fix(prelaunch): v0.0.18 - stop locking root; restore busybox-safe password setup - #114
Merged
Merged
Conversation
…sword setup v0.0.17 broke dev-image SSH and boot in three ways, all tied to busybox guests (every dstack 0.5.x image ships the same kirkstone busybox): - 'passwd -l root' locks the account; dstack sshd is built without PAM, so a locked account rejects ALL authentication including public keys (Phala-Network/phala-cloud-monorepo#1936). - DSTACK_ROOT_PASSWORD with no 'passwd --stdin' (busybox passwd has none) hit 'exit 1' and failed the boot. - 'head -c 32' random generation fails: fleet busybox is built without CONFIG_FEATURE_FANCY_HEAD, and set -e kills the script. v0.0.18: - Empty-password branch writes a discarded random password's SHA-512 crypt hash (openssl passwd -6) into /etc/shadow directly; falls back to leaving the password empty (v0.0.15 behavior) when openssl is absent. Never locks. - DSTACK_ROOT_PASSWORD branch gains the same openssl-hash fallback instead of exiting. - Random bytes come from 'dd bs=1 count=32' (the v0.0.6-v0.0.16 idiom) at both call sites. Verified on a real dstack-dev-0.5.9 CVM (pubkey SSH, user password, and a v0.0.17 control reproducing the lockout) and in a busybox + PAM-less OpenSSH container.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync of the Phala Cloud default pre-launch script v0.0.18.
v0.0.17 broke dev-image SSH and boot on busybox guests (all dstack 0.5.x images share the same kirkstone busybox userland):
passwd -l rootlocks the account; dstack sshd is built without PAM, so a locked account rejects all authentication including public keys (Phala-Network/phala-cloud-monorepo#1936).DSTACK_ROOT_PASSWORDwith nopasswd --stdin(busyboxpasswdhas none) hitexit 1and failed the boot.head -c 32fails: fleet busybox is built withoutCONFIG_FEATURE_FANCY_HEAD, andset -ekills the script.v0.0.18:
openssl passwd -6) into/etc/shadowdirectly; falls back to leaving the password empty (v0.0.15 behavior) when openssl is absent. Never locks.DSTACK_ROOT_PASSWORDbranch gains the same openssl-hash fallback instead of exiting.dd bs=1 count=32(the v0.0.6–v0.0.16 idiom) at both call sites.Verified on a real
dstack-dev-0.5.9CVM (pubkey SSH, user password, and a v0.0.17 control reproducing the lockout) and in a busybox + PAM-less OpenSSH container.SHA-256:
24d363e17b26dabdbf287588c1e1968fd7fdfef10954123b99ff6c6a837c5692