# Removing root's password results in 'ruby-shadow not installed' error

**URL:** <https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863>\
**Category:** Chef Infra (archive)\
**Created:** [May 4, 2011, 12:36am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863 "2011-05-04T00:36:35Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![jasonjwwilliams](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jasonjwwilliams/32/101_2.png) [@jasonjwwilliams](https://discourse.chef.io/u/jasonjwwilliams)\
**Post date:** [May 4, 2011, 12:36am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/1 "2011-05-04T00:36:35Z")

</div>

Hi,

I’m trying to write a recipe that will create a default user and  
remove root’s password on an Ubuntu 10.04 box. Creating the user (with  
password) works fine. However, when it hits this:

user “root” do  
action :modify  
password "\*"  
end

I get this traceback about ruby-shadow not being installed:  
[https://gist.github.com/954522](https://gist.github.com/954522)

I’ve tried setting the root password to an actual hash but I get the  
same error. Any help is greatly appreciated.

-J

---

<div class="post-metadata">

**Author:** ![Bryan\_McLellan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bryan_mclellan/32/81_2.png) [@Bryan\_McLellan](https://discourse.chef.io/u/Bryan_McLellan)\
**Post date:** [May 4, 2011, 12:43am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/2 "2011-05-04T00:43:59Z")

</div>

On Tue, May 3, 2011 at 5:36 PM, Jason J. W. Williams  
[jasonjwwilliams@gmail.com](mailto:jasonjwwilliams@gmail.com) wrote:

> I get this traceback about ruby-shadow not being installed:  
> [https://gist.github.com/954522](https://gist.github.com/954522)

You need the ruby-shadow library for modifying a user password. It  
isn't installed by the gems as a dependency because it is optional.

sudo gem install ruby-shadow

> I've tried setting the root password to an actual hash but I get the  
> same error. Any help is greatly appreciated.

This should be a hash.

[http://wiki.opscode.com/display/chef/Resources#Resources-User](http://wiki.opscode.com/display/chef/Resources#Resources-User)

Bryan

---

<div class="post-metadata">

**Author:** ![Jay\_Buffington](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jay_buffington/32/828_2.png) [@Jay\_Buffington](https://discourse.chef.io/u/Jay_Buffington)\
**Post date:** [May 4, 2011, 12:44am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/3 "2011-05-04T00:44:54Z")

</div>

From [http://wiki.opscode.com/display/chef/Resources](http://wiki.opscode.com/display/chef/Resources)  
"In order to use the "password" attribute in Chef 0.5.6, you must have  
"ruby-shadow" installed. You can get this by installing the debian  
package "libshadow-ruby1.8"."

Jay

On Tue, May 3, 2011 at 5:36 PM, Jason J. W. Williams  
[jasonjwwilliams@gmail.com](mailto:jasonjwwilliams@gmail.com) wrote:

> Hi,
> 
> I'm trying to write a recipe that will create a default user and  
> remove root's password on an Ubuntu 10.04 box. Creating the user (with  
> password) works fine. However, when it hits this:
> 
> user "root" do  
> action :modify  
> password "\*"  
> end
> 
> I get this traceback about ruby-shadow not being installed:  
> [https://gist.github.com/954522](https://gist.github.com/954522)
> 
> I've tried setting the root password to an actual hash but I get the  
> same error. Any help is greatly appreciated.
> 
> -J

---

<div class="post-metadata">

**Author:** ![Ian\_Marlier](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/ian_marlier/32/601_2.png) [@Ian\_Marlier](https://discourse.chef.io/u/Ian_Marlier)\
**Post date:** [May 4, 2011, 12:46am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/4 "2011-05-04T00:46:09Z")

</div>

'Gem install ruby-shadow' on Ruby 1.8. On 1.9 its trickier. Check the  
branch at github under user apalmblad- it builds and installs fine on an  
ubuntu system with Ruby 1.9 and build-essentials.  
On May 3, 2011 8:36 PM, "Jason J. W. Williams" [jasonjwwilliams@gmail.com](mailto:jasonjwwilliams@gmail.com)  
wrote:

