|
|
|
@@ -13,7 +13,12 @@ Provided public SSH keys will be authorized for the `core` user.
|
|
|
|
|
The keys will be named "coreos-cloudinit" by default.
|
|
|
|
|
Override this with the `--ssh-key-name` flag when calling `coreos-cloudinit`.
|
|
|
|
|
|
|
|
|
|
#### users
|
|
|
|
|
### hostname
|
|
|
|
|
|
|
|
|
|
The provided value will be used to set the system's hostname.
|
|
|
|
|
This is the local part of a fully-qualified domain name (i.e. `foo` in `foo.example.com`).
|
|
|
|
|
|
|
|
|
|
### users
|
|
|
|
|
|
|
|
|
|
Add or modify users with the `users` directive by providing a list of user objects, each consisting of the following fields.
|
|
|
|
|
Each field is optional and of type string unless otherwise noted.
|
|
|
|
@@ -41,14 +46,58 @@ The following fields are not yet implemented:
|
|
|
|
|
|
|
|
|
|
##### Generating a password hash
|
|
|
|
|
|
|
|
|
|
You can generate a safe hash via:
|
|
|
|
|
Generating a safe hash is important to the security of your system. Currently with updated tools like [oclhashcat](http://hashcat.net/oclhashcat/) simplified hashes like md5crypt are trivial to crack on modern GPU hardware. You can generate a "safer" hash (read: not safe, never publish your hashes publicly) via:
|
|
|
|
|
|
|
|
|
|
###### On Debian/Ubuntu (via the package "whois")
|
|
|
|
|
mkpasswd --method=SHA-512 --rounds=4096
|
|
|
|
|
|
|
|
|
|
Using a higher number of rounds will help create more secure passwords, but given enough time, password hashes can be reversed.
|
|
|
|
|
###### With OpenSSL (note: this will only make md5crypt. While better than plantext it should not be considered fully secure)
|
|
|
|
|
openssl passwd -1
|
|
|
|
|
|
|
|
|
|
###### With Python (change password and salt values)
|
|
|
|
|
python -c "import crypt, getpass, pwd; print crypt.crypt('password', '\$6\$SALT\$')"
|
|
|
|
|
|
|
|
|
|
###### With Perl (change password and salt values)
|
|
|
|
|
perl -e 'print crypt("password","\$6\$SALT\$") . "\n"'
|
|
|
|
|
|
|
|
|
|
Using a higher number of rounds will help create more secure passwords, but given enough time, password hashes can be reversed. On most RPM based distributions there is a tool called mkpasswd available in the `expect` package, but this does not handle "rounds" nor advanced hashing algorithms.
|
|
|
|
|
|
|
|
|
|
### write_files
|
|
|
|
|
|
|
|
|
|
Inject an arbitrary set of files to the local filesystem.
|
|
|
|
|
Provide a list of objects with the following attributes:
|
|
|
|
|
|
|
|
|
|
- **path**: Absolute location on disk where contents should be written
|
|
|
|
|
- **content**: Data to write at the provided `path`
|
|
|
|
|
- **permissions**: String representing file permissions in octal notation (i.e. '0644')
|
|
|
|
|
- **owner**: User and group that should own the file written to disk. This is equivalent to the `<user>:<group>` argument to `chown <user>:<group> <path>`.
|
|
|
|
|
|
|
|
|
|
## Custom cloud-config Parameters
|
|
|
|
|
|
|
|
|
|
### coreos.oem
|
|
|
|
|
|
|
|
|
|
These fields are borrowed from the [os-release spec][os-release] and repurposed
|
|
|
|
|
as a way for cloud-init to know about the OEM partition on this machine.
|
|
|
|
|
|
|
|
|
|
- **id**: A lower case string identifying the oem.
|
|
|
|
|
- **version-id**: A lower case string identifying the version of the OEM. Example: `168.0.0`
|
|
|
|
|
- **name**: A name without the version that is suitable for presentation to the user.
|
|
|
|
|
- **home-url**: Link to the homepage of the provider or OEM.
|
|
|
|
|
- **bug-report-url***: Link to a place to file bug reports about this OEM partition.
|
|
|
|
|
|
|
|
|
|
cloudinit must render these fields down to an /etc/oem-release file on disk in the following format:
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
NAME=Rackspace
|
|
|
|
|
ID=rackspace
|
|
|
|
|
VERSION_ID=168.0.0
|
|
|
|
|
PRETTY_NAME="Rackspace Cloud Servers"
|
|
|
|
|
HOME_URL="http://www.rackspace.com/cloud/servers/"
|
|
|
|
|
BUG_REPORT_URL="https://github.com/coreos/coreos-overlay"
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
[os-release]: http://www.freedesktop.org/software/systemd/man/os-release.html
|
|
|
|
|
|
|
|
|
|
### coreos.etcd.discovery_url
|
|
|
|
|
|
|
|
|
|
The value of `coreos.etcd.discovery_url` will be used to discover the instance's etcd peers using the [etcd discovery protocol][disco-proto]. Usage of the [public discovery service][disco-service] is encouraged.
|
|
|
|
@@ -129,3 +178,19 @@ users:
|
|
|
|
|
ssh-authorized-keys:
|
|
|
|
|
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0g+ZTxC7weoIJLUafOgrm+h...
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### Inject configuration files
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
#cloud-config
|
|
|
|
|
|
|
|
|
|
write_files:
|
|
|
|
|
- path: /etc/hosts
|
|
|
|
|
contents: |
|
|
|
|
|
127.0.0.1 localhost
|
|
|
|
|
192.0.2.211 buildbox
|
|
|
|
|
- path: /etc/resolv.conf
|
|
|
|
|
contents: |
|
|
|
|
|
nameserver 192.0.2.13
|
|
|
|
|
nameserver 192.0.2.14
|
|
|
|
|
```
|
|
|
|
|