# How to keep from resetting user password

**URL:** <https://discourse.chef.io/t/how-to-keep-from-resetting-user-password/1564>\
**Category:** Chef Infra (archive)\
**Created:** [September 25, 2010, 6:47pm UTC](https://discourse.chef.io/t/how-to-keep-from-resetting-user-password/1564 "2010-09-25T18:47:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brad\_Pardee](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@Brad\_Pardee](https://discourse.chef.io/u/Brad_Pardee)\
**Post date:** [September 25, 2010, 6:47pm UTC](https://discourse.chef.io/t/how-to-keep-from-resetting-user-password/1564/1 "2010-09-25T18:47:11Z")

</div>

I want to use chef to maintain users with a default password while allowing the  
user to change their password. Each time I rerun chef-client, the user’s  
password gets reset. Is there a way I can keep it from resetting back to the  
default? I’m thinking about only adding the password param if the entry isn’t  
already in /etc/passwd but it seems like there should be an easier way?

---

<div class="post-metadata">

**Author:** ![Sahil\_R\_Cooner](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/sahil_r_cooner/32/773_2.png) [@Sahil\_R\_Cooner](https://discourse.chef.io/u/Sahil_R_Cooner)\
**Post date:** [September 25, 2010, 6:49pm UTC](https://discourse.chef.io/t/how-to-keep-from-resetting-user-password/1564/2 "2010-09-25T18:49:38Z")

</div>

write a script or web interface that stores the password hashes in a databag  
on the chef server for the users who changed their password and then pull  
that new hash value into your cookbook. this is currently how I did it, not  
sure if it's the best way but it works.

--sahil

On Sat, Sep 25, 2010 at 11:47 AM, [bpardee@clarityservices.com](mailto:bpardee@clarityservices.com) wrote:

> I want to use chef to maintain users with a default password while allowing  
> the  
> user to change their password. Each time I rerun chef-client, the user's  
> password gets reset. Is there a way I can keep it from resetting back to  
> the  
> default? I'm thinking about only adding the password param if the entry  
> isn't  
> already in /etc/passwd but it seems like there should be an easier way?

---

<div class="post-metadata">

**Author:** ![Joshua\_Timberman](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/joshua_timberman/32/424_2.png) [@Joshua\_Timberman](https://discourse.chef.io/u/Joshua_Timberman)\
**Post date:** [September 25, 2010, 7:08pm UTC](https://discourse.chef.io/t/how-to-keep-from-resetting-user-password/1564/3 "2010-09-25T19:08:06Z")

</div>

Is there a particular reason to have user passwords set?

I recommend not setting user passwords on the user definitions, only  
allow login via ssh with keys, and set sudo up for users that need  
root access with "NOPASSWD".

This is consistent with recommendations from security experts such as  
SANS Institute, too :).

On Sat, Sep 25, 2010 at 12:47 PM, [bpardee@clarityservices.com](mailto:bpardee@clarityservices.com) wrote:

> I want to use chef to maintain users with a default password while allowing the  
> user to change their password. Each time I rerun chef-client, the user's  
> password gets reset. Is there a way I can keep it from resetting back to the  
> default? I'm thinking about only adding the password param if the entry isn't  
> already in /etc/passwd but it seems like there should be an easier way?

--  
Opscode, Inc  
Joshua Timberman, Senior Solutions Engineer  
C: 720.878.4322 E: [joshua@opscode.com](mailto:joshua@opscode.com)

---

<div class="post-metadata">

**Author:** ![Sahil\_R\_Cooner](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/sahil_r_cooner/32/773_2.png) [@Sahil\_R\_Cooner](https://discourse.chef.io/u/Sahil_R_Cooner)\
**Post date:** [September 25, 2010, 7:09pm UTC](https://discourse.chef.io/t/how-to-keep-from-resetting-user-password/1564/4 "2010-09-25T19:09:21Z")

</div>

I like it that way too :).  
--sahil

On Sat, Sep 25, 2010 at 12:08 PM, Joshua Timberman [joshua@opscode.com](mailto:joshua@opscode.com)wrote:

> Is there a particular reason to have user passwords set?
> 
> I recommend not setting user passwords on the user definitions, only  
> allow login via ssh with keys, and set sudo up for users that need  
> root access with "NOPASSWD".
> 
> This is consistent with recommendations from security experts such as  
> SANS Institute, too :).
> 
> On Sat, Sep 25, 2010 at 12:47 PM, [bpardee@clarityservices.com](mailto:bpardee@clarityservices.com) wrote:
> 
> > I want to use chef to maintain users with a default password while  
> > allowing the  
> > user to change their password. Each time I rerun chef-client, the user's  
> > password gets reset. Is there a way I can keep it from resetting back to  
> > the  
> > default? I'm thinking about only adding the password param if the entry  
> > isn't  
> > already in /etc/passwd but it seems like there should be an easier way?
> 
> --  
> Opscode, Inc  
> Joshua Timberman, Senior Solutions Engineer  
> C: 720.878.4322 E: [joshua@opscode.com](mailto:joshua@opscode.com)

---

<div class="post-metadata">

**Author:** ![Brad\_Pardee](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@Brad\_Pardee](https://discourse.chef.io/u/Brad_Pardee)\
**Post date:** [September 25, 2010, 8:45pm UTC](https://discourse.chef.io/t/how-to-keep-from-resetting-user-password/1564/5 "2010-09-25T20:45:08Z")

</div>

Non-technical users just using the machine for sftp uploads.

I think I solved my problem by adding a getpwnam check:

```
password params[:password].crypt(params[:password]) if params[:password] && Etc.getpwnam(params[:name]).nil?

```

On Sep 25, 2010, at 3:08 PM, Joshua Timberman wrote:

> Is there a particular reason to have user passwords set?
> 
> I recommend not setting user passwords on the user definitions, only  
> allow login via ssh with keys, and set sudo up for users that need  
> root access with "NOPASSWD".
> 
> This is consistent with recommendations from security experts such as  
> SANS Institute, too :).
> 
> On Sat, Sep 25, 2010 at 12:47 PM, [bpardee@clarityservices.com](mailto:bpardee@clarityservices.com) wrote:
> 
> > I want to use chef to maintain users with a default password while allowing the  
> > user to change their password. Each time I rerun chef-client, the user's  
> > password gets reset. Is there a way I can keep it from resetting back to the  
> > default? I'm thinking about only adding the password param if the entry isn't  
> > already in /etc/passwd but it seems like there should be an easier way?
> 
> --  
> Opscode, Inc  
> Joshua Timberman, Senior Solutions Engineer  
> C: 720.878.4322 E: [joshua@opscode.com](mailto:joshua@opscode.com)