Saltstack create user : password is not set

Question

I am trying to automate the creation of my users with Saltstack.

I created a pillar conf:

users:
  homer:
    fullname: Homer Simpson
    uid: 1007
    gid: 1007
    groups:
      - sudo
      - adm
    crypt: $6H7kNJefhBeY
    pub_ssh_keys:
  - ssh-rsa ...

And in my state I use the following:

{% for username, details in pillar.get('users', {}).items() %}
{{ username }}:

  group:
    - present
    - name: {{ username }}
    - gid: {{ details.get('gid', '') }}

  user:
    - present
    - fullname: {{ details.get('fullname','') }}
    - name: {{ username }}
    - shell: /bin/bash
    - home: /home/{{ username }}
    - uid: {{ details.get('uid', '') }}
    - gid: {{ details.get('gid', '') }}
    - password: {{ details.get('crypt','') }}
    {% if 'groups' in details %}
    - groups:
      {% for group in details.get('groups', []) %}
      - {{ group }}
      {% endfor %}
    {% endif %}

  {% if 'pub_ssh_keys' in details %}
   ssh_auth:
    - present
    - user: {{ username }}
    - names:
    {% for pub_ssh_key in details.get('pub_ssh_keys', []) %}
      - {{ pub_ssh_key }}
    {% endfor %}
    - require:
     - user: {{ username }}
  {% endif %}

 {% endfor %}

The user creation is okay, ssh-rsa keys are added properly but my main isssue is with the password: I tried the following:

crypt: password
crypt: some-hash

But when I connect to my server, I have a wrong password issue for this user.

Can you tell me how can I generate a good password compliant with the format salt is expecting? Is there a special command to use to generate it ?

Thank you.

Answer 1

To create hashed user passwords in Debian/Ubuntu, usable in salt, I do the following:

apt-get install makepasswd
echo '<password>' | makepasswd --clearfrom=- --crypt-md5 | awk '{ print $2 }'

This gives e.g.: $id$salt$encrypted

The id in "$id$salt$encrypted" should be 1, meaning it's an md5 hash.

Copy/paste this hash into your pillar.

Hope this works for you as well.