lfg2025/archy
1
0
Fork 0
Code Issues 20 Pull Requests Actions Packages Projects Releases 61 Wiki Activity

fix(auth): sync OS login password when the UI password is set at install (#97)

Browse Source 
auth.setup only wrote the web password hash to user.json, so the
archipelago system user kept the image default password ("archipelago")
on console/SSH even after the user picked a real password during
onboarding. Reuse the existing usermod-based sync (already used by
auth.changePassword's alsoChangeSsh path) at setup time, best-effort so
a failure can never break onboarding.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago 2026-07-17 11:31:27 -04:00
parent 1ee1b56f70
commit ea0cd87b3b
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
core/archipelago/src/api/rpc/auth.rs
View File

@ -147,6 +147,15 @@ impl RpcHandler {
self.auth_manager.setup_user(password).await?; self.auth_manager.setup_user(password).await?;
tracing::info!("[onboarding] user setup complete"); tracing::info!("[onboarding] user setup complete");
// The install-time password must also become the OS login for the
// archipelago user — otherwise the console/SSH keeps the image default
// ("archipelago") after the user has picked a real password (#97).
// Best-effort: a failure here must not break onboarding.
match crate::auth::change_ssh_password(password).await {
Ok(()) => tracing::info!("[onboarding] system login password synced"),
Err(e) => tracing::warn!("[onboarding] system login password sync failed: {e}"),
}
// Persist the pending onboarding seed as the encrypted backup now that // Persist the pending onboarding seed as the encrypted backup now that
// a passphrase (the login password) finally exists — otherwise "Reveal // a passphrase (the login password) finally exists — otherwise "Reveal
// recovery phrase" has nothing to decrypt on this node, ever. // recovery phrase" has nothing to decrypt on this node, ever.

2
core/archipelago/src/auth.rs
View File

@ -360,7 +360,7 @@ fn validate_password_strength(password: &str) -> Result<()> {
/// Change the archipelago user's SSH/login password. /// Change the archipelago user's SSH/login password.
/// Uses usermod + openssl to bypass PAM (avoids "Authentication token manipulation" errors). /// Uses usermod + openssl to bypass PAM (avoids "Authentication token manipulation" errors).
/// Uses absolute paths (/usr/bin/openssl, /usr/sbin/usermod) for systemd's minimal PATH. /// Uses absolute paths (/usr/bin/openssl, /usr/sbin/usermod) for systemd's minimal PATH.
async fn change_ssh_password(new_password: &str) -> Result<()> { pub(crate) async fn change_ssh_password(new_password: &str) -> Result<()> {
let ssh_user = let ssh_user =
std::env::var("ARCHIPELAGO_SSH_USER").unwrap_or_else(|_| "archipelago".to_string()); std::env::var("ARCHIPELAGO_SSH_USER").unwrap_or_else(|_| "archipelago".to_string());