1

I'm building an embedded system that normally one would not log in to, but we need a way for developers to get in for debugging and development. The rootfs is normally read-only (but can be remounted read-write).

The scheme I'm looking at is keeping the root password locked (passwd -l). If a special file exists (on removable media), unlock the password so you can log in. After a reboot, if the special file doesn't exist, the password is locked again.

The special file is undocumented and would not be used by end users. Developers would normally create this file so they can log in at will. Another way to log in is an ssh client that opens a port forward to one of our servers allowing us to ssh in with key-based auth. For development, there needs to be a way to get in without the network.

It seems like the simplest way to implement this is something like this:

if passwd_is_locked and enable_login_exists:
    remount_rw()
    unlock_passwd()
    remount_ro()
elif not passwd_is_locked and not enable_login_exists:
    remount_rw()
    lock_passwd()
    remount_ro()
else:
    pass

I don't like remounting and modifying files; I'd rather some how have a transient alternate configuration (e.g. something in /tmp).

I dug into the passwd command a bit. It looks like it supports multiple sources for some data (--repository) via the Name Service Switch system (nsswitch.conf). I'm not sure that's a viable option, especially for the root account, because it seems like the root account should always fall back to the normal /etc/shadow file. I admit that I'm not much of a sysadmin, so maybe I just don't understand it.

passwd also has a --root option. I was able to get that to work by just doing cp -a /etc /lib /tmp && passwd --root /tmp which edits the files in /tmp. I'm not sure if I can do something useful with this.

If I change /etc/passwd et al to symlinks to some writable area, and it seems to work if I edit the files by hand, but I can't use the passwd command.

I'm not using PAM, but I could probably enable it if there's a good solution there.

0

I ended up using something like (inside the initrd):

if is_dev_mode ; then
    chroot $ROOTFS_MOUNT /usr/bin/passwd --delete root
else
    chroot $ROOTFS_MOUNT /usr/bin/passwd --lock root
fi
sync

This occurs before the rootfs is remounted read-only. I don't really like it, but I think it's better than using yet another unionfs (there are already several). The initrd's passwd doesn't have the fancy options that the main OS's does, but a chroot works just as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.