Setting password for root user in Yocto

-
By default, if you have not made any modifications to 'EXTRA_IMAGE_FEATURES' variables, "debug-tweaks" option is set.

$ bitbake -e rpi-basic-image | grep ^EXTRA_IMAGE_FEATURES
EXTRA_IMAGE_FEATURES="debug-tweaks"

This option makes the image suitable for development and allows you to have an empty root password. So, if you have ssh server running, you no need to type the password.

But for production, this is not a good idea, as it is insecure. We need to add a password for the root user. We need to remove "debug-tweaks" option from the EXTRA_IMAGE_FEATURES. Add the below line in your local.conf or machine.conf file

EXTRA_IMAGE_FEATURES=""

To add the password for the root account you can write the below in your local.conf or machine.conf file:

INHERIT += "extrausers"
EXTRA_USERS_PARAMS = "usermod -p $(openssl passwd 123456) root

The problem with the above approach is any developer can look at the local.conf file and find out the root password.

The other way is to pass an encrypted value of the password to usermod option

To generate an encrypted value, you can use openssl or mkpasswd. I used mkpasswd.

For example to set password:123456

mkpasswd -m sha-512 123456 -s "mypassword"

You can see running multiple times, I get the same output.

Finally, add the generated encrypted password in local.conf file. Note: You need to escape the '$' and any other special characters as that will be interpreted by shell.



Comments

Post a Comment

Popular posts from this blog

bb.utils.contains yocto

-
Image
bb.utils.contains  is most commonly used function in Yocto. grep in poky directory returned with 696 count. $ grep -nr 'bb.utils.contains' poky/ | wc -l 696 It's definition is present in 'poky/bitbake/lib/bb/utils.py' file This function returns third argument if the second argument is subset of the first argument else returns fourth argument Let's take an example to understand this. You can see from the above screenshot, when the second argument is a subset of first argument, "present" was returned, else "notpresent" was returned We can also use bb.utils.contains inside if loop. This we can use inside a recipe. if ${@bb.utils.contains('SOMEFLAG','NEWVALUE3','true','false',d)}; then     FOO = 'HELLO' fi
Read more

make config vs oldconfig vs defconfig vs menuconfig vs savedefconfig

-
Image
Building the Linux Kernel is a two-step process: Configuring the Kernel options Building the Kernel with those options. There are many methods available for configuring the kernel. make config: Text-based Configuration.  Options are prompted one after another. All options need to be answered Access to former options is not possible make menuconfig: Menu-driven user interface Allows to navigate forwards and backward directly between features Allows to load and save files with filenames different from ".config" Provides search feature It uses ncurses library for GUI. If the ncurses library is not installed, make menuconfig option fails. To install ncurses library on Ubuntu: sudo apt-get install libncurses5-dev make defconfig: Creates a ".config" file with default options from the ARCH supplied defconfig Configurations are generally stored in the directory: arch/$(ARCH)/configs $ ls arch/x86/configs/ i386_defconfi
Read more

PR, PN and PV Variable in Yocto

-
PN : Represents the name of the recipe. The name is usually extracted from the recipe file name. PR:  Represents the revision of the recipe. Default value for this revision is "r0". Subsequent revisions of the recipe conventionally will have "r1", "r2" and so on. PV:  Represents the version of the recipe. Normally extracted from the recipe file name. For example: ffmpeg_3.4.2.bb recipe. ${PN} : ffmpeg ${PV} : 3.4.2
Read more