|
Packit Service |
a04d08 |
#cloud-config
|
|
Packit Service |
a04d08 |
# Add groups to the system
|
|
Packit Service |
a04d08 |
# The following example adds the ubuntu group with members 'root' and 'sys'
|
|
Packit Service |
a04d08 |
# and the empty group cloud-users.
|
|
Packit Service |
a04d08 |
groups:
|
|
Packit Service |
a04d08 |
- ubuntu: [root,sys]
|
|
Packit Service |
a04d08 |
- cloud-users
|
|
Packit Service |
a04d08 |
|
|
Packit Service |
a04d08 |
# Add users to the system. Users are added after groups are added.
|
|
Packit Service |
9bfd13 |
# Note: Most of these configuration options will not be honored if the user
|
|
Packit Service |
9bfd13 |
# already exists. Following options are the exceptions and they are
|
|
Packit Service |
9bfd13 |
# applicable on already-existing users:
|
|
Packit Service |
9bfd13 |
# - 'plain_text_passwd', 'hashed_passwd', 'lock_passwd', 'sudo',
|
|
Packit Service |
9bfd13 |
# 'ssh_authorized_keys', 'ssh_redirect_user'.
|
|
Packit Service |
a04d08 |
users:
|
|
Packit Service |
a04d08 |
- default
|
|
Packit Service |
a04d08 |
- name: foobar
|
|
Packit Service |
a04d08 |
gecos: Foo B. Bar
|
|
Packit Service |
a04d08 |
primary_group: foobar
|
|
Packit Service |
a04d08 |
groups: users
|
|
Packit Service |
a04d08 |
selinux_user: staff_u
|
|
Packit Service |
a04d08 |
expiredate: 2012-09-01
|
|
Packit Service |
a04d08 |
ssh_import_id: foobar
|
|
Packit Service |
a04d08 |
lock_passwd: false
|
|
Packit Service |
a04d08 |
passwd: $6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/
|
|
Packit Service |
a04d08 |
- name: barfoo
|
|
Packit Service |
a04d08 |
gecos: Bar B. Foo
|
|
Packit Service |
a04d08 |
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
Packit Service |
a04d08 |
groups: users, admin
|
|
Packit Service |
a04d08 |
ssh_import_id: None
|
|
Packit Service |
a04d08 |
lock_passwd: true
|
|
Packit Service |
a04d08 |
ssh_authorized_keys:
|
|
Packit Service |
a04d08 |
- <ssh pub key 1>
|
|
Packit Service |
a04d08 |
- <ssh pub key 2>
|
|
Packit Service |
a04d08 |
- name: cloudy
|
|
Packit Service |
a04d08 |
gecos: Magic Cloud App Daemon User
|
|
Packit Service |
a04d08 |
inactive: true
|
|
Packit Service |
a04d08 |
system: true
|
|
Packit Service |
a04d08 |
- name: fizzbuzz
|
|
Packit Service |
a04d08 |
sudo: False
|
|
Packit Service |
a04d08 |
ssh_authorized_keys:
|
|
Packit Service |
a04d08 |
- <ssh pub key 1>
|
|
Packit Service |
a04d08 |
- <ssh pub key 2>
|
|
Packit Service |
a04d08 |
- snapuser: joe@joeuser.io
|
|
Packit Service |
a04d08 |
- name: nosshlogins
|
|
Packit Service |
a04d08 |
ssh_redirect_user: true
|
|
Packit Service |
a04d08 |
|
|
Packit Service |
a04d08 |
# Valid Values:
|
|
Packit Service |
a04d08 |
# name: The user's login name
|
|
Packit Service |
a04d08 |
# gecos: The user name's real name, i.e. "Bob B. Smith"
|
|
Packit Service |
a04d08 |
# homedir: Optional. Set to the local path you want to use. Defaults to
|
|
Packit Service |
a04d08 |
# /home/<username>
|
|
Packit Service |
a04d08 |
# primary_group: define the primary group. Defaults to a new group created
|
|
Packit Service |
a04d08 |
# named after the user.
|
|
Packit Service |
a04d08 |
# groups: Optional. Additional groups to add the user to. Defaults to none
|
|
Packit Service |
a04d08 |
# selinux_user: Optional. The SELinux user for the user's login, such as
|
|
Packit Service |
a04d08 |
# "staff_u". When this is omitted the system will select the default
|
|
Packit Service |
a04d08 |
# SELinux user.
|
|
Packit Service |
a04d08 |
# lock_passwd: Defaults to true. Lock the password to disable password login
|
|
Packit Service |
a04d08 |
# inactive: Create the user as inactive
|
|
Packit Service |
a04d08 |
# passwd: The hash -- not the password itself -- of the password you want
|
|
Packit Service |
a04d08 |
# to use for this user. You can generate a safe hash via:
|
|
Packit Service |
a04d08 |
# mkpasswd --method=SHA-512 --rounds=4096
|
|
Packit Service |
a04d08 |
# (the above command would create from stdin an SHA-512 password hash
|
|
Packit Service |
a04d08 |
# with 4096 salt rounds)
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# Please note: while the use of a hashed password is better than
|
|
Packit Service |
a04d08 |
# plain text, the use of this feature is not ideal. Also,
|
|
Packit Service |
a04d08 |
# using a high number of salting rounds will help, but it should
|
|
Packit Service |
a04d08 |
# not be relied upon.
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# To highlight this risk, running John the Ripper against the
|
|
Packit Service |
a04d08 |
# example hash above, with a readily available wordlist, revealed
|
|
Packit Service |
a04d08 |
# the true password in 12 seconds on a i7-2620QM.
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# In other words, this feature is a potential security risk and is
|
|
Packit Service |
a04d08 |
# provided for your convenience only. If you do not fully trust the
|
|
Packit Service |
a04d08 |
# medium over which your cloud-config will be transmitted, then you
|
|
Packit Service |
a04d08 |
# should use SSH authentication only.
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# You have thus been warned.
