Bug 1052202
Summary: | [rhevm-dwh-setup] rhevm-dwh-setup drops '"' from read db password | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Virtualization Manager | Reporter: | Jiri Belka <jbelka> | |
Component: | ovirt-engine-dwh | Assignee: | Yedidyah Bar David <didi> | |
Status: | CLOSED ERRATA | QA Contact: | Barak Dagan <bdagan> | |
Severity: | medium | Docs Contact: | ||
Priority: | medium | |||
Version: | 3.3.0 | CC: | aberezin, acathrow, adahms, alonbl, bazulay, didi, gklein, iheim, jbelka, pstehlik, Rhev-m-bugs, sbonazzo, scohen, yeylon, ylavi | |
Target Milestone: | --- | Keywords: | ZStream | |
Target Release: | 3.4.0 | |||
Hardware: | Unspecified | |||
OS: | Unspecified | |||
Whiteboard: | integration | |||
Fixed In Version: | Doc Type: | Bug Fix | ||
Doc Text: |
Previously, including a double quotation mark in the password for the history database would cause the ovirt-engine-dwh-setup command to fail due to an authentication error. This was caused by the double quotation marks not being considered a part of the password. Now, the ovirt-engine-dwh-setup command disallows the characters '"', '\', '#', and '$'.
|
Story Points: | --- | |
Clone Of: | ||||
: | 1065781 (view as bug list) | Environment: | ||
Last Closed: | 2014-06-09 15:16:42 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 1065781, 1078909, 1142926 |
Description
Jiri Belka
2014-01-13 13:46:03 UTC
*** Bug 1052848 has been marked as a duplicate of this bug. *** This happens due to us removing all '"' from all credentials. In ovirt-engine-dwh-setup.py:getDbDictFromOptions: db_dict[k] = s.strip('"') To fix this properly, we should not do that, and instead of parsing ourselves, use the module configfile from ovirt-engine-lib (rhevm-lib). This module does not support writing, just reading, so a partial solution will be to copy the parsing from it to the current parser (common_utils.py:TextConfigFileHandler). For the meantime, we might want to add a note to the release notes that a remote db user's password should not contain '"'. Well I think the password should be saved in its real form. Right now the code escapes and saves escaped specific chars in password. See: [root@bz ~]# grep -i pass /etc/ovirt-engine/engine.conf.d/10-setup-database.conf ENGINE_DB_PASSWORD="Z6AA"4txi\"" Real password's form is: Z6AA"4txi" I have never seen any application saving plain-text password in files escaped. (In reply to Jiri Belka from comment #3) > Well I think the password should be saved in its real form. Right now the > code escapes and saves escaped specific chars in password. See: > > [root@bz ~]# grep -i pass > /etc/ovirt-engine/engine.conf.d/10-setup-database.conf > ENGINE_DB_PASSWORD="Z6AA"4txi\"" > > Real password's form is: Z6AA"4txi" > > I have never seen any application saving plain-text password in files > escaped. Any application whose configuration is intended to be parsed by a shell does that. E.g. most of the files in /etc/sysconfig. It's not specific to the password, btw. These files are read by at least 3 different parsers: 1. They are sourced by sh - in engine-prolog.sh 2. They are read by Java code, in LocalConfig.java 3. They are read by the above-mentioned configfile python code dwh and reports have their own simple parser (two unsynced copies of it) and as I said we better get rid of it in favor of configfile. Anyway, accepting your suggestion of keeping unescaped strings in these files means rewriting quite a lot of code. So it won't happen. Barak, do we want this fixed for z stream? Yaniv simplest solution for now is just to forbid '"', if you can please check the new setup and see if problem exists there. Do we want this fixed in 3.3.z? See comment #4 for the (somewhat) complex fix this will require. In 3.4 the setup is rewritten and so porting a fix from there to 3.3 is not practical. As Alon said, we can simply forbid '"' in passwords for 3.3. Arthur, We intend to ban the use of '"' in the setup entirely (this is consistent with ethe engin's behaviour (see comment #7). Please ack Moving to QA as 24464 is irrelevant for 3.4 - the code there was rewritten and should behave well. Verified on av2.1 rhevm-dwh-3.4.0-0.4.master.20140224152332.el6ev.noarch rhevm-dwh-setup-3.4.0-0.4.master.20140224152332.el6ev.noarch rhevm-reports-setup-3.4.0-0.4.master.20140226133324.el6ev.noarch rhevm-reports-3.4.0-0.4.master.20140226133324.el6ev.noarch jasperreports-server-pro-5.5.0-8.el6ev.noarch # grep -i pass /etc/ovirt-engine/engine.conf.d/10-setup-database.conf ENGINE_DB_PASSWORD="Z6AA"4txi\"" Reports installation passed. Is that enough Jiri ? OK. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHEA-2014-0601.html |