Related

Tool DOCTL: DigitalOcean CLI Tool
Can you reset a droplet password via APIv2? Question Question
Will more fine grained API token scopes available? Question Question

Question

How to remove "reset root password"?

Posted July 17, 2015 4.5k views
SecurityAPI

Hi,

Upon logging into a new droplet the first time via SSH using an SSH Key I am being asked to reset the root password - I would like to disable this. Is this possible?

My scenario is this.

1/ Create a new droplet with an SSH key from an image via Java Api (This image has all the correct sshd_config settings - PermitRootLogin without-password and PasswordAuthentication no
2/ SSH into this box via JSch Java Api and perform some operations.

Step 2 would not be possible if there is a prompt to reset the root password. I can verify that the SSH key is setup correctly because when I attempt to SSH to the box the first time I am not asked for a password.

Any help would be greatly appreciated.

Cheers.

Add a comment
lucad2ff0aab4ab
By:
lucad2ff0aab4ab
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
2 answers
saurabh July 19, 2015

Well, as I understand, there is no way to disable this root password reset feature. There is a script that runs on “every” DO droplet that is deployed which first generates a new password & then expires that password. So when you login, the password is expired and if you login through root, you will most certainly be forced to change your pass.

A workaround can be that you create another user with sudo privileges and login with that user. This way, even though root password has expired, the other user would still be working fine!

Hope this helps!

Reply Report
thehunmonkgroup December 16, 2017

When POST'ing to the /droplets endpoint, if you set the user_data property to this multi-line string:

#cloud-config

runcmd:
  - echo root:somelongrandompasswordstring | chpasswd

This is executed after the DO script which expires the password, and sets a new one with no expire date.

That’s working on Debian-based systems, for others you may need to modify the shell command, but the idea should be the same.

Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help