Compare commits

...

6 Commits

Author SHA1 Message Date
Brandon Philips
68202f3c06 feat(Documentation/cloud-config): add section about oem-release
We need to have cloud-config render a file about itself that can be
easily parsed and used by the rest of the system. Essentially just copy
the os-release format.
2014-03-16 16:47:44 -07:00
Brian Waldon
29b558caec Merge pull request #19 from bcwaldon/doc
doc(config): Fill in missing config options
2014-03-14 12:08:34 -07:00
Brian Waldon
a153ed02a7 doc(config): Fill in missing config options 2014-03-14 12:05:26 -07:00
Brian Waldon
b2eafb0efb Merge pull request #18 from brianredbeard/cloud-config-hashing
docs: Additional information on generating password hashes
2014-03-14 11:47:45 -07:00
Brian 'Redbeard' Harrington
98a19e6fc6 Moar hashing stuff
This time with less conflicts and a new file!
2014-03-14 11:42:17 -07:00
Brian Waldon
f0b5b2906b chore(release): Bump version to v0.1.2+git 2014-03-14 10:37:16 -07:00
2 changed files with 69 additions and 4 deletions

View File

@@ -13,7 +13,12 @@ Provided public SSH keys will be authorized for the `core` user.
The keys will be named "coreos-cloudinit" by default. The keys will be named "coreos-cloudinit" by default.
Override this with the `--ssh-key-name` flag when calling `coreos-cloudinit`. Override this with the `--ssh-key-name` flag when calling `coreos-cloudinit`.
#### users ### hostname
The provided value will be used to set the system's hostname.
This is the local part of a fully-qualified domain name (i.e. `foo` in `foo.example.com`).
### users
Add or modify users with the `users` directive by providing a list of user objects, each consisting of the following fields. Add or modify users with the `users` directive by providing a list of user objects, each consisting of the following fields.
Each field is optional and of type string unless otherwise noted. Each field is optional and of type string unless otherwise noted.
@@ -41,14 +46,58 @@ The following fields are not yet implemented:
##### Generating a password hash ##### Generating a password hash
You can generate a safe hash via: Generating a safe hash is important to the security of your system. Currently with updated tools like [oclhashcat](http://hashcat.net/oclhashcat/) simplified hashes like md5crypt are trivial to crack on modern GPU hardware. You can generate a "safer" hash (read: not safe, never publish your hashes publicly) via:
###### On Debian/Ubuntu (via the package "whois")
mkpasswd --method=SHA-512 --rounds=4096 mkpasswd --method=SHA-512 --rounds=4096
Using a higher number of rounds will help create more secure passwords, but given enough time, password hashes can be reversed. ###### With OpenSSL (note: this will only make md5crypt. While better than plantext it should not be considered fully secure)
openssl passwd -1
###### With Python (change password and salt values)
python -c "import crypt, getpass, pwd; print crypt.crypt('password', '\$6\$SALT\$')"
###### With Perl (change password and salt values)
perl -e 'print crypt("password","\$6\$SALT\$") . "\n"'
Using a higher number of rounds will help create more secure passwords, but given enough time, password hashes can be reversed. On most RPM based distributions there is a tool called mkpasswd available in the `expect` package, but this does not handle "rounds" nor advanced hashing algorithms.
### write_files
Inject an arbitrary set of files to the local filesystem.
Provide a list of objects with the following attributes:
- **path**: Absolute location on disk where contents should be written
- **content**: Data to write at the provided `path`
- **permissions**: String representing file permissions in octal notation (i.e. '0644')
- **owner**: User and group that should own the file written to disk. This is equivalent to the `<user>:<group>` argument to `chown <user>:<group> <path>`.
## Custom cloud-config Parameters ## Custom cloud-config Parameters
### coreos.oem
These fields are borrowed from the [os-release spec][os-release] and repurposed
as a way for cloud-init to know about the OEM partition on this machine.
- **id**: A lower case string identifying the oem.
- **version-id**: A lower case string identifying the version of the OEM. Example: `168.0.0`
- **name**: A name without the version that is suitable for presentation to the user.
- **home-url**: Link to the homepage of the provider or OEM.
- **bug-report-url***: Link to a place to file bug reports about this OEM partition.
cloudinit must render these fields down to an /etc/oem-release file on disk in the following format:
```
NAME=Rackspace
ID=rackspace
VERSION_ID=168.0.0
PRETTY_NAME="Rackspace Cloud Servers"
HOME_URL="http://www.rackspace.com/cloud/servers/"
BUG_REPORT_URL="https://github.com/coreos/coreos-overlay"
```
[os-release]: http://www.freedesktop.org/software/systemd/man/os-release.html
### coreos.etcd.discovery_url ### coreos.etcd.discovery_url
The value of `coreos.etcd.discovery_url` will be used to discover the instance's etcd peers using the [etcd discovery protocol][disco-proto]. Usage of the [public discovery service][disco-service] is encouraged. The value of `coreos.etcd.discovery_url` will be used to discover the instance's etcd peers using the [etcd discovery protocol][disco-proto]. Usage of the [public discovery service][disco-service] is encouraged.
@@ -129,3 +178,19 @@ users:
ssh-authorized-keys: ssh-authorized-keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0g+ZTxC7weoIJLUafOgrm+h... - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0g+ZTxC7weoIJLUafOgrm+h...
``` ```
### Inject configuration files
```
#cloud-config
write_files:
- path: /etc/hosts
contents: |
127.0.0.1 localhost
192.0.2.211 buildbox
- path: /etc/resolv.conf
contents: |
nameserver 192.0.2.13
nameserver 192.0.2.14
```

View File

@@ -10,7 +10,7 @@ import (
"github.com/coreos/coreos-cloudinit/cloudinit" "github.com/coreos/coreos-cloudinit/cloudinit"
) )
const version = "0.1.2" const version = "0.1.2+git"
func main() { func main() {
var userdata []byte var userdata []byte