Page MenuHomeVyOS Platform

Password recovery does not work if public keys are configured
Closed, ResolvedPublicBUG

Description

If a public key is configured in the config file, the password recovery tool (standalone_root_pw_reset) cannot reset a password.

The problem exists because regex used for sed there expects to find the password before the first line with the`}` character, but the public key section breaks this logic.

Affected sed command (https://github.com/vyos/vyatta-cfg-system/blob/2ec876ba9034c4e35538860d3128c6c13e185825/scripts/standalone_root_pw_reset#L29-L32):

set_encrypted_password() {
    sed -i \
       -e "/ user $1 {/,/}/s/encrypted-password .*\$/encrypted-password $2/" $3
}

Config with public keys:

login {
    user vyos {
        authentication {
            public-keys keyname {
                type "ssh-ed25519"
                key "keydata"
            }
            encrypted-password "passworddata"
            plaintext-password ""
        }
    }
}

Details

Version
1.3.4, 1.4, 1.5
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

zsdc changed the task status from Open to In progress.
zsdc claimed this task.
zsdc renamed this task from Password recovery does not work in Equinix Metal to Password recovery does not work if public keys are configured.Nov 14 2023, 1:18 PM
zsdc triaged this task as High priority.
zsdc updated the task description. (Show Details)
zsdc edited a custom field.
zsdc changed Version from 1.3.4 to 1.3.4, 1.4, 1.5.
zsdc edited a custom field.
syncer changed the task status from Needs testing to In progress.Nov 15 2023, 5:03 AM
syncer moved this task from Open to Backport Candidates on the VyOS 1.5 Circinus board.