Ability to disable access to system from console

[superseb]

At the moment, anyone with access to the console can set rancher.password on boot, set a password and login. In some environments it is required to disable these methods. This can be achieved by:

• Config option to ignore rancher.password kernel param
• Option to disable boot/kernel params
• Option to disable recovery menu
• Option to disable login prompt

[Jason-ZW]

• Config option to ignore rancher.password kernel param:
  I will try to add a configuration parameter in cloud-config.yml that can makes the RancherOS ignore the rancher.password kernel parameter, the configuration parameter such as the rancher.kernel.params.ignore or something else. This parameter is not exposed by the ros config export, but can be obtained with the ros config get command.

• Option to disable boot/kernel params:
  I’m not sure to disable all boot/kernel parameters can lead to some potential problems, so could you please provide some parameters need to be disabled?

• Option to disable recovery menu:

  This can be done by manual.

  For Example:

  1. Run Command:
     $ sudo system-docker run --rm -it -v /:/host alpine vi /host/boot/linux-current.cfg
  2. Comment out the line of code:
     #LABEL rancheros-v1.4.0-recovery
# SAY rancheros-v1.4.0-recovery: recovery console RancherOS ${VERSION} ${KERNEL_VERSION}
# MENU LABEL Recovery console
# MENU INDENT 2
# COM32 cmd.c32
# APPEND rancheros-v1.4.0 rancher.recovery=true
  3. Reboot RancherOS
     $ reboot

  If needed autoconfig, I will try to add a configuration item in ros config syslinux that can makes the RancherOS ignore the recovery menu.

• Option to disable login prompt:

  This can be done by manual.

  For Example:

  1. Run Command:
     $ sudo ros config syslinux
  2. Remove all of the item:
     rancher.autologin=tty1 rancher.autologin=ttyS0 rancher.autologin=ttyS1 rancher.autologin=ttyS1 console=tty1 console=ttyS0 console=ttyS1
  3. Reboot RancherOS:
     $ reboot

[janeczku]

@Jason-ZW When running RancherOS from ISO (machine vsphere) it's not possible to edit kernel boot parameter with ros config syslinux. We should have cloud-config option to disable or configure autologin.

[janeczku]

See #1858

[niusmallnan]

When we start a RancherOS instance, the loading order is roughly like this:

bootloader
     |
     |
(initrd start)
     |
preparefs
     |
load boot params
     |
mount and bootstrap
     |
cloud-config save 
     |
start system services(console)
     |  
(initrd end)                                                                         
     |                                                                    
     |                                                                           
system-docker Pid 1

Config option to ignore rancher.password kernel param

The rancher.password takes effect in the console, we can ignore it via cloud-config.

Option to disable boot/kernel params

Now, boot params is loaded first than cloud-config so cloud-config does not affect boot params unless we adjust the load order. This change will have a big impact.

Option to disable recovery menu

This is controlled by the bootloader, and the cloud-config can't affect it. The bootloader is read only if booting an instance via docker-machine, so in this scenario, we cannot disable the recovery console.

Option to disable login prompt

We can do this via cloud-config.

[riaan53]

Hi, Do you still plan on giving the option to disable the boot/kernel params to autologin to the console?