Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[action] [PR:215] Fix sudo command failed because root user password expired by password hardening feature issue. #221

Merged
merged 1 commit into from
Feb 14, 2025

Conversation

mssonicbld
Copy link

Fix sudo command failed because root user password expired by password hardening feature issue.

Why I did it

some sudo command failed after enable password hardening feature:

admin@vlab-01:~$ sudo config reload -y
sudo: Account or password is expired, reset your password and try again
Changing password for root.
Current password:

This is because:

  1. root user password change time is image build time.
  2. password hardening feature will set expiration time smaller than 1 year, in sonic-mgmt test it's 100 days.
  3. some SONiC command will run another commands, those sub-commands will run with root user.
  4. any command run by 'root' user will be blocked and ask update password.
  5. SONiC diabled the 'root' user, this user not have password, also can't login with SSH/Console, which means when ask change password by the sudo command, there is no way to provide the 'current' password user will be blocked there.

The only solution is to run 'sudo passwd root' command, this command will not ask current password, so user can set a new root password.

Work item tracking
  • Microsoft ADO: 31221102

How I did it

Remove the 'root' user expiration code.

How to verify it

Manually verified.
Pass all test case.

Which release branch to backport (provide reason below if selected)

  • 201811
  • 201911
  • 202006
  • 202012
  • 202106
  • 202111
  • 202205
  • 202211
  • 202305

Tested branch (Please provide the tested image version)

will updated with this PR image later.

  • [] SONiC.master-16482.360728-2c8b4066f

Description for the changelog

Fix hostcfgd modify_single_file method generates empty file issue

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

…d hardening feature issue.

Fix sudo command failed because root user password expired by password hardening feature issue.

#### Why I did it
some sudo command failed after enable password hardening feature:

admin@vlab-01:~$ sudo config reload -y
sudo: Account or password is expired, reset your password and try again
Changing password for root.
Current password:

This is because:
1. root user password change time is image build time.
2. password hardening feature will set expiration time smaller than 1 year, in sonic-mgmt test it's 100 days.
3. some SONiC command will run another commands, those sub-commands will run with root user.
4. any command run by 'root' user will be blocked and ask update password.
5. SONiC diabled the 'root' user, this user not have password, also can't login with SSH/Console, which means when ask change password by the sudo command,  there is no way to provide the 'current' password user will be blocked there.

The only solution is to run 'sudo passwd root' command, this command will not ask current password, so user can set a new root password.

##### Work item tracking
- Microsoft ADO: 31221102

#### How I did it
Remove the 'root' user expiration code.

#### How to verify it
Manually verified.
Pass all test case.

<!--
If PR needs to be backported, then the PR must be tested against the base branch and the earliest backport release branch and provide tested image version on these two branches. For example, if the PR is requested for master, 202211 and 202012, then the requester needs to provide test results on master and 202012.
-->

#### Which release branch to backport (provide reason below if selected)

<!--
- Note we only backport fixes to a release branch, *not* features!
- Please also provide a reason for the backporting below.
- e.g.
- [x] 202006
-->

- [ ] 201811
- [ ] 201911
- [ ] 202006
- [ ] 202012
- [ ] 202106
- [ ] 202111
- [ ] 202205
- [ ] 202211
- [ ] 202305

#### Tested branch (Please provide the tested image version)

<!--
- Please provide tested image version
- e.g.
- [x] 20201231.100
-->

will updated with this PR image later.
- [] SONiC.master-16482.360728-2c8b4066f

#### Description for the changelog
Fix hostcfgd modify_single_file method generates empty file issue

#### Link to config_db schema for YANG module changes
<!--
Provide a link to config_db schema for the table for which YANG model
is defined
Link should point to correct section on https://github.com/Azure/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md
-->

#### A picture of a cute animal (not mandatory but encouraged)
@mssonicbld
Copy link
Author

Original PR: #215

@mssonicbld
Copy link
Author

/azp run

Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@mssonicbld mssonicbld merged commit 1958c62 into sonic-net:202405 Feb 14, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant