Currently users are required to set all passwords at firstboot.
A PR exists against common (@OnGle - great work BTW 😄) which I was intending to merge some time ago. However, during discussions with Alon (at the time), he requested that we hold off and think about it a bit more. Mainly this was around usage of Adminer (you need to know your root MySQL/PostgreSQL password to login to Adminer).
Recently, the discussion was reignited by the fact that so long as you can access it easily, some users may wish to skip inputting passwords and/or have random passwords generated. As per @OnGle's work, we could leverage the new confconsole plugin functionality to view and/or reset the passwords.