Hi, On 26/03/12 21:38, Petter Reinholdtsen wrote: >> * gosa-sync uses the raw passwords as processes arguments, which on a >> multi-user system means others (users or services) to read them via >> /proc or utilities like 'top', 'ps' or 'w' > > gosa-sync is carefully constructed to never use the password as > process argument. It is only available in the environment passed from > GOSA, a inline text string and in a temp file.
Ah, I see in r75805 you did make efforts to prevent that before the Squeeze release, so it is not so serious. I misread this: > change_password -pw "$USERPASSWORD" $USERID thinking that was a shell command, but I see it is being used as part of a heredoc: > 32 cat > $TMPFILE <<EOF > 33 change_password -pw "$USERPASSWORD" $USERID > 34 EOF > 35 > 36 # Grep away change_password -pw call to make sure syslog to not > 37 # get a copy of the new password. > 38 cat $TMPFILE | kadmin.local 2>&1 | grep -v "change_password -pw" | > logger -t gosa-sync -p notice But isn't this kinda redundant? It could be written so that the heredoc goes directly to kadmin.local instead of being output to file with 'cat' and then 'cat' back in? The call to ldapwhoami still needs to read the raw password from a file though, which is unfortunate. Because I'm really, really paranoid, I don't think raw passwords should be even written to tempfile/disk, and anything using them should use memlockall() to avoid them being swapped out to disk. Is there any specific reason to still not use quotes around things like $1, $USERDN, $USERID (or even $TMPFILE), as has now been done for $USERPASSWORD? I would think that if someone did (as www-data) something like: $ USERPASSWORD="correctpw" sudo gosa-sync "uid=; foo," they could maybe inject extra commands/parameters to ldapwhoami or kadmin.local? And what is this... revision 77106 by pere, Tue Mar 20 19:00:25 2012 UTC: > Change gosa-sync to not syslog the new passoword string when > changing password in GOsa². Wow, really? :/ I didn't know about this. If that has happened, patching gosa-sync is too late to help anyone whose raw passwords are now saved into syslog for many weeks (but hopefully readably only by root user or adm group). But, if someone was importing raw passwords from a CSV file, their passwords are probably no more exposed than they already were... > The clear text passwords are removed from debconf at the end of the > installation... Okay. Well, that's much better than I thought, but not perfect. Hopefully the temporarily-stored passwords are held in /var/cache/debconf/passwords.dat, rather than remaining in world-readable /var/cache/debconf/config.dat-old after install? I haven't checked this. Regards, -- Steven Chamberlain [email protected] -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]
