We are seeing similar behavior with our automated deployments of both desktop and server 26.04 via Subiquity.
We are configuring a default local user via the autoinstall identity key with a hashed password. We have used the autoinstall identity key to create the default user with 20.04, 22.04, and 24.04 with SSSD installed without issues until 26.04. After cloud-init runs on the first boot of a deployed 26.04 system, the password for the default user is blank and we see the following in the cloud-init.log file: ######## 2026-08-26 21:56:06,392 - modules.py[DEBUG]: Running module users_groups (<module 'cloudinit.config.cc_users_groups' from '/usr/lib/python3/dist-packages/cloudinit/config/cc_users_groups.py'>) with frequency once-per-instance 2026-08-26 21:56:06,392 - handlers.py[DEBUG]: start: init-network/config-users_groups: running config-users_groups with frequency once-per-instance 2026-08-26 21:56:06,392 - util.py[DEBUG]: Writing to /var/lib/cloud/instances/iid-datasource-none/sem/config_users_groups - wb: [644] 23 bytes 2026-08-26 21:56:06,392 - helpers.py[DEBUG]: Running config-users_groups using lock (<FileLock using file '/var/lib/cloud/instances/iid-datasource-none/sem/config_users_groups'>) 2026-08-26 21:56:06,392 - distros[INFO]: User DefaultUser already exists, skipping. 2026-08-26 21:56:06,392 - util.py[DEBUG]: Reading from /etc/os-release (quiet=True) 2026-08-26 21:56:06,392 - util.py[DEBUG]: Reading 410 bytes from /etc/os-release 2026-08-26 21:56:06,393 - util.py[DEBUG]: Reading from /etc/system-image/channel.ini (quiet=True) 2026-08-26 21:56:06,393 - util.py[DEBUG]: Reading 0 bytes from /etc/system-image/channel.ini 2026-08-26 21:56:06,393 - util.py[DEBUG]: Reading from /etc/shadow (quiet=False) 2026-08-26 21:56:06,393 - util.py[DEBUG]: Reading 1074 bytes from /etc/shadow 2026-08-26 21:56:06,393 - distros[DEBUG]: User DefaultUser found in /etc/shadow. Checking for empty password 2026-08-26 21:56:06,393 - subp.py[DEBUG]: Running command ['passwd', '-u', 'DefaultUser'] with allowed return codes [0, 3] (shell=False, capture=True) 2026-08-26 21:56:06,462 - performance.py[DEBUG]: Running ['passwd', '-u', 'DefaultUser'] took 0.069 seconds 2026-08-26 21:56:06,463 - subp.py[DEBUG]: Running command ['passwd', '-d', 'DefaultUser'] with allowed return codes [0] (shell=False, capture=True) 2026-08-26 21:56:06,483 - performance.py[DEBUG]: Running ['passwd', '-d', 'DefaultUser'] took 0.020 seconds 2026-08-26 21:56:06,483 - handlers.py[DEBUG]: finish: init-network/config-users_groups: SUCCESS: config-users_groups ran successfully and took 0.091 seconds (duration: 0.091s) ######## For some reason cloud-init runs "passwd -u DefaultUser", which does not return an error from the subp.py function per the logs, then follows that with "passwd -d DefaultUser". On our 22.04/24.04 deployments we see the same "passwd -u DefaultUser" behavior in cloud-init.log, however, it is not followed by "passwd -d DefaultUser". The lines that are generated in the logs appear to come from the unlock_password function of the distros module of cloud-init: https://github.com/canonical/cloud- init/blob/6193b2a0d241bed305e28a7aced1bd5c8c09de9a/cloudinit/distros/__init__.py#L1045 In the system logs on the 26.04 machine we see the following lines repeated several times at the same timestamps passwd -d and passwd -u are run: ######## [sss_cache] [sss_tool_confdb_init] (0x0010): Can't access '/var/lib/sss/db/config.ldb', probably SSSD isn't configured Can't find configuration db, was SSSD configured and run? ######## The /var/lib/sss/db/config directory is empty at the time passwd -u/-d are run as far as we can tell, even though SSSD is configured and set to run at boot by our automated deployment. We have confirmed that the correct password hash for the DefaultUser is set during the Subiquity automated install and is not removed until after the first boot of the system and cloud-init has been run. We have confirmed that not installing the SSSD packages resolves the issue of cloud-init running passwd -u followed by passwd -d on our automated server deployments of 26.04. We are not sure what interaction between SSSD startup, the missing config.ldb DB, and cloud-init's user creation changed between 24.04 and 26.04. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2153951 Title: no config.ldb file under /var/lib/sss/db in 26.04 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2153951/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
