Managing Root Passwords With CFEngine

control:
        rootpassword = ( "root:$6$YOURHASH:0:99999:7:::" )

editfiles:
        { /etc/shadow
          BeginGroupIfNoSuchLine "$(rootpassword)"
           DeleteLinesStarting 'root:'
           PrependIfNoSuchLine "$(rootpassword)"
          EndGroup
          }