[Freeipa-devel] [PATCH] Don't pass the DM password on the command-line

[Rob Crittenden]

Simo Sorce wrote:
> On Mon, 2008-05-19 at 14:29 -0400, Rob Crittenden wrote:
>> We used the -w flag when calling ldapmodify so were passing the DM 
>> password on the command-line. This meant that if something went wrong 
>> the DM password got logged.
>>
>> Use the -y flag instead which takes a file. I'm using mkstemp() to 
>> create that file and a try/finally to be sure it is always removed,
>> even 
>> if an error is thrown.
> 
> I'll ack if you add an extra chmod 400 for safety before you write the
> password.
> 
> Thanks for fixing this.
> 
> Simo.
> 

The file is already created mode 0600, is that good enough? From the 
docs at http://docs.python.org/lib/module-tempfile.html

mkstemp( [suffix[, prefix[, dir[, text]]]])

     Creates a temporary file in the most secure manner possible. There 
are no race conditions in the file's creation, assuming that the 
platform properly implements the O_EXCL flag for os.open(). The file is 
readable and writable only by the creating user ID. If the platform uses 
permission bits to indicate whether a file is executable, the file is 
executable by no one. The file descriptor is not inherited by child 
processes.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20080519/49a1d861/attachment.bin>