Martin Kosek wrote:
On Fri, 2011-09-23 at 09:07 -0400, Rob Crittenden wrote:
Martin Kosek wrote:
On Thu, 2011-09-22 at 11:55 -0400, Rob Crittenden wrote:
Obfuscate the one-time password in the client installer log.
rob
NACK. You missed a case when OTP is interactively prompted (-W parameter
is passed).
Martin
Nice catch, updated patch
rob
Umh, nice try. I think you wanted to read nolog password from
getpass.getpass output and not options.password.
Martin
That's what I get for doing things quickly. This one should work.
rob
>From f9a9e785174004aed56f3d2e6d14eda400b2d6e9 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcrit...@redhat.com>
Date: Thu, 22 Sep 2011 11:52:58 -0400
Subject: [PATCH] Don't log one-time password in logs when configuring client.
https://fedorahosted.org/freeipa/ticket/1801
---
ipa-client/ipa-install/ipa-client-install | 9 +++++----
1 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install
index 44c2f5fbc40c9f3a6d5f4378d91e048b63bf0e7a..21643cdcdc34eb9af750f54e457963399368a27c 100755
--- a/ipa-client/ipa-install/ipa-client-install
+++ b/ipa-client/ipa-install/ipa-client-install
@@ -23,17 +23,15 @@ try:
import sys
import os
- import stat
import time
import socket
import logging
import tempfile
import getpass
- import re
from ipaclient import ipadiscovery
import ipaclient.ipachangeconf
import ipaclient.ntpconf
- from ipapython.ipautil import run, user_input, CalledProcessError, file_exists, install_file
+ from ipapython.ipautil import run, user_input, CalledProcessError, file_exists
import ipapython.services as ipaservices
from ipapython import ipautil
from ipapython import dnsclient
@@ -888,6 +886,7 @@ def install(options, env, fstore, statestore):
return CLIENT_INSTALL_ERROR
if not options.on_master:
+ nolog = tuple()
# First test out the kerberos configuration
try:
(krb_fd, krb_name) = tempfile.mkstemp()
@@ -929,6 +928,7 @@ def install(options, env, fstore, statestore):
print stdout
return CLIENT_INSTALL_ERROR
elif options.password:
+ nolog = (options.password,)
join_args.append("-w")
join_args.append(options.password)
elif options.prompt_password:
@@ -938,9 +938,10 @@ def install(options, env, fstore, statestore):
password = getpass.getpass("Password: ")
join_args.append("-w")
join_args.append(password)
+ nolog = (password,)
# Now join the domain
- (stdout, stderr, returncode) = run(join_args, raiseonerr=False, env=env)
+ (stdout, stderr, returncode) = run(join_args, raiseonerr=False, env=env, nolog=nolog)
if returncode != 0:
print >>sys.stderr, "Joining realm failed: %s" % stderr,
--
1.7.6
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
