docs: ref-manual: variables: add hashed password example in EXTRA_USERS_PARAMS

Add examples for hashed hardcoded passwords from extrausers.bbclass so
that this feature is not hidden away.

Cc: Quentin Schulz <foss+yocto@0leil.net>
(From yocto-docs rev: 5db73c7c5668144ed4629f95378e44f0bd8c8256)

Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Quentin Schulz
2022-04-22 15:13:15 +02:00
committed by Richard Purdie
parent 4c2ea34b3e
commit 8c7145a12d

View File

@@ -2338,6 +2338,37 @@ system and gives an overview of their function and contents.
# usermod -s /bin/sh tester; \
# "
Hardcoded passwords are supported via the ``-p`` parameters for
``useradd`` or ``usermod``, but only hashed.
Here is an example that adds two users named "tester-jim" and "tester-sue" and assigns
passwords. First on host, create the (escaped) password hash::
printf "%q" $(mkpasswd -m sha256crypt tester01)
The resulting hash is set to a variable and used in ``useradd`` command parameters::
inherit extrausers
PASSWD = "\$X\$ABC123\$A-Long-Hash"
EXTRA_USERS_PARAMS = "\
useradd -p '${PASSWD}' tester-jim; \
useradd -p '${PASSWD}' tester-sue; \
"
Finally, here is an example that sets the root password::
inherit extrausers
EXTRA_USERS_PARAMS = "\
usermod -p '${PASSWD}' root; \
"
.. note::
From a security perspective, hardcoding a default password is not
generally a good idea or even legal in some jurisdictions. It is
recommended that you do not do this if you are building a production
image.
Additionally there is a special ``passwd-expire`` command that will
cause the password for a user to be expired and thus force changing it
on first login, for example::