Puppet users - Oct 2007 - user management

Hello,

I would like to use puppet to manage my user accounts.  I also have a 
requirement to do things like password aging on the systems, and 
enforcing strong passwords.

I can create a user just fine with the user class and have it assign a 
password to the account.  If I change the password on the local machine, 
puppet will reset it to the password specified in my user class.  Is 
there a built in way I can tell puppet to only set the password one 
time, and allow the system to manage it at that point?

I''m running centos5 with the ruby-shadow libs installed, and puppet
0.23.2

Thanks
-Adam

On Oct 26, 2007, at 3:47 PM, Adam Crews wrote:
> I would like to use puppet to manage my user accounts.  I also have a
> requirement to do things like password aging on the systems, and
> enforcing strong passwords.
>
> I can create a user just fine with the user class and have it assign a
> password to the account.  If I change the password on the local  
> machine,
> puppet will reset it to the password specified in my user class.  Is
> there a built in way I can tell puppet to only set the password one
> time, and allow the system to manage it at that point?
There''s no way to do that with Puppet.  It''s really much
better at
managing system users, which don''t normally have passwords, than  
normal users.

  --
  The time to repair the roof is when the sun is shining.
          -- John F. Kennedy
  ---------------------------------------------------------------------
  Luke Kanies | http://reductivelabs.com | http://madstop.com

You could always use something like npasswd to manage the
password complexity requirements on a single host
(puppetmaster) and then use puppet to push the resulting
password file out to all other systems.  The drawback is that
users have to maintain their passwords on a single host and
have to keep them the same everywhere.

Link: http://www.utexas.edu/cc/unix/software/npasswd/




---- Original message ----
>Date: Sun, 28 Oct 2007 15:24:46 -0500
>From: Luke Kanies <luke@madstop.com>  
>Subject: Re: [Puppet-users] user management  
>To: Puppet User Discussion <puppet-users@madstop.com>
>
>On Oct 26, 2007, at 3:47 PM, Adam Crews wrote:
>
>> I would like to use puppet to manage my user accounts.  I
also have a
>> requirement to do things like password aging on the
systems, and
>> enforcing strong passwords.
>>
>> I can create a user just fine with the user class and have
it assign a
>> password to the account.  If I change the password on the
local  
>> machine,
>> puppet will reset it to the password specified in my user
class.  Is
>> there a built in way I can tell puppet to only set the
password one
>> time, and allow the system to manage it at that point?
>
>There''s no way to do that with Puppet.  It''s really much
better at  
>managing system users, which don''t normally have passwords,
than  
>normal users.
>
>  --
>  The time to repair the roof is when the sun is shining.
>          -- John F. Kennedy
> 
---------------------------------------------------------------------
>  Luke Kanies | http://reductivelabs.com | http://madstop.com
>
>
>_______________________________________________
>Puppet-users mailing list
>Puppet-users@madstop.com
>https://mail.madstop.com/mailman/listinfo/puppet-users