[chef] Re: Re: Removing root's password results in 'ruby-shadow not installed' error.

[Kimball Johnson < >]

On 4 May 2011 01:46, Bryan McLellan 
<
 >
 wrote:
> On Tue, May 3, 2011 at 5:36 PM, Jason J. W. Williams
> <
 >
>  wrote:
>>  user "root" do
>>    action :modify
>>    password "*"
>>  end
>
> Also, there's a "lock" action.
>

You should note that locking the account and setting the hash to '*'
are quite different.  For example if you are using ssh key logins you
can allow a user to access that has no usable password (i.e. hash of
'*') but  if you lock the account the user will not be permitted to
login.

> I suppose you could set the password to "*" using the password
> attribute. Since we're normally writing directly to this field through
> the shadow library, that may work.

If you have the ruby shadow library installed the manipulation of the
hash does indeed work correctly, and leave the account enabled, but
with no usable password.

Kimball Johnson