I'm building an embedded system that normally one would not log in to, but we need a way for developers to get in for debugging and development. The rootfs is normally read-only (but can be remounted read-write).
The scheme I'm looking at is keeping the root password locked (
passwd -l). If a special file exists (on removable media), unlock the password so you can log in. After a reboot, if the special file doesn't exist, the password is locked again.
The special file is undocumented and would not be used by end users. Developers would normally create this file so they can log in at will. Another way to log in is an ssh client that opens a port forward to one of our servers allowing us to ssh in with key-based auth. For development, there needs to be a way to get in without the network.
It seems like the simplest way to implement this is something like this:
if passwd_is_locked and enable_login_exists: remount_rw() unlock_passwd() remount_ro() elif not passwd_is_locked and not enable_login_exists: remount_rw() lock_passwd() remount_ro() else: pass
I don't like remounting and modifying files; I'd rather some how have a transient alternate configuration (e.g. something in
I dug into the
passwd command a bit. It looks like it supports multiple sources for some data (
--repository) via the Name Service Switch system (
nsswitch.conf). I'm not sure that's a viable option, especially for the root account, because it seems like the root account should always fall back to the normal
/etc/shadow file. I admit that I'm not much of a sysadmin, so maybe I just don't understand it.
passwd also has a
--root option. I was able to get that to work by just doing
cp -a /etc /lib /tmp && passwd --root /tmp which edits the files in
/tmp. I'm not sure if I can do something useful with this.
If I change
/etc/passwd et al to symlinks to some writable area, and it seems to work if I edit the files by hand, but I can't use the
I'm not using PAM, but I could probably enable it if there's a good solution there.