Package: rancid
Version: 2.3.2-1.1
Severity: normal
Tags: patch
We dropped a couple of switches running CatOS 8.2(1)GLX, into our config,
to discover that the passwords are not stripped out of the localuser
command.
The output of `show config` looks something like this:
!
#Local User
set localuser user zanchey password $2$somepassword privilege 0
set localuser authentication disable
The attached patch strips passwords as recommended.
This bug has been reported upstream and the patch accepted.
-- System Information:
Debian Release: 5.0.4
APT prefers stable
APT policy: (800, 'stable'), (400, 'testing'), (99, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.18-6-xen-686 (SMP w/2 CPU cores)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages rancid depends on:
ii adduser 3.110 add and remove users and groups
ii cvs 1:1.12.13-12 Concurrent Versions System
ii debconf [debconf-2.0] 1.5.24 Debian configuration management sy
ii expect 5.43.0-17 A program that can automate intera
ii iputils-ping [ping] 3:20071127-1 Tools to test the reachability of
ii libc6 2.7-18lenny2 GNU C Library: Shared libraries
ii openssh-client 1:5.1p1-5 secure shell client, an rlogin/rsh
ii passwd 1:4.1.1-6+lenny1 change and administer password and
ii perl 5.10.0-19lenny2 Larry Wall's Practical Extraction
ii ssh 1:5.1p1-5 secure shell client and server (me
ii subversion 1.5.1dfsg1-4 Advanced version control system
rancid recommends no packages.
Versions of packages rancid suggests:
ii diffstat 1.45-2 produces graph of changes introduc
-- debconf information:
* rancid/warning:
* rancid/go_on: true
--- cat5rancid.in.orig 2010-04-23 10:01:45.000000000 +0800
+++ cat5rancid.in 2010-04-23 10:03:15.000000000 +0800
@@ -911,6 +911,14 @@
ProcessHistory("","","","! set password <removed>\n");
next;
}
+ if (/^(set localuser user .*) password .* (privilege .*)/) {
+ if (/^(set localuser user .*) password .* (privilege .*)/ &&
$filter_pwds >= 1) {
+ ProcessHistory("","","","! $1 password <removed> $2\n");
+ } else {
+ ProcessHistory("","","","$_\n");
+ }
+ next;
+ }
if (/^(\s*)password / && $filter_pwds >= 1) {
ProcessHistory("LINE-PASS","","","!$1password <removed>\n");
next;
