admin_pass via MAAS

I can successfully use an SSL certificate and WinRM to set the Admin user password after a Windows image has been deployed by MAAS.

I understand that setting it via meta data is not really “secure”, but that works in our trusted environment. I’ve tried with the following user data passed in to user_data as a base64 encoded string:

#cloud-config

cloudbase-config
admin_pass: password

with cloudbase-init.conf:

[DEFAULT]
username=Admin
groups=Administrators
inject_user_password=true
first_logon_behaviour=no
config_drive_raw_hhd=true
config_drive_cdrom=true
config_drive_vfat=true
bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
verbose=true
debug=true
logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
logfile=cloudbase-init.log
default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
logging_serial_port_settings=COM1,115200,N,8
mtu_use_dhcp_config=true
ntp_use_dhcp_config=true
local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\

and cloudbase-init-unattend.conf:

[DEFAULT]
username=Admin
groups=Administrators
inject_user_password=true
first_logon_behaviour=no
config_drive_raw_hhd=true
config_drive_cdrom=true
config_drive_vfat=true
bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
verbose=true
debug=true
logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
logfile=cloudbase-init-unattend.log
default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
logging_serial_port_settings=COM1,115200,N,8
mtu_use_dhcp_config=true
ntp_use_dhcp_config=true
local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
metadata_services=cloudbaseinit.metadata.services.configdrive.ConfigDriveService,cloudbaseinit.metadata.services.httpservice.HttpService,cloudbaseinit.metadata.services.ec2service.EC2Service,cloudbaseinit.metadata.services.maasservice.MaaSHttpService
plugins=cloudbaseinit.plugins.common.mtu.MTUPlugin,cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,cloudbaseinit.plugins.windows.extendvolumes.ExtendVolumesPlugin
allow_reboot=false
stop_service_on_exit=false
check_latest_version=false

But each time I’m still prompted to change the password when host first boots. This is problematic for us as the devices are headless Intel NUCs with no IPMI (we are using a custom Eaton power driver to control power state - see: https://code.launchpad.net/~adacre/maas/+git/maas/+merge/377439)

[ader1990]

Once https://review.opendev.org/#/c/379354 gets merged, there should not be any configuration change from your side. You just need to define the userdata in cloud=config format similar to:

Note that cloudbase-init beta installer gets rebuilt once a day.

#cloud-config
users:
  -
    name: Admin
    primary_group: Administrators
    passwd: StrongPassw0rd

After user/groups support for cloud-config gets merged, when a user gets created using the cloud-config information, its password does not expire.

[ader1990]

Hello @dacron,

Did you manage to solve your requirements by using users/groups cloud-config directives?

Thank you, Adrian Vladu