> Hi,
> 
> I'm trying to write a recipe that will create a default user and  
> remove root's password on an Ubuntu 10.04 box. Creating the user (with  
> password) works fine. However, when it hits this:
> 
> user "root" do  
> action :modify  
> password "\*"  
> end
> 
> I get this traceback about ruby-shadow not being installed:  
> [https://gist.github.com/954522](https://gist.github.com/954522)
> 
> I've tried setting the root password to an actual hash but I get the  
> same error. Any help is greatly appreciated.
> 
> -J

---

<div class="post-metadata">

**Author:** ![Bryan\_McLellan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bryan_mclellan/32/81_2.png) [@Bryan\_McLellan](https://discourse.chef.io/u/Bryan_McLellan)\
**Post date:** [May 4, 2011, 12:46am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/5 "2011-05-04T00:46:29Z")

</div>

On Tue, May 3, 2011 at 5:36 PM, Jason J. W. Williams  
[jasonjwwilliams@gmail.com](mailto:jasonjwwilliams@gmail.com) wrote:

> user "root" do  
> action :modify  
> password "\*"  
> end

Also, there's a "lock" action.

[http://wiki.opscode.com/display/chef/Resources#Resources-User](http://wiki.opscode.com/display/chef/Resources#Resources-User)

Bryan

---

<div class="post-metadata">

**Author:** ![jasonjwwilliams](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jasonjwwilliams/32/101_2.png) [@jasonjwwilliams](https://discourse.chef.io/u/jasonjwwilliams)\
**Post date:** [May 4, 2011, 12:51am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/6 "2011-05-04T00:51:11Z")

</div>

Hi Bryan,

> You need the ruby-shadow library for modifying a user password. It  
> isn't installed by the gems as a dependency because it is optional.

Actually I do this already in the recipe at the beginning, just not  
included in that snippet:

gem\_package "ruby-shadow" do  
action :install  
end

> This should be a hash.

Since I want to remove the password how do you do a hash of nothing?  
😉 Setting it '\*' was a guess that it was just setting the password  
field in /etc/shadow directly.

-J

---

<div class="post-metadata">

**Author:** ![Bryan\_McLellan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bryan_mclellan/32/81_2.png) [@Bryan\_McLellan](https://discourse.chef.io/u/Bryan_McLellan)\
**Post date:** [May 4, 2011, 12:54am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/7 "2011-05-04T00:54:27Z")

</div>

On Tue, May 3, 2011 at 5:51 PM, Jason J. W. Williams  
[jasonjwwilliams@gmail.com](mailto:jasonjwwilliams@gmail.com) wrote:

> gem\_package "ruby-shadow" do  
> action :install  
> end

Does this error happen on a second run?

Are you installing from debs or gems?

> Since I want to remove the password how do you do a hash of nothing?  
> 😉 Setting it '\*' was a guess that it was just setting the password  
> field in /etc/shadow directly.

Use "action :lock" which I failed to mention at first.

Bryan

---

<div class="post-metadata">

**Author:** ![jasonjwwilliams](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jasonjwwilliams/32/101_2.png) [@jasonjwwilliams](https://discourse.chef.io/u/jasonjwwilliams)\
**Post date:** [May 4, 2011, 1:16am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/8 "2011-05-04T01:16:19Z")

</div>

> Does this error happen on a second run?

Creating the "test-user" account with a password specified does not  
throw the error. Only modifying the "root" account afterwards.

> Are you installing from debs or gems?

Using gem\_package to force installation from gems.

> Use "action :lock" which I failed to mention at first.

:lock will set the shadow password field to "\*"?

