired by password hardening feature issue.

#### Why I did it
some sudo command failed after enable password hardening feature:

admin@vlab-01:~$ sudo config reload -y
sudo: Account or password is expired, reset your password and try again
Changing password for root.
Current password:

This is because:
1. root user password change time is image build time.
2. password hardening feature will set expiration time smaller than 1 year, in sonic-mgmt test it's 100 days.
3. some SONiC command will run another commands, those sub-commands will run with root user.
4. any command run by 'root' user will be blocked and ask update password.
5. SONiC diabled the 'root' user, this user not have password, also can't login with SSH/Console, which means when ask change password by the sudo command, there is no way to provide the 'current' password user will be blocked there.

The only solution is to run 'sudo passwd root' command, this command will not ask current password, so user can set a new root password.

##### Work item tracking
- Microsoft ADO: 31221102

#### How I did it
Remove the 'root' user expiration code.

#### How to verify it
Manually verified.
Pass all test case.

<!--
If PR needs to be backported, then the PR must be tested against the base branch and the earliest backport release branch and provide tested image version on these two branches. For example, if the PR is requested for master, 202211 and 202012, then the requester needs to provide test results on master and 202012.
-->

#### Which release branch to backport (provide reason below if selected)

<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->

- [ ] 201811
- [ ] 201911
- [ ] 202006
- [ ] 202012
- [ ] 202106
- [ ] 202111
- [ ] 202205
- [ ] 202211
- [ ] 202305

#### Tested branch (Please provide the tested image version)

<!--
- Please provide tested image version
- e.g.
- [x] 20201231.100
-->

will updated with this PR image later.
- [] SONiC.master-16482.360728-2c8b4066f

#### Description for the changelog
Fix hostcfgd modify_single_file method generates empty file issue

#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->

#### A picture of a cute animal (not mandatory but encouraged)
  • Loading branch information
mssonicbld authored Feb 14, 2025
1 parent 8825ed7 commit 1958c62
Showing 1 changed file with 0 additions and 1 deletion.
1 change: 0 additions & 1 deletion scripts/hostcfgd
Original file line number Diff line number Diff line change
Expand Up @@ -1012,7 +1012,6 @@ class PasswHardening(object):
if account_number >= uid_min and account_number <= uid_max:
normal_accounts.append(account_spl[ACCOUNT_NAME])

normal_accounts.append('root') # root is also a candidate to be age modify.
return normal_accounts

def modify_passw_conf_file(self):
Expand Down

0 comments on commit 1958c62

Please sign in to comment.