I've changed my mind: this feels like it should be a security update if the user made no mistakes in their configuration and a previous version of sssd (with the "create the database" behavior) would have been giving the user the correct, unlocked, password-protected, user; but the new version of sssd (without "create the database" behavior) leaves the user account unlocked and passwordless.
Perhaps the user has a reasonable OpenSSH configuration that allows some other account to be passwordless (I can't tell you how often I've wished "anonymous ssh" was a thing) and expected for this created account to be protected by a very good password, not no password. How do we actually get this security update into user workflows? Will it only happen with eg 26.04.2 ISO builds (and daily cloud images?) Do we need to worry about NIS+ or Kerberos or something similar not playing nicely with the shadow password "user::" and "user:!:" conventions? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2153951 Title: unconfigured sssd leads to cloud-init removing a password from a user To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/2153951/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