-J

---

<div class="post-metadata">

**Author:** ![Bryan\_McLellan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bryan_mclellan/32/81_2.png) [@Bryan\_McLellan](https://discourse.chef.io/u/Bryan_McLellan)\
**Post date:** [May 4, 2011, 1:50am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/9 "2011-05-04T01:50:16Z")

</div>

On Tue, May 3, 2011 at 6:16 PM, Jason J. W. Williams  
[jasonjwwilliams@gmail.com](mailto:jasonjwwilliams@gmail.com) wrote:

> > Are you installing from debs or gems?
> 
> Using gem\_package to force installation from gems.

Are you install Chef from gems or debs?

> > Use "action :lock" which I failed to mention at first.
> 
> :lock will set the shadow password field to "\*"?

This depends on your platform. On Linux, the account lock feature adds  
an "!" to the beginning of the password field. The user can no longer  
log in using this password. This does allow you to later unlock the  
account and return to the previous password. On Linux, chef utilizes  
"usermod -L" to lock an account, which acts this way.

I suppose you could set the password to "\*" using the password  
attribute. Since we're normally writing directly to this field through  
the shadow library, that may work.

Please keep in mind that neither of these options prevent login to an  
account on Linux, they only prohibit login using a password. Often  
people disable root login via ssh in the sshd\_config and delete other  
users when they are no longer needed. Alternately you could expire the  
account (chage -E 1 user)

Bryan

---

<div class="post-metadata">

**Author:** ![jasonjwwilliams](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jasonjwwilliams/32/101_2.png) [@jasonjwwilliams](https://discourse.chef.io/u/jasonjwwilliams)\
**Post date:** [May 4, 2011, 2:13am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/10 "2011-05-04T02:13:17Z")

</div>

> Are you install Chef from gems or debs?

Debs.

> I suppose you could set the password to "\*" using the password  
> attribute. Since we're normally writing directly to this field through  
> the shadow library, that may work.

Setting the password attribute to "\*" is what appears to trigger the  
issue. Locking the account works fine though.

> Please keep in mind that neither of these options prevent login to an  
> account on Linux, they only prohibit login using a password. Often  
> people disable root login via ssh in the sshd\_config and delete other  
> users when they are no longer needed. Alternately you could expire the  
> account (chage -E 1 user)

Root login is also disabled in sshd\_config. The goal is to prevent  
login with a password to the root account. If a privileged user  
becomes root that's acceptable. Just getting rid of direct  
password-based login to the account.

Thank you for your help.

-J

---

<div class="post-metadata">

**Author:** ![Kimball\_Johnson](https://avatars.discourse-cdn.com/v4/letter/k/41988e/32.png) [@Kimball\_Johnson](https://discourse.chef.io/u/Kimball_Johnson)\
**Post date:** [May 4, 2011, 7:31am UTC](https://discourse.chef.io/t/removing-roots-password-results-in-ruby-shadow-not-installed-error/1863/11 "2011-05-04T07:31:03Z")

</div>

On 4 May 2011 01:46, Bryan McLellan [btm@loftninjas.org](mailto:btm@loftninjas.org) wrote:

> On Tue, May 3, 2011 at 5:36 PM, Jason J. W. Williams  
> [jasonjwwilliams@gmail.com](mailto:jasonjwwilliams@gmail.com) wrote:
> 
> > user "root" do  
> > action :modify  
> > password "\*"  
> > end
> 
> Also, there's a "lock" action.

You should note that locking the account and setting the hash to '_'  
are quite different. For example if you are using ssh key logins you  
can allow a user to access that has no usable password (i.e. hash of  
'_') but if you lock the account the user will not be permitted to  
login.

> I suppose you could set the password to "\*" using the password  
> attribute. Since we're normally writing directly to this field through  
> the shadow library, that may work.

If you have the ruby shadow library installed the manipulation of the  
hash does indeed work correctly, and leave the account enabled, but  
with no usable password.

Kimball Johnson