alternate shadow file?

Archives Ansible Project
1

Greetings.

I would like to use the “user” module to change my password, but the shadow file is not located in /etc/shadow . It’s in an alternate location, specifically, /mnt/pxe/etc/shadow . Is there a way to accomplish this?

I have a bad feeling that the answer is “only if the underlying passwd command allows this option,” which it doesn’t.

I suppose the “lineinfile” module will accomplish this with a little bit of extra effort, but it would be nice if the standard “user” module would allow this.

Maybe somebody has a better idea?

Thanks.

–EbH

2

use chroot to /mnt/pxe and then use user module, passwd will then
'work as expected', with ansible this might mean using the 'chroot'
connection plugin

3

Unless the functionality has changed, it’s my understanding that ansible cannot use chroot when managing a remote machine.

4

If there is a complete chroot environment under /mnt/pxe, you could configure a new ansible user to always log into a chrooted environment, using a sshd_config file and these two lines:

Match User new_ansible_user
ChrootDirectory /mnt/pxe

Then use ansible normally under that special user.

But that seems overkill, it would be easier to script the password change locally with mkpassword and some text manipulation.

5

Thanks for the tip. Setting up a chroot-only ansible-only user is a pretty good idea.

In this particular case, after talking with a co-worker, I ended up simply copying one shadow file to the other (note that this is a redacted copy for informational purposes only)

tasks:

  • name: “update system password”
    user:
    name: “{{ item }}”
    update_password: always
  • name: “update chroot password”
    copy:
    src: /etc/shadow
    remote_src: yes
    dest: /mnt/pxe/etc/shadow
    notify: “rebuild image”