Wrong ssh password used in platform::firewall::runtime causes sysadmin linux user to be locked
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Fix Released
|
Medium
|
Andre Kantek |
Bug Description
Brief Description
Puppet runtime class platform:
The issue is that OS_PASSWORD is not the Linux password. During installation they may be set to the same password, but will diverge as soon as the Linux password is changed with 'passwd' command.
OS_PASSWORD actually is the keystone password, same as 'keyring get CGCS admin'
Severity
Major: System is usable but degraded
Steps to Reproduce
1 - With the master load, install a standard system.
2 - On the active controller, change the password to something different than 'Li69nux*'
3 - Keep track of the failed login attempts with the below command:
[sysadmin@
sysadmin:
When Type Source Valid
2026-09-11 00:32:45 RHOST 192.169.1.45 V
2026-09-11 00:32:51 RHOST 192.169.1.45 V
Once 5 failed attempts are reached, sysadmin user will be locked and it will be not possible
to login anymore to the active controller.
4 - Exit and try to login again to the active controller and you will get permission denied now.
Expected Behavior
Script calico_
Actual Behavior
Script calico_
Reproducibility
Seen multiple times, 100%
System Configuration
Muti-node std config
Load info (eg: 2022-03-
all mentioned labs shared same load
[sysadmin@
BUILD_ID=
Any load greater than 15/05/2023 should have this behaviour as well.
Timestamp/Logs
Failed logins with both compute-0 and compute-1 ips:
root@controller
2026-09-
2026-09-
2026-09-
2026-09-
2026-09-
2026-09-
2026-09-
2026-09-
2026-09-
2026-09-
root@controller
Alarms
N/A
Test Activity
DEV testing
Workaround
No workaround known so far
Impacted Regression TCs
N/A
Changed in starlingx: | |
assignee: | nobody → Andre Kantek (akantek) |
Changed in starlingx: | |
importance: | Undecided → Medium |
tags: | added: stx.9.0 stx.networking stx.security |
Fix proposed to branch: master /review. opendev. org/c/starlingx /stx-puppet/ +/897467
Review: https:/