From 0680c7e5b4ca1fd35de7641303d8d529da2deda7 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 17 Feb 2025 22:20:51 +0100 Subject: [PATCH 1/3] homectl: don't show --enforce-password-policy= recommendation in first-boot invocation The hint is not useful, since this is after all invoked as part of the boot process, and not from an interactive shell, where the user could directly retry with the changed switch. Hence let's simply suppress the hint for those cases. --- src/home/homectl.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/home/homectl.c b/src/home/homectl.c index 7acaf593018..f53a7be93a9 100644 --- a/src/home/homectl.c +++ b/src/home/homectl.c @@ -1407,7 +1407,7 @@ static int bus_message_append_blobs(sd_bus_message *m, Hashmap *blobs) { return sd_bus_message_close_container(m); } -static int create_home_common(sd_json_variant *input) { +static int create_home_common(sd_json_variant *input, bool show_enforce_password_policy_hint) { _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL; _cleanup_(user_record_unrefp) UserRecord *hr = NULL; _cleanup_hashmap_free_ Hashmap *blobs = NULL; @@ -1497,7 +1497,8 @@ static int create_home_common(sd_json_variant *input) { _cleanup_(erase_and_freep) char *new_password = NULL; log_error_errno(r, "%s", bus_error_message(&error, r)); - log_info("(Use --enforce-password-policy=no to turn off password quality checks for this account.)"); + if (show_enforce_password_policy_hint) + log_info("(Use --enforce-password-policy=no to turn off password quality checks for this account.)"); r = acquire_new_password(hr->user_name, hr, /* suggest = */ false, &new_password); if (r < 0) @@ -1550,7 +1551,7 @@ static int create_home(int argc, char *argv[], void *userdata) { return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "User name required."); } - return create_home_common(/* input= */ NULL); + return create_home_common(/* input= */ NULL, /* show_enforce_password_policy_hint= */ true); } static int remove_home(int argc, char *argv[], void *userdata) { @@ -2392,7 +2393,7 @@ static int create_from_credentials(void) { log_notice("Processing user '%s' from credentials.", e); - r = create_home_common(identity); + r = create_home_common(identity, /* show_enforce_password_policy_hint= */ false); if (r >= 0) n_created++; @@ -2682,7 +2683,7 @@ static int create_interactively(void) { return log_error_errno(r, "Failed to set shell field: %m"); } - return create_home_common(/* input= */ NULL); + return create_home_common(/* input= */ NULL, /* show_enforce_password_policy_hint= */ false); } static int verb_firstboot(int argc, char *argv[], void *userdata) { From 0e7dd5aa4d716f661afeef23d753992fe7fba5b6 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 17 Feb 2025 22:28:30 +0100 Subject: [PATCH 2/3] homectl: when asking for a user pw for an initial homed account at boot, don't insist on strong password It's just very annoying during debugging, and also unnecessary. --- src/home/homectl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/home/homectl.c b/src/home/homectl.c index f53a7be93a9..b2a7bc6c107 100644 --- a/src/home/homectl.c +++ b/src/home/homectl.c @@ -2549,6 +2549,18 @@ static int create_interactively(void) { if (r < 0) return log_error_errno(r, "Failed to set userName field: %m"); + /* Let's not insist on a strong password in the firstboot interactive interface. Insisting on this is + * really annoying, as the user cannot just invoke the tool again with "--enforce-password-policy=no" + * because after all the tool is called from the boot process, and not from an interactive + * shell. Moreover, when setting up an initial system we can assume the user owns it, and hence we + * don't need to hard enforce some policy on password strength some organization or OS vendor + * requires. Note that this just disables the *strict* enforcement of the password policy. Even with + * this disabled we'll still tell the user in the UI that the password is too weak and suggest better + * ones, even if we then accept the weak ones if the user insists, by repeating it. */ + r = sd_json_variant_set_field_boolean(&arg_identity_extra, "enforcePasswordPolicy", false); + if (r < 0) + return log_error_errno(r, "Failed to set enforcePasswordPolicy field: %m"); + _cleanup_strv_free_ char **available = NULL, **groups = NULL; for (;;) { _cleanup_free_ char *s = NULL; From 787904d0789f347c49acfad60cb12d63d336d432 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 17 Feb 2025 22:29:54 +0100 Subject: [PATCH 3/3] terminal-util: output newline at end of "Press any key to proceed" message So far we'd leave the cursor at the end of the Press any key to proceed message as long as the user didn't type in anything yet, and generated the newline only after. Let's switch this around: let's output the newline before. This should make boot-time output nicer since it means concurrent output while we wait will start at the beginning of line, and not in the middle. --- src/basic/terminal-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/basic/terminal-util.c b/src/basic/terminal-util.c index f9e2a280246..0a185776303 100644 --- a/src/basic/terminal-util.c +++ b/src/basic/terminal-util.c @@ -485,12 +485,12 @@ bool any_key_to_proceed(void) { fputs(ansi_highlight_magenta(), stdout); fputs("-- Press any key to proceed --", stdout); fputs(ansi_normal(), stdout); + fputc('\n', stdout); fflush(stdout); char key = 0; (void) read_one_char(stdin, &key, USEC_INFINITY, /* echo= */ false, /* need_nl= */ NULL); - fputc('\n', stdout); fputc('\n', stdout); fflush(stdout);