CloudStack reset password not working

Bug #1440263 reported by pdion891
28
This bug affects 4 people
Affects Status Importance Assigned to Milestone
cloud-init
Fix Released
Undecided
Unassigned
cloud-init (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

CloudStack provide password reset for existing VM [1]. when generating a new random password for user using the cloudstack API: resetPasswordForVirtualMachine, it is not considered by cloud-init at the restart of the VM.

This has been experienced with cloud-init 0.7.7

[1] http://cloudstack.apache.org/docs/api/apidocs-4.5/root_admin/resetPasswordForVirtualMachine.html

Related branches

Revision history for this message
pdion891 (pdion891) wrote :

current method to support password reset with cloud-init is to use CloudStack default script and execute it from the /var/lib/cloud/scripts/per-boot.

pdion891 (pdion891)
summary: - cloudstack reset password not working
+ CloudStack reset password not working
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cloud-init (Ubuntu):
status: New → Confirmed
Revision history for this message
Erik Weber (terbolous) wrote :

I'm having issues where the core cloud-init fetches the password before the per-boot script is run, thus invalidating the functionality (passwords can only be fetched once).

IMHO, the datasourceprovider should only fetch the password if it intends to do anything with it, which afaik is on the first boot only.

Revision history for this message
Dan Watkins (oddbloke) wrote :

Hi pdion891, Erik,

Thanks for taking the time to report this bug, we're always keen to improve the cloud-init experience for users.

I believe that you're seeing this because the set_passwords module runs PER_INSTANCE. Could you try spinning up a test instance and modifying cloudinit/config/cc_set_passwords.py to include:

from cloudinit.settings import PER_ALWAYS
frequency = PER_ALWAYS

and see if that makes a difference to the behaviour?

Thanks,

Dan

Revision history for this message
Dan Watkins (oddbloke) wrote :

(You'll find the cloudinit directory in /usr/lib/python2.7/dist-packages, or /usr/lib/python3/dist-packages on vivid)

Revision history for this message
Thomas Moroder (server24) (cloudstack-t) wrote :

The problem has two (possible) causes:

(1) the cloud-init scripts only run once per instance, this can be fixed by Dan Watkings' addition above;

(2) when using ACS 4.5.1 with newer sytem-templates, the password server now responds correctly with full HTTP-headers (and is also a lot faster). This is a great improvement and both the old and the new response-type work with "wget" as used in the legacy cloudstack-set-guest-password scripts, but not in cloud-init as there is specific python-code to circumvent the missing HTTP-headers in /usr/lib/python2.7/dist-packages/cloudinit/sources/DataSourceCloudStack.py. With the update Virtual Router from ACS 4.5.1 and the cloud-init scripts the get_password call returns "HTTP/1.0 200 OK" instead of the password!

It is not easy to fix this generally, as old versions of the CloudStack System-VR will work with cloud-init as per (1), but will not work with newer versions. What is more, the password "HTTP/1.0 200 OK" is also a possible security problem.

My suggestion would be to switch to using wget in this fashion:

                password=$(wget -q -t 3 -T 20 -O - --header "DomU_Request: send_my_password" $PASSWORD_SERVER_IP:8080)
                password=$(echo $password | tr -d '\r')

This works correctly for both CloudStack-Versions.

My patched DataSourceCloudStack.py looks like this starting from line 82:

    def get_password(self):
        # password = self._do_request('send_my_password')
        password=$(wget -q -t 3 -T 20 -O - --header "DomU_Request: send_my_password" $PASSWORD_SERVER_IP:8080)
        password=$(echo $password | tr -d '\r')

        if password in ['', 'saved_password']:
            return None
        if password == 'bad_request':
            raise RuntimeError('Error when attempting to fetch root password.')
        self._do_request('saved_password')
        return password

Any thoughts about this?

Thomas Moroder
server24

Revision history for this message
Thomas Moroder (server24) (cloudstack-t) wrote :

Sorry, my patch for DataSourceCloudStack.py does not work because instead of $PASSWORD_SERVER_IP, self.virtual_router_address has to be used (it was working in my test setup as I call the legacy cloudstack set guest password script thereafter), but the cause of the issue is really the now correctly responding password-server included in the new systemvm-templates of ACS 4.5.1.

Thomas Moroder

Revision history for this message
Thomas Moroder (server24) (cloudstack-t) wrote :

(you can verify this by trying to use "HTTP/1.0 200 OK" as password :D)

Thomas Moroder

Revision history for this message
Dan Watkins (oddbloke) wrote :

Thomas,

Could you test the code in the branch that is now attached to this bug and see if that solves your problem?