|
|
Packit Service |
a04d08 |
# no_create_home: When set to true, do not create home directory.
|
|
Packit Service |
a04d08 |
# no_user_group: When set to true, do not create a group named after the user.
|
|
Packit Service |
a04d08 |
# no_log_init: When set to true, do not initialize lastlog and faillog database.
|
|
Packit Service |
a04d08 |
# ssh_import_id: Optional. Import SSH ids
|
|
Packit Service |
a04d08 |
# ssh_authorized_keys: Optional. [list] Add keys to user's authorized keys file
|
|
Packit Service |
a04d08 |
# ssh_redirect_user: Optional. [bool] Set true to block ssh logins for cloud
|
|
Packit Service |
a04d08 |
# ssh public keys and emit a message redirecting logins to
|
|
Packit Service |
a04d08 |
# use <default_username> instead. This option only disables cloud
|
|
Packit Service |
a04d08 |
# provided public-keys. An error will be raised if ssh_authorized_keys
|
|
Packit Service |
a04d08 |
# or ssh_import_id is provided for the same user.
|
|
Packit Service |
9bfd13 |
#
|
|
Packit Service |
a04d08 |
# ssh_authorized_keys.
|
|
Packit Service |
a04d08 |
# sudo: Defaults to none. Accepts a sudo rule string, a list of sudo rule
|
|
Packit Service |
a04d08 |
# strings or False to explicitly deny sudo usage. Examples:
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# Allow a user unrestricted sudo access.
|
|
Packit Service |
a04d08 |
# sudo: ALL=(ALL) NOPASSWD:ALL
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# Adding multiple sudo rule strings.
|
|
Packit Service |
a04d08 |
# sudo:
|
|
Packit Service |
a04d08 |
# - ALL=(ALL) NOPASSWD:/bin/mysql
|
|
Packit Service |
a04d08 |
# - ALL=(ALL) ALL
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# Prevent sudo access for a user.
|
|
Packit Service |
a04d08 |
# sudo: False
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# Note: Please double check your syntax and make sure it is valid.
|
|
Packit Service |
a04d08 |
# cloud-init does not parse/check the syntax of the sudo
|
|
Packit Service |
a04d08 |
# directive.
|
|
Packit Service |
a04d08 |
# system: Create the user as a system user. This means no home directory.
|
|
Packit Service |
a04d08 |
# snapuser: Create a Snappy (Ubuntu-Core) user via the snap create-user
|
|
Packit Service |
a04d08 |
# command available on Ubuntu systems. If the user has an account
|
|
Packit Service |
a04d08 |
# on the Ubuntu SSO, specifying the email will allow snap to
|
|
Packit Service |
a04d08 |
# request a username and any public ssh keys and will import
|
|
Packit Service |
a04d08 |
# these into the system with username specifed by SSO account.
|
|
Packit Service |
a04d08 |
# If 'username' is not set in SSO, then username will be the
|
|
Packit Service |
a04d08 |
# shortname before the email domain.
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
|
|
Packit Service |
a04d08 |
# Default user creation:
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# Unless you define users, you will get a 'ubuntu' user on ubuntu systems with the
|
|
Packit Service |
a04d08 |
# legacy permission (no password sudo, locked user, etc). If however, you want
|
|
Packit Service |
a04d08 |
# to have the 'ubuntu' user in addition to other users, you need to instruct
|
|
Packit Service |
a04d08 |
# cloud-init that you also want the default user. To do this use the following
|
|
Packit Service |
a04d08 |
# syntax:
|
|
Packit Service |
9bfd13 |
# users:
|
|
Packit Service |
9bfd13 |
# - default
|
|
Packit Service |
9bfd13 |
# - bob
|
|
Packit Service |
9bfd13 |
# - ....
|
|
Packit Service |
a04d08 |
# foobar: ...
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# users[0] (the first user in users) overrides the user directive.
|
|
Packit Service |
a04d08 |
#
|
|
Packit Service |
a04d08 |
# The 'default' user above references the distro's config:
|
|
Packit Service |
a04d08 |
# system_info:
|
|
Packit Service |
a04d08 |
# default_user:
|
|
Packit Service |
9bfd13 |
# name: Ubuntu
|
|
Packit Service |
9bfd13 |
# plain_text_passwd: 'ubuntu'
|
|
Packit Service |
9bfd13 |
# home: /home/ubuntu
|
|
Packit Service |
9bfd13 |
# shell: /bin/bash
|
|
Packit Service |
9bfd13 |
# lock_passwd: True
|
|
Packit Service |
9bfd13 |
# gecos: Ubuntu
|
|
Packit Service |
9bfd13 |
# groups: [adm, audio, cdrom, dialout, floppy, video, plugdev, dip, netdev]
|