Setting a Custom OPC Password When Launching an OCI Linux Compute Instance

When launching a new Linux compute instance in Oracle Cloud Infrastructure (OCI), the default security posture requires SSH key-based authentication for the default opc user. However, there are many operational scenarios such as legacy application requirements, automated scripts, or administrative recovery where you need to set a custom password for the opc user at provisioning time. This guide walks you through using OCI’s metadata injection via cloud-init to safely prepopulate a secure password for your instance’s default user.

Generating a Hashed Password

Before writing your cloud-init script, you must generate a secure cryptographic hash of your desired password. For security reasons, you should never store or pass plain text passwords inside configuration files or scripts.

Use the openssl passwd command with the SHA-512 algorithm (flagged with -6) to generate the hash:

openssl passwd -6 "Pass0word123"

This command returns a secure hash similar to the example below (note that your actual hash output will vary):

$6$yMVzHu1Db7yeCldt$9.drg61DbhqpoH551FzPldh/D23m9bOJyGvsTBGDCY1i3O0pvFM8ziPDvY3Uvvd1wR/3./x3jJ7XL3pgG8eAw1

Creating the Cloud-Init Script

Once you have your password hash, copy the following cloud-init configuration block. This script will direct the cloud-init daemon to apply the password and configure SSH policies during the first boot cycle.

#cloud-config
chpasswd:
  list: |
    opc:$6$yMVzHu1Db7yeCldt$9.drg61DbhqpoH551FzPldh/D23m9bOJyGvsTBGDCY1i3O0pvFM8ziPDvY3Uvvd1wR/3./x3jJ7XL3pgG8eAw1
  expire: False
ssh_pwauth: True

Key Variables Explained

• chpasswd.list: Specifies the target username (opc) and the freshly generated password hash separated by a colon.
• expire: False: Keeps the password active immediately, bypassing forced-reset procedures during your initial login.
• ssh_pwauth: True: Tells the SSH daemon to allow password authentication over the network (by default, many OCI images disable this).

Configuring the OCI Console

To inject this cloud-init script during the provisioning stage, follow these wizard steps in the OCI Console:

1. Navigate to Compute → Instances → Create Instance.
2. Fill out your identity and networking information. Under “Add SSH keys”, we recommend still uploading your public SSH key as an alternative entry point.
3. Scroll to the bottom of the page and click on “Show Advanced Options”.
4. Go to the “User Data” tab and paste the cloud-init script block generated above into the text area.
5. Click “Create” to launch the compute instance.

Verifying Your Access

Give the instance a minute or two to run its initialization routines. Once the status turns to “Running” and the initial cloud-init scripts conclude, test your new configuration by connecting via SSH:

ssh opc@<instance-public-ip>

You will be prompted to enter your password (e.g., Pass0word123) to authenticate. While password authentication adds flexibility, remember to monitor your SSH access policies and restrict network access via Security Lists or Network Security Groups (NSGs) to defend against brute-force attacks.