This sample manages local Linux account passwords over SSH using an interactive shell. It verifies service-account access, validates managed-account passwords against /etc/shadow, and changes passwords with passwd.
Platform Script: GenericLinux.json
A generic Linux host with local accounts in /etc/passwd and password hashes in /etc/shadow.
| Operation | Description |
|---|---|
CheckSystem |
Logs in with the service account, initializes the shell, and verifies that the service account can read the required shadow entry through the configured delegation command. |
CheckPassword |
Confirms the managed account exists, reads its /etc/shadow entry, and compares the supplied password to the stored hash. |
ChangePassword |
Runs passwd for the target account, handles interactive prompts, and submits the new password. |
DiscoverSshHostKey |
Retrieves the SSH host key so it can be stored on the asset. |
- A Linux host reachable over SSH
- A service account that can log in over SSH and use
sudo(or anotherDelegationPrefix) to read/etc/shadowand runpasswd - If
sudoprompts for a password, the service account password must be supplied; optional SSH key login is supported throughUserKey
- Upload the script:
Import-SafeguardCustomPlatformScript -FilePath ./GenericLinux.json - Create a custom platform using this script
- Create an asset using the platform
- Configure service account and managed account(s)
- Test with
Test-SafeguardAssetAccountPassword -ExtendedLogging
The script connects over SSH, flushes the login banner, and sets a predictable shell environment with a known sudo prompt. CheckSystem verifies delegation by looking up the service account in /etc/shadow. CheckPassword checks that the managed account exists in /etc/passwd, retrieves the shadow entry through the delegation command, and uses CompareShadowHash to validate the supplied password. ChangePassword drives the interactive passwd flow, handling optional sudo and current-password prompts before sending the new password twice.
DelegationPrefix- Command used for privilege elevation, typicallysudoRequestTerminal- Controls whether SSH requests a PTY; defaults totruefor interactive flowsUserKey- Optional SSH private key for the service account login
- Designed for local Unix accounts backed by
/etc/passwdand/etc/shadow - Assumes interactive
passwdprompts match the regexes in the sample - Password validation requires enough privilege to read
/etc/shadow - Expired-password or forced-password-change login banners cause login validation to fail