search

shadow-maint / shadow

Upstream shadow tree
Other
292 stars 228 forks source link

Implement reading password from pipe/stdin #927

Closed thalman closed 7 months ago

thalman commented 7 months ago

New option --stdin/-s is available for root user. It is useful for automation/setup and it makes shadow utils passwd more versatile.

stoeckmann commented 7 months ago

It is useful for automation/setup and it makes shadow utils passwd more versatile.

Which use case does this cover compared to what newusers has to offer? The advantage of newusers is that it's not setuid. Pretty much "root only" already.

thalman commented 7 months ago

Hmm, I found that my PR does not work correctly with PAM. Let me investigate it first.

thalman commented 7 months ago

It is useful for automation/setup and it makes shadow utils passwd more versatile.

Which use case does this cover compared to what newusers has to offer? The advantage of newusers is that it's not setuid. Pretty much "root only" already.

It is useful in automation and tests and compatibility.

Distributions like Fedora and RHEL (and clones) uses another implementation of passwd that has --stdin option. Currently I'm trying to push passwd from shadow utils to Fedora as a replacement for that other implementation.

To make transition easier for Fedora/RHEL users, I would like to have this option implemented in passwd utility.

But yes you are right, this can be achieved in many different ways.

thalman commented 7 months ago

Please don't remove the -s comment in this PR. (Never mind; fixed in master.)

Removed from PR

stoeckmann commented 7 months ago

Which use case does this cover compared to what newusers has to offer? The advantage of newusers is that it's not setuid. Pretty much "root only" already.

But yes you are right, this can be achieved in many different ways.

Just to add to my initial remark: The solution with newusers has a critical issue: Passwords cannot contain colons because they are field separators. So I'm not a fan of newusers anymore at all.

Thank you for clarification!