The sudoer postscript created the xcat account with the fixed password
rootpw. The rebased change from #6166 moved the password to the -p
option, which shows it in ps on the node and spreads it over
postscripts attributes.
The postscript now asks the management node for the password field of
the passwd row key=system,username=<sudoer> over getcredentials, the
way remoteshell gets the root hash under secureroot, and applies it:
the hash, or "!" when the table has no password for the account. sudo
and the SSH key are granted only after that. A missing reply, a refused
request, or a failed usermod fails the postscript and leaves the
account unprivileged. -u still selects the user name and defaults to
xcat. -p is rejected.
An existing login account is kept, with the other keys in its
authorized_keys. Root, accounts outside UID_MIN..UID_MAX, and accounts
without a login shell are refused. The sudo rule lives in
/etc/sudoers.d/xcat-sudoer, which records its account: a rerun with
another name revokes the rule, the password, and the cluster key of the
previous account, and the lines the old postscript appended to
/etc/sudoers are moved out after visudo accepts the result. Every
privilege write is checked, and a failed run removes the managed rule.
Without sudoers.d the rule is appended once to /etc/sudoers.
Vinícius Ferrão
005a32a721