From 4106c7dcfc685580eeb0f2074872036cd5faaaae Mon Sep 17 00:00:00 2001 From: Abhijeet Kasurde Date: Thu, 27 Apr 2017 16:23:41 +0530 Subject: [PATCH] Hide PKI Client database password in log file This fix masks PKI client database password from showing in CA/KRA installer log file Fixes https://pagure.io/freeipa/issue/6904 Signed-off-by: Abhijeet Kasurde Reviewed-By: Stanislav Laznicka --- ipaserver/install/cainstance.py | 5 ++++- ipaserver/install/krainstance.py | 9 ++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index 0672bccf79d7cc6133fdb20f0854366306bfc2e0..84d60bfddc0fb968f31706e54e36557e9543846e 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -610,7 +610,10 @@ class CAInstance(DogtagInstance): try: DogtagInstance.spawn_instance( self, cfg_file, - nolog_list=(self.dm_password, self.admin_password, pki_pin) + nolog_list=(self.dm_password, + self.admin_password, + pki_pin, + self.tmp_agent_pwd) ) finally: os.remove(cfg_file) diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py index fc25ac72b0dc593f06a8b070b67b5d54a0ab8bce..c39d6874a9d685f91b5d30ea1954320b8ee0c1ed 100644 --- a/ipaserver/install/krainstance.py +++ b/ipaserver/install/krainstance.py @@ -150,6 +150,7 @@ class KRAInstance(DogtagInstance): os.chown(cfg_file, pent.pw_uid, pent.pw_gid) self.tmp_agent_db = tempfile.mkdtemp( prefix="tmp-", dir=paths.VAR_LIB_IPA) + tmp_agent_pwd = ipautil.ipa_generate_password() # Create KRA configuration config = ConfigParser() @@ -173,8 +174,7 @@ class KRAInstance(DogtagInstance): # Client security database config.set("KRA", "pki_client_database_dir", self.tmp_agent_db) - config.set("KRA", "pki_client_database_password", - ipautil.ipa_generate_password()) + config.set("KRA", "pki_client_database_password", tmp_agent_pwd) config.set("KRA", "pki_client_database_purge", "True") config.set("KRA", "pki_client_pkcs12_password", self.admin_password) @@ -283,7 +283,10 @@ class KRAInstance(DogtagInstance): try: DogtagInstance.spawn_instance( self, cfg_file, - nolog_list=(self.dm_password, self.admin_password, pki_pin) + nolog_list=(self.dm_password, + self.admin_password, + pki_pin, + tmp_agent_pwd) ) finally: os.remove(p12_tmpfile_name) -- 2.12.2