|
 |
ba407d |
From 153c0154050a111fd7e5bcf4a685f906a1dea737 Mon Sep 17 00:00:00 2001
|
|
|
ba407d |
From: Jose Castillo <jcastillo@redhat.com>
|
|
|
ba407d |
Date: Wed, 10 Mar 2021 15:33:50 +0100
|
|
|
ba407d |
Subject: [PATCH] [ds] Mask password and encription keys in ldif files
|
|
|
ba407d |
|
|
|
ba407d |
Both /etc/dirsrv/slapd*/dse.ldif{,.startOK} files contain
|
|
|
ba407d |
sensitive information :
|
|
|
ba407d |
- all the nsSymmetricKey entries : symmetric encryption key
|
|
|
ba407d |
- nsslapd-rootpw : the admin password's hash
|
|
|
ba407d |
|
|
|
ba407d |
This patch masks these entries in the files we collect.
|
|
|
ba407d |
|
|
|
ba407d |
Resolves: #2442
|
|
|
ba407d |
|
|
|
ba407d |
Signed-off-by: Jose Castillo <jcastillo@redhat.com>
|
|
|
ba407d |
Signed-off-by: Jake Hunsaker <jhunsake@redhat.com>
|
|
|
ba407d |
---
|
|
|
ba407d |
sos/report/plugins/ds.py | 18 ++++++++++++++++++
|
|
|
ba407d |
1 file changed, 18 insertions(+)
|
|
|
ba407d |
|
|
|
ba407d |
diff --git a/sos/report/plugins/ds.py b/sos/report/plugins/ds.py
|
|
|
ba407d |
index f4d68d6e..d467dc89 100644
|
|
|
ba407d |
--- a/sos/report/plugins/ds.py
|
|
|
ba407d |
+++ b/sos/report/plugins/ds.py
|
|
|
ba407d |
@@ -74,4 +74,22 @@ class DirectoryServer(Plugin, RedHatPlugin):
|
|
|
ba407d |
|
|
|
ba407d |
self.add_cmd_output("ls -l /var/lib/dirsrv/slapd-*/db/*")
|
|
|
ba407d |
|
|
|
ba407d |
+ def postproc(self):
|
|
|
ba407d |
+ # Example for scrubbing rootpw hash
|
|
|
ba407d |
+ #
|
|
|
ba407d |
+ # nsslapd-rootpw: AAAAB3NzaC1yc2EAAAADAQABAAABAQDeXYA3juyPqaUuyfWV2HuIM
|
|
|
ba407d |
+ # v3gebb/5cvx9ehEAFF2yIKvsQN2EJGTV+hBM1DEOB4eyy/H11NqcNwm/2QsagDB3PVwYp
|
|
|
ba407d |
+ # 9VKN3BdhQjlhuoYKhLwgtYUMiGL8AX5g1qxjirIkTRJwjbXkSNuQaXig7wVjmvXnB2o7B
|
|
|
ba407d |
+ # zLtu99DiL1AizfVeZTYA+OVowYKYaXYljVmVKS+g3t29Obaom54ZLpfuoGMmyO64AJrWs
|
|
|
ba407d |
+ #
|
|
|
ba407d |
+ # to
|
|
|
ba407d |
+ #
|
|
|
ba407d |
+ # nsslapd-rootpw:********
|
|
|
ba407d |
+
|
|
|
ba407d |
+ regexppass = r"(nsslapd-rootpw(\s)*:(\s)*)(\S+)([\r\n]\s.*)*\n"
|
|
|
ba407d |
+ regexpkey = r"(nsSymmetricKey(\s)*::(\s)*)(\S+)([\r\n]\s.*)*\n"
|
|
|
ba407d |
+ repl = r"\1********\n"
|
|
|
ba407d |
+ self.do_path_regex_sub('/etc/dirsrv/*', regexppass, repl)
|
|
|
ba407d |
+ self.do_path_regex_sub('/etc/dirsrv/*', regexpkey, repl)
|
|
|
ba407d |
+
|
|
|
ba407d |
# vim: set et ts=4 sw=4 :
|
|
|
ba407d |
--
|
|
|
ba407d |
2.26.3
|
|
|
ba407d |
|