I've tried the following Puppet configuration to disable the root password:
class users {
user { 'root':
password => '*',
}
}
But after applying it with no warnings or error messages I could still su -
with the old password. Only after inspecting the debug output did it become clear why:
# puppet apply --debug --modulepath modules manifests/host.pp
[...]
Debug: Failed to load library 'shadow' for feature 'libshadow'
[...]
Wat. I know how to fix this (sudo pacman --sync --needed --refresh ruby-shadow
), but that's not the point. How do I force Puppet to crash and burn when it can't apply my configuration, at the very least by giving a non-zero exit code? --detailed-exitcodes
doesn't help.
Workaround: The following only works if run twice - on the first run it ignores the user
entry when compiling the catalogue.
class users {
package { 'ruby-shadow':
ensure => present,
}
user { 'root':
password => '*',
require => Package['ruby-shadow'],
}
}