fix(image): drop the expired password from the cloud image - #55
Merged
Conversation
The cloud image shipped the ubuntu account with password bes marked expired. An expired password makes PAM demand a change on every session, not just console logins: key-authenticated SSH and Tailscale SSH sessions open straight into "You are required to change your password immediately", and when that change cannot complete the session is closed, leaving no way in. Cloud instances get their credentials from cloud-init, so the cloud image now ships no usable password at all (matching stock Ubuntu cloud images) and no expiry. Metal and Pi keep bes plus the expiry, since there the pre-set credential is the intended console login and must be changed. Note that this removes serial-console login on cloud instances; break-glass is now via cloud-init user-data or the volume.
passcod
force-pushed
the
cloud-no-expired-password
branch
from
July 31, 2026 04:47
1a7c295 to
7a52177
Compare
The cloud image no longer ships a password, so an operator with only console access needs a documented way back in. Also records why init=/bin/sh and emergency.target do not work on these images.
Unrelated to the rest of this branch, but it blocks CI: the toolchain bump extended useless_borrows_in_formatting, and main has not been built since.
passcod
force-pushed
the
cloud-no-expired-password
branch
from
July 31, 2026 04:56
87cb89e to
5349d73
Compare
passcod
enabled auto-merge
July 31, 2026 05:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 The cloud image shipped the
ubuntuaccount with passwordbesmarked expired. An expired password makes PAM demand a change on every session, not just console logins — key-authenticated SSH and Tailscale SSH sessions open straight into "You are required to change your password immediately", and when that change cannot complete the session is closed, leaving no way in. Deployed AMI instances hit this.Cloud instances get their credentials from cloud-init, so the cloud image now ships no usable password at all (matching stock Ubuntu cloud images) and no expiry. Metal and Pi keep
besplus the expiry, since there the pre-set credential is the intended console login and must be changed.That removes serial-console login on cloud instances, so the second commit documents
rd.breakas the break-glass path. The recipes there use only tools that are actually present in the dracut initramfs (checked against a built image:sh,mount,sed,grep,cat,systemctl, but nochroot,passwd,chageordate), and note thatsystemd.unit=emergency.targetis not an alternative because root has no password and/sbin/nologinas its shell.The new structure-test assertions were run against a previously built cloud image and fail exactly as intended on the pre-fix state. The fix itself has not yet been confirmed against a freshly built image.