IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 07:33:27 -06:00
Code Issues Packages Projects Releases Wiki Activity

Remove sensitive information from logs

Browse Source 
When -w/--password option is passed to ipa-replica-install it is
printed to ipareplica-install.log. Make sure that the value of this
option is hidden.

https://fedorahosted.org/freeipa/ticket/1378
This commit is contained in:
Martin Kosek 2011-07-12 10:02:09 +02:00
parent 0cb65fd9f6
commit 02520ab98c
2 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ipapython/ipautil.py
View File

@ -210,8 +210,6 @@ def run(args, stdin=None, raiseonerr=True,
if capture_output:
p_out = subprocess.PIPE
p_err = subprocess.PIPE
elif len(nolog):
raise RuntimeError("Can't use nolog if output is not captured")
p = subprocess.Popen(args, stdin=p_in, stdout=p_out, stderr=p_err,
close_fds=True, env=env)
@ -224,13 +222,14 @@ def run(args, stdin=None, raiseonerr=True,
for value in nolog:
if not isinstance(value, basestring):
continue
args = args.replace(value, 'XXXXXXXX')
stdout = stdout.replace(value, 'XXXXXXXX')
stderr = stderr.replace(value, 'XXXXXXXX')
quoted = urllib2.quote(value)
args = args.replace(quoted, 'XXXXXXXX')
stdout = stdout.replace(quoted, 'XXXXXXXX')
stderr = stderr.replace(quoted, 'XXXXXXXX')
for nolog_value in (value, quoted):
if capture_output:
stdout = stdout.replace(nolog_value, 'XXXXXXXX')
stderr = stderr.replace(nolog_value, 'XXXXXXXX')
args = args.replace(nolog_value, 'XXXXXXXX')
logging.debug('args=%s' % args)
if capture_output:
logging.debug('stdout=%s' % stdout)

7
ipaserver/install/replication.py
View File

@ -55,15 +55,16 @@ def replica_conn_check(master_host, host_name, realm, check_ca,
"--auto-master-check", "--realm", realm,
"--principal", "admin",
"--hostname", host_name]
nolog=tuple()
if admin_password:
args.extend(["--password", admin_password])
nolog=(admin_password,)
if check_ca:
args.append('--check-ca')
logging.debug("Running ipa-replica-conncheck with following arguments: %s" %
" ".join(args))
(stdin, stderr, returncode) = ipautil.run(args,raiseonerr=False, capture_output=False)
(stdin, stderr, returncode) = ipautil.run(args,raiseonerr=False,capture_output=False,
nolog=nolog)
if returncode != 0:
sys.exit("Connection check failed!" +