Set emergency login for core user with random password #3755

praveenkumar · 2023-07-13T08:20:02Z

This PR allow user to set the emergency login for core user with a random generated password. It is helpful when user lost the ssh access and use VMM to debug the issue which require password for core user.

Generated password is printed on stdout if user use cli to start the VM and also part of ~/.crc/crc.log in case want to access it later. In case of VM is started by api endpoint then password would be part of ~/.crc.crcd.log.

$ crc config set enable-emergency-login true
$ crc config view
- enable-emergency-login                : true
[...]
$ crc start
[...]
INFO CRC VM is running
INFO Emergency login password for core user is: Yf9OwP7y
INFO Updating authorized keys...
[...]

praveenkumar · 2023-07-13T08:20:40Z

This superseed #3689 and incorporate the suggestion in that PR.

gbraad · 2023-07-13T08:46:48Z

In case of VM is started by api endpoint then password would be part of ~/.crc.crcd.log.

Wouldn't this 'rotate' away ?
In case of desktop usage, you will never see this prompt. And the likelihood logs rotate this away before you need it is quite high

better leave it in a dedicated file or part of the instance crc.json

gbraad · 2023-07-13T09:05:58Z

pkg/crc/machine/start.go

+	for i := range b {
+		b[i] = charset[rand.Intn(len(charset))] //nolint
+	}
+	logging.Infof("Emergency login password for core user is: %s", b)


This will disappear from the log file when it is gets 'cleaned'/rotated.

@gbraad updated.

gbraad · 2023-07-13T14:16:32Z

pkg/crc/machine/start.go

+	for i := range b {
+		b[i] = charset[rand.Intn(len(charset))] //nolint
+	}
+	if err := os.WriteFile(constants.PasswdFilePath, b, 0600); err != nil {


remove on stop and when the setting has been disabled

@gbraad On the stop we shouldnt' remove it otherwise we need to also remove core user password on stop, IMO we just need to delete it during crc delete not crc stop action.

wouldn't it get a new password on restart?

I reiterated and now when stop => start happen and user unset enable-emergency-login setting then core user password is locked and from shell not able to login.

We don't regenerate the ssh key on start/stop/start, I don't think the user password needs to behave differently, so as long as enable-emergency-login is set, we can keep the same password until the VM is deleted.

I also don't think this should happen, but it is the behaviour that existed in the PR: "wouldn't it get a new password on restart?" was not something I implied being happy with, but rather an observation of the current suggestion.

cfergeau · 2023-07-17T15:23:39Z

pkg/crc/machine/start.go

+}
+
+func lockCoreUserPasswd(sshRunner *crcssh.Runner) error {
+	_, _, err := sshRunner.RunPrivileged("delete core user password", "passwd", "--lock", "core")


I'd name this disableEmergencyLogin for symmetry with enableEmergencyLogin, and the RunPrivileged string could be disable core user password

cfergeau · 2023-07-17T15:24:54Z

pkg/crc/machine/start.go

+	if err := lockCoreUserPasswd(sshRunner); err != nil {
+		return nil, errors.Wrap(err, "Error deleting the password for core user")
+	}
+	// VM started and SSH available, so we can enable the emergency login


I don't think this comment is needed.

cfergeau · 2023-07-17T15:26:18Z

pkg/crc/machine/start.go

@@ -417,6 +418,16 @@ func (client *client) Start(ctx context.Context, startConfig types.StartConfig)
 	}
 	logging.Info("CRC VM is running")

+	if err := lockCoreUserPasswd(sshRunner); err != nil {
+		return nil, errors.Wrap(err, "Error deleting the password for core user")


Should this be moved to an else in if startConfig.EmergencyLogin { as both operations exclusive

pkg/crc/machine/start.go

cfergeau

Apart from da66c4e#r1277594992 this looks good to me.

This PR allow user to set the emergency login for core user with a random generated password. It is helpful when user lost the ssh access and use VMM to debug the issue which require password for `core` user. Generated password is stored in `~/.crc/machine/crc/passwd` file which user can consume in case of debugging. When user unset the `enable-emergency-login` setting then password is locked for `core` user. ``` $ crc config set enable-emergency-login true $ crc config view - enable-emergency-login : true [...] $ crc start [...] INFO CRC VM is running INFO Emergency login password for core user is stored to /home/prkumar/.crc/machines/crc/passwd INFO Updating authorized keys... [...] ```

openshift-ci · 2023-08-07T12:17:02Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from cfergeau. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2023-08-07T14:13:16Z

@praveenkumar: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/integration-crc	`f4b61ec`	link	true	`/test integration-crc`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

praveenkumar · 2023-08-09T09:08:17Z

/retest

openshift-ci bot requested review from cfergeau and gbraad July 13, 2023 08:20

praveenkumar mentioned this pull request Jul 13, 2023

[WIP] Set emergency login for core user #3689

Closed

gbraad reviewed Jul 13, 2023

View reviewed changes

praveenkumar force-pushed the pr/3689 branch 2 times, most recently from 938e8bd to 0c5331c Compare July 13, 2023 10:00

gbraad requested changes Jul 13, 2023

View reviewed changes

openshift-ci bot assigned gbraad Jul 13, 2023

praveenkumar force-pushed the pr/3689 branch from 0c5331c to 0268b66 Compare July 14, 2023 06:49

cfergeau reviewed Jul 17, 2023

View reviewed changes

praveenkumar force-pushed the pr/3689 branch from 0268b66 to da66c4e Compare July 18, 2023 06:20

gbraad assigned praveenkumar Jul 26, 2023

cfergeau reviewed Jul 28, 2023

View reviewed changes

pkg/crc/machine/start.go Show resolved Hide resolved

cfergeau requested changes Jul 28, 2023

View reviewed changes

openshift-ci bot assigned cfergeau Jul 28, 2023

praveenkumar force-pushed the pr/3689 branch from da66c4e to f4b61ec Compare August 7, 2023 12:16

praveenkumar merged commit c7dca60 into crc-org:main Aug 9, 2023

anjannath mentioned this pull request Oct 17, 2023

[Feature] Debug option to add a password for the core user on startup #3677

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set emergency login for core user with random password #3755

Set emergency login for core user with random password #3755

praveenkumar commented Jul 13, 2023

praveenkumar commented Jul 13, 2023

gbraad commented Jul 13, 2023 •

edited

Loading

gbraad Jul 13, 2023

praveenkumar Jul 13, 2023

gbraad Jul 13, 2023

praveenkumar Jul 13, 2023

gbraad Jul 14, 2023

praveenkumar Jul 14, 2023

cfergeau Jul 17, 2023

gbraad Jul 31, 2023

cfergeau Jul 17, 2023

cfergeau Jul 17, 2023

cfergeau Jul 17, 2023

cfergeau left a comment

openshift-ci bot commented Aug 7, 2023

openshift-ci bot commented Aug 7, 2023 •

edited

Loading

praveenkumar commented Aug 9, 2023

Set emergency login for core user with random password #3755

Set emergency login for core user with random password #3755

Conversation

praveenkumar commented Jul 13, 2023

praveenkumar commented Jul 13, 2023

gbraad commented Jul 13, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cfergeau left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Aug 7, 2023

openshift-ci bot commented Aug 7, 2023 • edited Loading

praveenkumar commented Aug 9, 2023

gbraad commented Jul 13, 2023 •

edited

Loading

openshift-ci bot commented Aug 7, 2023 •

edited

Loading