----- Original Message -----
From: "Nick Coghlan" <ncoghlan(a)redhat.com>
To: beaker-devel(a)lists.fedorahosted.org
Sent: Monday, August 26, 2013 12:39:08 PM
Subject: Re: [Beaker-devel] Feedback regarding implementing BZ#989924
On 08/26/2013 12:34 PM, Amit Saha wrote:
>
>
> ----- Original Message -----
>> From: "Nick Coghlan" <ncoghlan(a)redhat.com>
>> To: beaker-devel(a)lists.fedorahosted.org
>> Sent: Monday, August 26, 2013 12:31:26 PM
>> Subject: Re: [Beaker-devel] Feedback regarding implementing BZ#989924
>>
>> On 08/26/2013 12:17 PM, Amit Saha wrote:
>>> Regarding implementing [1], the two main changes are:
>>>
>>> 1. Adding support for a new ks_meta option. For eg. <recipe
>>> ks_meta="auth='--useshadow --enablemd5'">
>>> 2. And having support for reading it in the template:
>>>
>>> +{% if auth %}
>>> +auth {{ auth }}
>>> +{% endif %}
>>>
>>> When the ks_meta option is not specified, the generated kickstart
doesn't
>>> get a 'auth' command entry.
>>>
>>> Does this look fine?
>>
>> For older RHEL versions, we may want to keep the non-empty auth by
>> default. Work out when shadow and md5-or-better became the default, and
>> keep forcing them up until then. Alternatively, as a research-free
>> alternative, I'm happy to go with "keep the kickstart customisation
for
>> RHEL3 and RHEL4, switch to using the anaconda defaults for RHEL5 and
>> later".
>
> Do you mean, we keep the Beaker enforced defaults for RHEL3 and RHEL4?
>
> And use Anaconda defaults (unless overridden from ks_meta) for RHEL5+ and
> Fedora ?
Yeah. Although I wouldn't complain if you wanted to check the defaults
for RHEL3 and RHEL4 to see if we could use the OS defaults there, too :)
RHEL 3 and RHEL4: md5 and shadow
RHEL 6/7(guess) and Fedora : sha512
So, I will drop the explicit authconfig completely and add the ks_meta support.
-Amit.
--
Amit Saha <
http://echorand.me>
Infrastructure Engineering and Development
Red Hat, Inc.