Thanks,

Dan

Revision history for this message
Thomas Moroder (server24) (cloudstack-t) wrote :

Dan,

thank you for providing this patch, I am testing it right now and will let you know ASAP.

Sincerely,
Thomas Moroder
server24

Revision history for this message
Thomas Moroder (server24) (cloudstack-t) wrote :

Dan,

I have tested this script against Ubuntu 14.04 in our cloud and now it works flawlessly, but in addition to the patch provided the file:

/usr/lib/python2.7/dist-packages/cloudinit/config/cc_set_passwords.py

adding the following:

...
from cloudinit import util

from string import letters, digits # pylint: disable=W0402

+# new passwords need to be set at every boot if available
+from cloudinit.settings import PER_ALWAYS
+frequency = PER_ALWAYS

# We are removing certain 'painful' letters/numbers
PW_SET = (letters.translate(None, 'loLOI') +
          digits.translate(None, '01'))
...

Maybe you can add this also to your patch so that the implementation is complete.

If both are applied, the cloud-init scripts work correctly with ACS 4.5.1 at least in our reference cloud, thank you!

Sincerely,
Thomas Moroder
server24

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.7~bzr1127-0ubuntu1

---------------
cloud-init (0.7.7~bzr1127-0ubuntu1) wily; urgency=medium

  [ Scott Moser ]
  * d/README.source, debian/cherry-pick-rev: improve packaging tool

  [ Daniel Watkins ]
  * d/cloud-init.templates: Include SmartOS data source in the default list
    and choices. (LP: #1398997)

  [ Scott Moser ]
  * New upstream snapshot.
    * check for systemd using sd_booted symantics (LP: #1461201)
    * fix importing of gpg keys in python3 (LP: #1463373)
    * fix specification of devices to growpart (LP: #1465436)
    * reliably detect and use Azure disks using udev rules (LP: #1411582)
    * support selection of Ubuntu mirrors on GCE (LP: #1470890)
    * ssh: generate ed25519 host keys if supported (LP: #1461242)
    * test fixes and cleanups
    * fix reading of availability-zone on GCE (LP: #1470880)
    * fix cloudsigma datasource with python3 (LP: #1475215)
    * fix rightscale user-data
    * fix consumption of CloudStack passwords on newer CloudStack platforms
      (LP: #1440263, #1464253)

 -- Scott Moser <email address hidden> Wed, 22 Jul 2015 17:06:18 -0400

Changed in cloud-init (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Nux-m (nux-m) wrote :

Do you know if these fixed packages have made it into the latest Ubuntu cloud images? Or when they are scheduled to be added to them?

Revision history for this message
Erik Weber (terbolous) wrote :

Yes, would appreciate if this was backported to trusty as well.

Revision history for this message
Nux-m (nux-m) wrote :

+1 for the backport to 14.04

Revision history for this message
ozhan (ozhankaraman) wrote :

+1 for the backport to 14.04 and also this password reset feature does not work on 16.04 release

andi (andi0987654321)
information type: Public → Public Security
andi (andi0987654321)
information type: Public Security → Public
Revision history for this message
Vincent Bernat (vbernat) wrote :

This bug is closed but the original issue hasn't been solved. From my understanding, the only change that was applied was to use "wget". The fact that a password reset doesn't work is still present. Switching cc_set_passwords.py to PER_ALWAYS is still needed, right?

Revision history for this message
Vincent Bernat (vbernat) wrote :

A bit more information:

 - cloud-init steals the password, so it may not be possible to rely on another CS-specific component to set it

 - CS-provided script is not equivalent since it modifies the password for root, while Cloud Init will modify the password for the default user. On first boot, if we use both, we may have some kind of race condition. If CS executes first, the password is for root. Otherwise, it's for ubuntu. On subsequent boots, the password is for root.

Revision history for this message
pdion891 (pdion891) wrote :

We have tested cloud-init on Ubuntu 16.04 with cloudstack as datasource. The following cloud-init config work well, we can set and reset the password for the user define in cloud-init

```
cloud_config_modules:
 - [ set-passwords, always ]
```

Thanks a lot for this fix!

Joshua Powers (powersj)
Changed in cloud-init:
status: New → Fix Committed
Revision history for this message
Scott Moser (smoser) wrote :

based on ubuntu fix, this should be in any cloud-init >= 0.7.8.
marking fix-released.

Changed in cloud-init:
status: Fix Committed → Fix Released
Revision history for this message
James Falcon (falcojr) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.