Bug 166597

Summary:	No way to set LDAP bind passwd without having it visible on the command line
Product:	[Fedora] Fedora	Reporter:	Mark McLoughlin <markmc>
Component:	samba	Assignee:	Jay Fenlason <fenlason>
Status:	CLOSED CURRENTRELEASE	QA Contact:	David Lawrence <dkl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	jfeeney
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba-common-3.0.23	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-01-02 08:22:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark McLoughlin 2005-08-23 18:11:14 UTC

To set the LDAP bind passwd for samba (in secrets.tdb) you must use "smbpasswd
-w passwd"

It would be nice if smbpasswd would prompt for the password if it wasn't
supplied on the command line

Rationale is that for the brief time that smbpasswd is running, the password is
visible to everyone via /prov/$pid/cmdline, which isn't ideal

Comment 1 W. Michael Petullo 2005-12-24 15:27:31 UTC

This is a security issue.  The smbpasswd program should support reading the 
admin password from a prompt, and also support the -s option (read from stdin.)
 Can the owner of this bug set the severity to secruity?

Comment 2 W. Michael Petullo 2005-12-24 17:21:37 UTC

See also upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=3356.

Comment 3 W. Michael Petullo 2006-03-20 15:41:07 UTC

I think this is now fixed in the upstream SVN tree.  See 
http://viewcvs.samba.org/cgi-bin/viewcvs.cgi?rev=13524&view=rev.

Comment 4 W. Michael Petullo 2006-12-30 18:17:24 UTC

It looks like Fedora has incorporated the upstream fix.  I'm not sure exactly
when this was pulled in, but samba-common-3.0.23c-2 is good (see the new -W and
-s options.)  I tried to close this bug, but I can't because I was not the reporter.

Comment 5 Mark McLoughlin 2007-01-02 08:22:17 UTC

Thanks, confirmed