From edf98e317775869bc968ae8b84ddef1cb41e21b1 Mon Sep 17 00:00:00 2001 From: Markus Hilger Date: Mon, 7 Sep 2026 06:05:56 +0200 Subject: [PATCH] Lock root on SUSE 16 when no password is set The deploycfg carries the literal 'null', which went into the profile as a password hash, so the installed root account reported a usable password instead of a locked one. 15 substitutes '!' for this; the sed delimiter has to move off '!' to carry it. --- confluent_osdeploy/suse16/profiles/server/scripts/pre.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/confluent_osdeploy/suse16/profiles/server/scripts/pre.sh b/confluent_osdeploy/suse16/profiles/server/scripts/pre.sh index 66adf2d9..4d8a6a93 100644 --- a/confluent_osdeploy/suse16/profiles/server/scripts/pre.sh +++ b/confluent_osdeploy/suse16/profiles/server/scripts/pre.sh @@ -36,7 +36,12 @@ hostname $(grep ^NODENAME: /etc/confluent/confluent.info|awk '{print $2}') run_remote_parts pre.d sed -i s!%%DEPLOYER%%!$deployserver!g /tmp/autoinstall.json sed -i s!%%PROFILE%%!$(grep ^profile: /etc/confluent/confluent.deploycfg|awk '{print $2}')!g /tmp/autoinstall.json -sed -i s!%%ROOTPASSWORD%%!$(grep ^rootpassword: /etc/confluent/confluent.deploycfg|awk '{print $2}')!g /tmp/autoinstall.json +rootpw=$(grep ^rootpassword: /etc/confluent/confluent.deploycfg|awk '{print $2}') +if [ "$rootpw" = "null" ]; then + # lock the account, as 15 does. ! is a marker, not a hash anything matches + rootpw='!' +fi +sed -i 's@%%ROOTPASSWORD%%@'"$rootpw"'@g' /tmp/autoinstall.json sed -i s!%%NODENAME%%!$(hostname)!g /tmp/autoinstall.json python3 /opt/confluent/bin/apiclient /confluent-public/os/$profile/profile.yaml > /tmp/instprofile.yaml blargs=$(grep ^installedargs: /tmp/instprofile.yaml | sed -e 's/#.*//' -e 's/^installedargs: //')