user creds layer to use chpasswd -e (for hashed passwords)

[stu-spp]

user creds layer:

---
name: rpi-user-creds
mmdebstrap:
  packages:
    - sudo
  customize-hooks:
    - chroot $1 sh -c "if ! id -u $IGconf_device_user1 >/dev/null 2>&1; then
        adduser --disabled-password --gecos \"\"  $IGconf_device_user1;
        fi"
    - |-
      if [ -n "$IGconf_device_user1pass" ] ; then
         chroot $1 sh -c "echo ${IGconf_device_user1}:${IGconf_device_user1pass} | chpasswd"
      fi
    - chroot $1 usermod --pass='*' root
    - chroot $1 sh -c "for GRP in input spi i2c gpio; do
         groupadd -f -r \$GRP;
      done"
    - chroot $1 sh -c "for GRP in adm dialout cdrom audio users sudo video games plugdev input spi i2c gpio ; do
         adduser $IGconf_device_user1 \$GRP;
      done"
    - sed "s/^pi /$IGconf_device_user1 /" $RPI_TEMPLATES/sudo/010_pi-nopasswd > $1/etc/sudoers.d/010_pi-nopasswd
    - mkdir -p $1/etc/profile.d
    - |-
      cat <<- 'EOCHROOT' > $1/etc/profile.d/01local.sh
      #!/bin/sh
      if [ "$(id -u)" -ne 0 ]; then
        PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
      fi
      EOCHROOT

specifically:

      if [ -n "$IGconf_device_user1pass" ] ; then
         chroot $1 sh -c "echo ${IGconf_device_user1}:${IGconf_device_user1pass} | chpasswd"
      fi

It would be so great if we could use chpasswd -e instead of chpasswd:

  -e, --encrypted               supplied passwords are encrypted

so that we could store passwords hashed in version control.

I'm not sure if this is a good idea, but it was something I was considering a while back. Something to think about.

[learmj]

Hi @stu-spp I've not forgotten about this. AB work is taking priority.

[stu-spp]

No problem! Everything you're doing is greatly appreciated!

This issue is very low priority. It's really more of a question about how I should be doing per device credential management at 10e4 device scale.

We've been just been using a plaintext throw-away password, and have the device be made secure during provisioning/firstboot.

Thank you! Thank you! Thank you! Keep up the great work! <3