fa79f76951
Tools > Share accounts sets the pxe-upload, blancco and clonezilla Samba passwords. Saving one runs smbpasswd and writes it everywhere it is used: startnet.cmd in boot.wim (pxe-upload), the served Blancco preferences and the live config.img (blancco), the iPXE menu's Clonezilla entries (clonezilla). Refused while a PC is imaging unless forced. Stored 0600 in UPDATES_DIR/shares/accounts.json, never shown back. - The stored values are the authority: the playbook only creates the Samba accounts, seeds the store from site-vars (pxe_upload_password, blancco_smb_password, clonezilla_smb_password) for accounts it does not hold, and runs "share_accounts apply" at the end of every run. - Every startnet save re-pins SHAREPASS, so a restored snapshot cannot bring an old password back; new menu blocks use %SHAREUSER%/%SHAREPASS%. - Shop floor unattend Order 4 reads the login from fetch-source.txt; Invoke-PostPpkg deletes that file once the PPKG is applied. - Upload-Image.ps1 asks for the password unless -Pass is given. - pxe_admin_password: the Linux pxe login. Required while the box still has the shipped "pxe"; set with chpasswd when it differs. - Blancco site settings now also reach the live config.img (BIOS path).
84 lines
4.2 KiB
HTML
84 lines
4.2 KiB
HTML
{% extends "base.html" %}
|
|
{% import '_ui.html' as ui %}
|
|
{% block title %}Share accounts - PXE Manager{% endblock %}
|
|
|
|
{# Tools > Share accounts: one row per Samba account the imaging clients use,
|
|
each with its own password form. Passwords are never shown back.
|
|
services/share_accounts.py. #}
|
|
|
|
{% block extra_head %}
|
|
<style>
|
|
.sec-h { padding: 18px 24px 12px; }
|
|
.sec-h .sub { margin-top: 2px; }
|
|
.acct { padding: 14px 24px 16px; border-top: 1px solid var(--line); display: flex; flex-direction: column; gap: 10px; }
|
|
.acct-top { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 12px; }
|
|
.acct-top .name { font-weight: 600; }
|
|
.acct-top .sub { flex: 1 1 18rem; min-width: 0; }
|
|
.acct form { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 10px 12px; margin: 0; }
|
|
.acct .fld { display: flex; flex-direction: column; gap: 4px; flex: 1 1 14rem; min-width: 0; max-width: 20rem; }
|
|
.acct label { font-size: 13px; color: var(--muted); margin: 0; }
|
|
.acct .force { display: flex; align-items: center; gap: 6px; font-size: 13px; }
|
|
.busy { padding: 12px 24px; }
|
|
@media (max-width: 760px) {
|
|
.sec-h, .acct, .busy { padding-left: 16px; padding-right: 16px; }
|
|
.acct .fld { max-width: none; }
|
|
}
|
|
</style>
|
|
{% endblock %}
|
|
|
|
{% block content %}
|
|
<header class="ui-head">
|
|
<div>
|
|
<div class="eyebrow-t">Tools</div>
|
|
<h1>Share accounts</h1>
|
|
<div class="sub">The Samba logins the imaging PCs, Blancco and Clonezilla use on this server. Give each site its own: the shipped defaults are the same at every site.</div>
|
|
</div>
|
|
</header>
|
|
|
|
<div class="ui-stack">
|
|
{% if busy %}
|
|
<div class="notice busy" role="status">
|
|
{{ busy | length }} PC{{ 's' if busy | length != 1 }} imaging now ({{ busy[:5] | join(', ') }}{{ ', ...' if busy | length > 5 }}). A password change now breaks their next share connection, so it is refused unless you tick <strong>Change anyway</strong>.
|
|
</div>
|
|
{% endif %}
|
|
|
|
<section class="panel ui-list" aria-labelledby="acct-h">
|
|
<div class="sec-h"><h2 id="acct-h" class="sec">Accounts</h2>
|
|
<div class="sub">Passwords: {{ rule }}. Saving changes Samba and every file that carries the password (boot.wim, the PXE boot menu, the Blancco preferences) at once. They are never shown here.</div></div>
|
|
{% for a in accounts %}
|
|
<div class="acct">
|
|
<div class="acct-top">
|
|
<span class="name mono">{{ a.account }}</span>
|
|
{% if a.default %}{{ ui.chip('Default password', 'warn') }}{% else %}{{ ui.chip('Site password', 'ok') }}{% endif %}
|
|
<span class="sub">{{ used_by[a.account] }}</span>
|
|
</div>
|
|
<form method="post" action="{{ url_for('share_accounts.save', account=a.account) }}" autocomplete="off"
|
|
onsubmit="return confirm('Change the {{ a.account }} password? Anything that still uses the old one (a PC imaging now, a saved login) stops working.');">
|
|
<input type="hidden" name="_csrf_token" value="{{ csrf_token() }}">
|
|
<div class="fld">
|
|
<label for="pw-{{ loop.index }}">New password</label>
|
|
<input type="password" class="form-control" id="pw-{{ loop.index }}" name="password" required
|
|
minlength="8" maxlength="64" pattern="[A-Za-z0-9._~\-]{8,64}" autocomplete="new-password">
|
|
</div>
|
|
<div class="fld">
|
|
<label for="cf-{{ loop.index }}">Again</label>
|
|
<input type="password" class="form-control" id="cf-{{ loop.index }}" name="confirm" required
|
|
minlength="8" maxlength="64" autocomplete="new-password">
|
|
</div>
|
|
{% if busy %}<label class="force"><input type="checkbox" name="force" value="1"> Change anyway</label>{% endif %}
|
|
<button type="submit" class="ui-btn pri sm">Save</button>
|
|
</form>
|
|
</div>
|
|
{% endfor %}
|
|
</section>
|
|
|
|
<section class="panel" style="padding: 16px 24px" aria-labelledby="note-h">
|
|
<h2 id="note-h" class="sec" style="font-size: 15px">Where else to change it</h2>
|
|
<ul class="sub" style="margin: 6px 0 0; padding-left: 20px">
|
|
<li><strong>pxe-upload</strong>: anyone who maps the shares by hand, and <span class="mono">Upload-Image.ps1</span> (it asks for the password).</li>
|
|
<li>The server's own Linux login (<span class="mono">pxe</span>) is not set here: it is <span class="mono">pxe_admin_password</span> in <span class="mono">site-vars.yml</span>.</li>
|
|
</ul>
|
|
</section>
|
|
</div>
|
|
{% endblock %}
|