nixos-install: Ask the user to set a root password

This removes the need to have an initially empty root password.
This commit is contained in:
Eelco Dolstra 2014-05-09 00:04:48 +02:00
parent 8919d736a0
commit 4fc151b5a3
9 changed files with 39 additions and 24 deletions

View file

@ -209,7 +209,20 @@ $ nixos-install</screen>
a network issue while downloading binaries from the NixOS binary a network issue while downloading binaries from the NixOS binary
cache), you can just re-run <command>nixos-install</command>. cache), you can just re-run <command>nixos-install</command>.
Otherwise, fix your <filename>configuration.nix</filename> and Otherwise, fix your <filename>configuration.nix</filename> and
then re-run <command>nixos-install</command>.</para></listitem> then re-run <command>nixos-install</command>.</para>
<para>As the last step, <command>nixos-install</command> will ask
you to set the password for the <literal>root</literal> user, e.g.
<screen>
setting root password...
Enter new UNIX password: ***
Retype new UNIX password: ***
</screen>
</para>
</listitem>
<listitem><para>If everything went well: <listitem><para>If everything went well:

View file

@ -42,6 +42,9 @@ the following steps:
and generates a GRUB configuration file that boots into the NixOS and generates a GRUB configuration file that boots into the NixOS
configuration just installed.</para></listitem> configuration just installed.</para></listitem>
<listitem><para>It prompts you for a password for the root
account.</para></listitem>
</itemizedlist> </itemizedlist>
</para> </para>

View file

@ -374,8 +374,8 @@ in {
security.initialRootPassword = mkOption { security.initialRootPassword = mkOption {
type = types.str; type = types.str;
default = ""; default = "!";
example = "!"; example = "";
description = '' description = ''
The (hashed) password for the root account set on initial The (hashed) password for the root account set on initial
installation. The empty string denotes that root can login installation. The empty string denotes that root can login
@ -383,9 +383,9 @@ in {
as SSH, or indirectly via <command>su</command> or as SSH, or indirectly via <command>su</command> or
<command>sudo</command>). The string <literal>!</literal> <command>sudo</command>). The string <literal>!</literal>
prevents root from logging in using a password. prevents root from logging in using a password.
Note, setting this option sets Note that setting this option sets
<literal>users.extraUsers.root.hashedPassword</literal>. <literal>users.extraUsers.root.hashedPassword</literal>.
Note, if <literal>users.mutableUsers</literal> is false Also, if <literal>users.mutableUsers</literal> is false
you cannot change the root password manually, so in that case you cannot change the root password manually, so in that case
the name of this option is a bit misleading, since it will define the name of this option is a bit misleading, since it will define
the root password beyond the user initialisation phase. the root password beyond the user initialisation phase.

