sos/sos-bz1967113-ds-mask-password-in-ldif.patch
Pavel Moravec 0f27d057ca sos updates to RHEL 9.0.0 GA
- making 9.0 in par with 8.5
- adding a fix for SELinux bz1965002
- adding gating.yaml

Resolves: bz1965002 bz1967110 bz1967111 bz1967112
Resolves: bz1967113 bz1967114 bz1967115 bz1967116
Resolves: bz1967117 bz1967118 bz1967119 bz1967120

Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
2021-06-02 15:16:30 +02:00

51 lines
1.8 KiB
Diff

From 153c0154050a111fd7e5bcf4a685f906a1dea737 Mon Sep 17 00:00:00 2001
From: Jose Castillo <jcastillo@redhat.com>
Date: Wed, 10 Mar 2021 15:33:50 +0100
Subject: [PATCH] [ds] Mask password and encription keys in ldif files
Both /etc/dirsrv/slapd*/dse.ldif{,.startOK} files contain
sensitive information :
- all the nsSymmetricKey entries : symmetric encryption key
- nsslapd-rootpw : the admin password's hash
This patch masks these entries in the files we collect.
Resolves: #2442
Signed-off-by: Jose Castillo <jcastillo@redhat.com>
Signed-off-by: Jake Hunsaker <jhunsake@redhat.com>
---
sos/report/plugins/ds.py | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/sos/report/plugins/ds.py b/sos/report/plugins/ds.py
index f4d68d6e..d467dc89 100644
--- a/sos/report/plugins/ds.py
+++ b/sos/report/plugins/ds.py
@@ -74,4 +74,22 @@ class DirectoryServer(Plugin, RedHatPlugin):
self.add_cmd_output("ls -l /var/lib/dirsrv/slapd-*/db/*")
+ def postproc(self):
+ # Example for scrubbing rootpw hash
+ #
+ # nsslapd-rootpw: AAAAB3NzaC1yc2EAAAADAQABAAABAQDeXYA3juyPqaUuyfWV2HuIM
+ # v3gebb/5cvx9ehEAFF2yIKvsQN2EJGTV+hBM1DEOB4eyy/H11NqcNwm/2QsagDB3PVwYp
+ # 9VKN3BdhQjlhuoYKhLwgtYUMiGL8AX5g1qxjirIkTRJwjbXkSNuQaXig7wVjmvXnB2o7B
+ # zLtu99DiL1AizfVeZTYA+OVowYKYaXYljVmVKS+g3t29Obaom54ZLpfuoGMmyO64AJrWs
+ #
+ # to
+ #
+ # nsslapd-rootpw:********
+
+ regexppass = r"(nsslapd-rootpw(\s)*:(\s)*)(\S+)([\r\n]\s.*)*\n"
+ regexpkey = r"(nsSymmetricKey(\s)*::(\s)*)(\S+)([\r\n]\s.*)*\n"
+ repl = r"\1********\n"
+ self.do_path_regex_sub('/etc/dirsrv/*', regexppass, repl)
+ self.do_path_regex_sub('/etc/dirsrv/*', regexpkey, repl)
+
# vim: set et ts=4 sw=4 :
--
2.26.3