English Spanish (Latin America)
The configured password will be accepted for local authentication at the console. By default, Fedora CoreOS does not allow <<_enabling_ssh_password_authentication,password authentication via SSH>>.
Configuring Groups
Fedora CoreOS comes with a few groups configured by default: `root`, `adm`, `wheel`, `sudo`, `systemd-journal`, `docker`
When configuring users via Butane configs, we can specify groups that the user(s) should be a part of.
variant: fcos
version: 1.4.0
passwd:
users:
- name: core
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHn2eh...
- name: jlebon
groups:
- wheel
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDC5QFS...
- sh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIveEaMRW...
- name: miabbott
groups:
- docker
- wheel
password_hash: $y$j9T$aUmgEDoFIDPhGxEe2FUjc/$C5A...
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTey7R...
If a group does not exist, users should create them as part of the Butane config.
variant: fcos
version: 1.4.0
passwd:
groups:
- name: engineering
- name: marketing
gid: 9000
users:
- name: core
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHn2eh...
- name: jlebon
groups:
- engineering
- wheel
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDC5QFS...
- sh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIveEaMRW...
- name: miabbott
groups:
- docker
- marketing
- wheel
password_hash: $y$j9T$aUmgEDoFIDPhGxEe2FUjc/$C5A...
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTey7R...
Configuring Administrative Privileges
The easiest way for users to be granted administrative privileges is to have them added to the `sudo` and `wheel` groups as part of the Butane config.
variant: fcos
version: 1.4.0
passwd:
groups:
- name: engineering
- name: marketing
gid: 9000
users:
- name: core
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHn2eh...
- name: jlebon
groups:
- engineering
- wheel
- sudo
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDC5QFS...
- sh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIveEaMRW...
- name: miabbott
groups:
- docker
- marketing
- wheel
- sudo
password_hash: $y$j9T$aUmgEDoFIDPhGxEe2FUjc/$C5A...
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTey7R...
Enabling SSH Password Authentication
To enable password authentication via SSH, add the following to your Butane config:
variant: fcos
version: 1.4.0
storage:
files:
- path: /etc/ssh/sshd_config.d/20-enable-passwords.conf
mode: 0644
contents:
inline: |
# Fedora CoreOS disables SSH password login by default.
# Enable it.
# This file must sort before 40-disable-passwords.conf.
PasswordAuthentication yes