View file

@ -73,16 +73,18 @@ fi
# Mount some stuff in the target root directory. We bind-mount /etc # Mount some stuff in the target root directory. We bind-mount /etc
# into the chroot because we need networking and the nixbld user # into the chroot because we need networking and the nixbld user
# accounts in /etc/passwd. But we do need the target's /etc/nixos. # accounts in /etc/passwd. But we do need the target's /etc/nixos.
mkdir -m 0755 -p $mountPoint/dev $mountPoint/proc $mountPoint/sys $mountPoint/etc mkdir -m 0755 -p $mountPoint/dev $mountPoint/proc $mountPoint/sys $mountPoint/etc $mountPoint/run
mkdir -m 01777 -p $mountPoint/tmp mkdir -m 01777 -p $mountPoint/tmp
mkdir -m 0755 -p $mountPoint/tmp/root mkdir -m 0755 -p $mountPoint/tmp/root
mkdir -m 0755 -p $mountPoint/var mkdir -m 0755 -p $mountPoint/var/setuid-wrappers
mount --rbind /dev $mountPoint/dev mount --rbind /dev $mountPoint/dev
mount --rbind /proc $mountPoint/proc mount --rbind /proc $mountPoint/proc
mount --rbind /sys $mountPoint/sys mount --rbind /sys $mountPoint/sys
mount --rbind / $mountPoint/tmp/root mount --rbind / $mountPoint/tmp/root
mount --bind /etc $mountPoint/etc mount --bind /etc $mountPoint/etc
mount --bind $mountPoint/tmp/root/$mountPoint/etc/nixos $mountPoint/etc/nixos mount --bind $mountPoint/tmp/root/$mountPoint/etc/nixos $mountPoint/etc/nixos
mount -t tmpfs -o "mode=0755" none $mountPoint/run
mount -t tmpfs -o "mode=0755" none $mountPoint/var/setuid-wrappers
# Create the necessary Nix directories on the target device, if they # Create the necessary Nix directories on the target device, if they
@ -215,3 +217,17 @@ touch $mountPoint/etc/NIXOS
echo "finalising the installation..." echo "finalising the installation..."
NIXOS_INSTALL_GRUB=1 chroot $mountPoint \ NIXOS_INSTALL_GRUB=1 chroot $mountPoint \
/nix/var/nix/profiles/system/bin/switch-to-configuration boot /nix/var/nix/profiles/system/bin/switch-to-configuration boot
# Run the activation script.
chroot $mountPoint /nix/var/nix/profiles/system/activate
# Ask the user to set a root password.
if [ -t 0 ] ; then
echo "setting root password..."
chroot $mountPoint passwd
fi
echo "installation finished!"

View file

@ -160,9 +160,4 @@ with lib;
environment.systemPackages = [ pkgs.cryptsetup ]; environment.systemPackages = [ pkgs.cryptsetup ];
boot.initrd.supportedFilesystems = [ "unionfs-fuse" ]; boot.initrd.supportedFilesystems = [ "unionfs-fuse" ];
# Prevent logging in as root without a password. This doesn't really matter,
# since the only PAM services that allow logging in with a null
# password are local ones that are inaccessible on EC2 machines.
security.initialRootPassword = mkDefault "!";
} }

View file

@ -117,7 +117,6 @@ in
modules = modules =
let extraConfig = let extraConfig =
{ boot.isContainer = true; { boot.isContainer = true;
security.initialRootPassword = mkDefault "!";
networking.hostName = mkDefault name; networking.hostName = mkDefault name;
networking.useDHCP = false; networking.useDHCP = false;
}; };

View file

@ -114,11 +114,6 @@ in
# Always include cryptsetup so that NixOps can use it. # Always include cryptsetup so that NixOps can use it.
environment.systemPackages = [ pkgs.cryptsetup ]; environment.systemPackages = [ pkgs.cryptsetup ];
# Prevent logging in as root without a password. This doesn't really matter,
# since the only PAM services that allow logging in with a null
# password are local ones that are inaccessible on Google Compute machines.
security.initialRootPassword = mkDefault "!";
# Configure default metadata hostnames # Configure default metadata hostnames
networking.extraHosts = '' networking.extraHosts = ''
169.254.169.254 metadata.google.internal metadata 169.254.169.254 metadata.google.internal metadata

View file

@ -64,7 +64,6 @@ sub writeNixOSConfig {
with lib; with lib;
{ boot.isContainer = true; { boot.isContainer = true;
security.initialRootPassword = mkDefault "!";
networking.hostName = mkDefault "$containerName"; networking.hostName = mkDefault "$containerName";
networking.useDHCP = false; networking.useDHCP = false;
$extraConfig $extraConfig

View file

@ -107,9 +107,4 @@ with lib;
boot.loader.grub.device = "/dev/sda"; boot.loader.grub.device = "/dev/sda";
services.virtualbox.enable = true; services.virtualbox.enable = true;
# Prevent logging in as root without a password. For NixOps, we
# don't need this because the user can login via SSH, and for the
# demo images, there is a demo user account that can sudo to root.
security.initialRootPassword = mkDefault "!";
} }