Attachment 305990 Details for Bug 446865 – Don't pass the DM password on the command-line, use a file

[patch] Don't pass the DM password on the command-line, use a file

freeipa-23-ldapmodify.patch (text/plain), 2.76 KB, created by Rob Crittenden on 2008-05-19 18:29:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2008-05-19 18:29:45 UTC

Size: 2.76 KB

patch

obsolete

>From c3d247c6324fbe48715f53a8d85c20215894de08 Mon Sep 17 00:00:00 2001
>From: Rob Crittenden <rcritten@redhat.com>
>Date: Mon, 19 May 2008 14:31:02 -0400
>Subject: [PATCH] Don't pass the Directory Manager password on the command-line to ldapmodify.
>
>446865
>---
> ipa-server/ipaserver/dsinstance.py  |   16 ++++++++++++----
> ipa-server/ipaserver/krbinstance.py |   15 +++++++++++----
> 2 files changed, 23 insertions(+), 8 deletions(-)
>
>diff --git a/ipa-server/ipaserver/dsinstance.py b/ipa-server/ipaserver/dsinstance.py
>index 9a80548..f0ff2da 100644
>--- a/ipa-server/ipaserver/dsinstance.py
>+++ b/ipa-server/ipaserver/dsinstance.py
>@@ -26,6 +26,7 @@ import sys
> import os
> import re
> import time
>+import tempfile
> 
> from ipa import ipautil
> 
>@@ -279,13 +280,20 @@ class DsInstance(service.Service):
>             fd = ipautil.write_tmp_file(txt)
>             path = fd.name
> 
>+        [pw_fd, pw_name] = tempfile.mkstemp()
>+        os.write(pw_fd, self.dm_password)
>+        os.close(pw_fd)
>+
>         args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv",
>-                "-D", "cn=Directory Manager", "-w", self.dm_password, "-f", path]
>+                "-D", "cn=Directory Manager", "-y", pw_name, "-f", path]
> 
>         try:
>-            ipautil.run(args)
>-        except ipautil.CalledProcessError, e:
>-            logging.critical("Failed to load %s: %s" % (ldif, str(e)))
>+            try:
>+                ipautil.run(args)
>+            except ipautil.CalledProcessError, e:
>+                logging.critical("Failed to load %s: %s" % (ldif, str(e)))
>+        finally:
>+            os.remove(pw_name)
> 
>         if not fd is None:
>             fd.close()
>diff --git a/ipa-server/ipaserver/krbinstance.py b/ipa-server/ipaserver/krbinstance.py
>index 50250f6..7ad03e1 100644
>--- a/ipa-server/ipaserver/krbinstance.py
>+++ b/ipa-server/ipaserver/krbinstance.py
>@@ -211,13 +211,20 @@ class KrbInstance(service.Service):
>         txt = ipautil.template_file(ipautil.SHARE_DIR + ldif, self.sub_dict)
>         fd = ipautil.write_tmp_file(txt)
> 
>+        [pw_fd, pw_name] = tempfile.mkstemp()
>+        os.write(pw_fd, self.admin_password)
>+        os.close(pw_fd)
>+
>         args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv",
>-                "-D", "cn=Directory Manager", "-w", self.admin_password, "-f", fd.name]
>+                "-D", "cn=Directory Manager", "-y", pw_name, "-f", fd.name]
> 
>         try:
>-            ipautil.run(args)
>-        except ipautil.CalledProcessError, e:
>-            logging.critical("Failed to load %s: %s" % (ldif, str(e)))
>+            try:
>+                ipautil.run(args)
>+            except ipautil.CalledProcessError, e:
>+                logging.critical("Failed to load %s: %s" % (ldif, str(e)))
>+        finally:
>+            os.remove(pw_name)
> 
>         fd.close()
> 
>-- 
>1.5.4
>

Actions: View | Diff

Attachments on bug 446865: 305990