|
 |
904e70 |
From 5fd872c64c53af37015f366295e0c2418c969757 Mon Sep 17 00:00:00 2001
|
|
|
904e70 |
From: Yedidyah Bar David <didi@redhat.com>
|
|
|
904e70 |
Date: Thu, 26 May 2022 16:43:21 +0300
|
|
|
904e70 |
Subject: [PATCH] [ovirt] answer files: Filter out all password keys
|
|
|
904e70 |
|
|
|
904e70 |
Instead of hard-coding specific keys and having to maintain them over
|
|
|
904e70 |
time, replace the values of all keys that have 'password' in their name.
|
|
|
904e70 |
I think this covers all our current and hopefully future keys. It might
|
|
|
904e70 |
add "false positives" - keys that are not passwords but have 'password'
|
|
|
904e70 |
in their name - and I think that's a risk worth taking.
|
|
|
904e70 |
|
|
|
904e70 |
Sadly, the engine admin password prompt's name is
|
|
|
904e70 |
'OVESETUP_CONFIG_ADMIN_SETUP', which does not include 'password', so has
|
|
|
904e70 |
to be listed specifically.
|
|
|
904e70 |
|
|
|
904e70 |
A partial list of keys added since the replaced code was written:
|
|
|
904e70 |
- grafana-related stuff
|
|
|
904e70 |
- keycloak-related stuff
|
|
|
904e70 |
- otopi-style answer files
|
|
|
904e70 |
|
|
|
904e70 |
Signed-off-by: Yedidyah Bar David <didi@redhat.com>
|
|
|
904e70 |
Change-Id: I416c6e4078e7c3638493eb271d08d73a0c22b5ba
|
|
|
904e70 |
---
|
|
|
904e70 |
sos/report/plugins/ovirt.py | 23 +++++++++++++----------
|
|
|
904e70 |
1 file changed, 13 insertions(+), 10 deletions(-)
|
|
|
904e70 |
|
|
|
904e70 |
diff --git a/sos/report/plugins/ovirt.py b/sos/report/plugins/ovirt.py
|
|
|
904e70 |
index 09647bf1..3b1bb29b 100644
|
|
|
904e70 |
--- a/sos/report/plugins/ovirt.py
|
|
|
904e70 |
+++ b/sos/report/plugins/ovirt.py
|
|
|
904e70 |
@@ -241,19 +241,22 @@ class Ovirt(Plugin, RedHatPlugin):
|
|
|
904e70 |
r'{key}=********'.format(key=key)
|
|
|
904e70 |
)
|
|
|
904e70 |
|
|
|
904e70 |
- # Answer files contain passwords
|
|
|
904e70 |
- for key in (
|
|
|
904e70 |
- 'OVESETUP_CONFIG/adminPassword',
|
|
|
904e70 |
- 'OVESETUP_CONFIG/remoteEngineHostRootPassword',
|
|
|
904e70 |
- 'OVESETUP_DWH_DB/password',
|
|
|
904e70 |
- 'OVESETUP_DB/password',
|
|
|
904e70 |
- 'OVESETUP_REPORTS_CONFIG/adminPassword',
|
|
|
904e70 |
- 'OVESETUP_REPORTS_DB/password',
|
|
|
904e70 |
+ # Answer files contain passwords.
|
|
|
904e70 |
+ # Replace all keys that have 'password' in them, instead of hard-coding
|
|
|
904e70 |
+ # here the list of keys, which changes between versions.
|
|
|
904e70 |
+ # Sadly, the engine admin password prompt name does not contain
|
|
|
904e70 |
+ # 'password'... so neither does the env key.
|
|
|
904e70 |
+ for item in (
|
|
|
904e70 |
+ 'password',
|
|
|
904e70 |
+ 'OVESETUP_CONFIG_ADMIN_SETUP',
|
|
|
904e70 |
):
|
|
|
904e70 |
self.do_path_regex_sub(
|
|
|
904e70 |
r'/var/lib/ovirt-engine/setup/answers/.*',
|
|
|
904e70 |
- r'{key}=(.*)'.format(key=key),
|
|
|
904e70 |
- r'{key}=********'.format(key=key)
|
|
|
904e70 |
+ re.compile(
|
|
|
904e70 |
+ r'(?P<key>[^=]*{item}[^=]*)=.*'.format(item=item),
|
|
|
904e70 |
+ flags=re.IGNORECASE
|
|
|
904e70 |
+ ),
|
|
|
904e70 |
+ r'\g<key>=********'
|
|
|
904e70 |
)
|
|
|
904e70 |
|
|
|
904e70 |
# aaa profiles contain passwords
|
|
|
904e70 |
--
|
|
|
904e70 |
2.34.3
|
|
|
904e70 |
|