nixos-install: Ask the user to set a root password

This removes the need to have an initially empty root password.
This commit is contained in:
Eelco Dolstra 2014-05-09 00:04:48 +02:00
parent 8919d736a0
commit 4fc151b5a3
9 changed files with 39 additions and 24 deletions

View file

@ -209,7 +209,20 @@ $ nixos-install</screen>
a network issue while downloading binaries from the NixOS binary
cache), you can just re-run <command>nixos-install</command>.
Otherwise, fix your <filename>configuration.nix</filename> and
then re-run <command>nixos-install</command>.</para></listitem>
then re-run <command>nixos-install</command>.</para>
<para>As the last step, <command>nixos-install</command> will ask
you to set the password for the <literal>root</literal> user, e.g.
<screen>
setting root password...
Enter new UNIX password: ***
Retype new UNIX password: ***
</screen>
</para>
</listitem>
<listitem><para>If everything went well:

View file

@ -42,6 +42,9 @@ the following steps:
and generates a GRUB configuration file that boots into the NixOS
configuration just installed.</para></listitem>
<listitem><para>It prompts you for a password for the root
account.</para></listitem>
</itemizedlist>
</para>

View file

@ -374,8 +374,8 @@ in {
security.initialRootPassword = mkOption {
type = types.str;
default = "";
example = "!";
default = "!";
example = "";
description = ''
The (hashed) password for the root account set on initial
installation. The empty string denotes that root can login
@ -383,9 +383,9 @@ in {
as SSH, or indirectly via <command>su</command> or
<command>sudo</command>). The string <literal>!</literal>
prevents root from logging in using a password.
Note, setting this option sets
Note that setting this option sets
<literal>users.extraUsers.root.hashedPassword</literal>.
Note, if <literal>users.mutableUsers</literal> is false
Also, if <literal>users.mutableUsers</literal> is false
you cannot change the root password manually, so in that case
the name of this option is a bit misleading, since it will define
the root password beyond the user initialisation phase.

View file

@ -73,16 +73,18 @@ fi
# Mount some stuff in the target root directory. We bind-mount /etc
# into the chroot because we need networking and the nixbld user
# accounts in /etc/passwd. But we do need the target's /etc/nixos.
mkdir -m 0755 -p $mountPoint/dev $mountPoint/proc $mountPoint/sys $mountPoint/etc
mkdir -m 0755 -p $mountPoint/dev $mountPoint/proc $mountPoint/sys $mountPoint/etc $mountPoint/run
mkdir -m 01777 -p $mountPoint/tmp
mkdir -m 0755 -p $mountPoint/tmp/root
mkdir -m 0755 -p $mountPoint/var
mkdir -m 0755 -p $mountPoint/var/setuid-wrappers
mount --rbind /dev $mountPoint/dev
mount --rbind /proc $mountPoint/proc
mount --rbind /sys $mountPoint/sys
mount --rbind / $mountPoint/tmp/root
mount --bind /etc $mountPoint/etc
mount --bind $mountPoint/tmp/root/$mountPoint/etc/nixos $mountPoint/etc/nixos
mount -t tmpfs -o "mode=0755" none $mountPoint/run
mount -t tmpfs -o "mode=0755" none $mountPoint/var/setuid-wrappers
# Create the necessary Nix directories on the target device, if they
@ -215,3 +217,17 @@ touch $mountPoint/etc/NIXOS
echo "finalising the installation..."
NIXOS_INSTALL_GRUB=1 chroot $mountPoint \
/nix/var/nix/profiles/system/bin/switch-to-configuration boot
# Run the activation script.
chroot $mountPoint /nix/var/nix/profiles/system/activate
# Ask the user to set a root password.
if [ -t 0 ] ; then
echo "setting root password..."
chroot $mountPoint passwd
fi
echo "installation finished!"

View file

@ -160,9 +160,4 @@ with lib;
environment.systemPackages = [ pkgs.cryptsetup ];
boot.initrd.supportedFilesystems = [ "unionfs-fuse" ];
# Prevent logging in as root without a password. This doesn't really matter,
# since the only PAM services that allow logging in with a null
# password are local ones that are inaccessible on EC2 machines.
security.initialRootPassword = mkDefault "!";
}

View file

@ -117,7 +117,6 @@ in
modules =
let extraConfig =
{ boot.isContainer = true;
security.initialRootPassword = mkDefault "!";
networking.hostName = mkDefault name;
networking.useDHCP = false;
};

View file

@ -114,11 +114,6 @@ in
# Always include cryptsetup so that NixOps can use it.
environment.systemPackages = [ pkgs.cryptsetup ];
# Prevent logging in as root without a password. This doesn't really matter,
# since the only PAM services that allow logging in with a null
# password are local ones that are inaccessible on Google Compute machines.
security.initialRootPassword = mkDefault "!";
# Configure default metadata hostnames
networking.extraHosts = ''
169.254.169.254 metadata.google.internal metadata

View file

@ -64,7 +64,6 @@ sub writeNixOSConfig {
with lib;
{ boot.isContainer = true;
security.initialRootPassword = mkDefault "!";
networking.hostName = mkDefault "$containerName";
networking.useDHCP = false;
$extraConfig

View file

@ -107,9 +107,4 @@ with lib;
boot.loader.grub.device = "/dev/sda";
services.virtualbox.enable = true;
# Prevent logging in as root without a password. For NixOps, we
# don't need this because the user can login via SSH, and for the
# demo images, there is a demo user account that can sudo to root.
security.initialRootPassword = mkDefault "!";
}