RHQ CLI - Obfuscating user/password data

[Andy Overton]

Hi,

 

Does anyone know if it's possible to use obfuscated username/password values
to connect to RHQ via the CLI?

 

Seems like an obvious thing to do but from the docs it looks like you can
either pass in the username/pass in plain text or get it to prompt you for
the password but no option to use obfuscated values.

 

So, I can do:

 

rhq-cli.sh -u rhqadmin -p rhqadmin

 

rhq-cli.sh -u rhqadmin -P

 

but I need to do

 

rhq-cli.sh -u H*%@SDAFSDF -p H*%@SDAFSDF

 

or similar.

 

The problem is this needs to run as a cron job so I can't prompt for the
password but don't want it stored as plain text.

 

Thanks,

 

Andy

[Thomas Segismont]

Hi,

This not possible currently. Would you like to contribute the "read 
credentials from file" feature? We can help and it would be a nice add.

Regards,
Thomas

Le 15/01/2014 18:09, Andy Overton a écrit :
>  Hi,
>
>  Does anyone know if it’s possible to use obfuscated username/password
>  values to connect to RHQ via the CLI?
>
>  Seems like an obvious thing to do but from the docs it looks like you
>  can either pass in the username/pass in plain text or get it to prompt
>  you for the password but no option to use obfuscated values.
>
>  So, I can do:
>
>  rhq-cli.sh -u rhqadmin -p rhqadmin
>
>  rhq-cli.sh -u rhqadmin –P
>
>  but I need to do
>
>  rhq-cli.sh -u H*%@SDAFSDF -p H*%@SDAFSDF
>
>  or similar.
>
>  The problem is this needs to run as a cron job so I can’t prompt for the
>  password but don’t want it stored as plain text.
>
>  Thanks,
>
>  Andy
>
>
>
>  _______________________________________________
>  rhq-users mailing list
>  rhq-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/rhq-users
>

[Stefan Negrea]

Hello Andy,

The cron configuration is only accessible to the respective authenticated user or the root
user. So non-root users should not be able to see the configuration from other users. Can
you elaborate a little why storing the password without obfuscation can be a problem if
nobody other than the user itself has access to it? 

You could also create a cron job from the root that downgrades the execution to a non-root
user (using su). So you are guaranteed that only the root user has access to the cron
config (user/pass for the cli command). 


Does this help?


Thank you,
Stefan Negrea


----- Original Message -----
>  From: "Thomas Segismont" <tsegismo(a)redhat.com&gt;
>  To: rhq-users(a)lists.fedorahosted.org
>  Sent: Thursday, January 16, 2014 11:16:26 AM
>  Subject: Re: RHQ CLI - Obfuscating user/password data
>  
>  Hi,
>  
>  This not possible currently. Would you like to contribute the "read
>  credentials from file" feature? We can help and it would be a nice add.
>  
>  Regards,
>  Thomas
>  
>  Le 15/01/2014 18:09, Andy Overton a écrit :
>  > Hi,
>  >
>  > Does anyone know if it’s possible to use obfuscated username/password
>  > values to connect to RHQ via the CLI?
>  >
>  > Seems like an obvious thing to do but from the docs it looks like you
>  > can either pass in the username/pass in plain text or get it to prompt
>  > you for the password but no option to use obfuscated values.
>  >
>  > So, I can do:
>  >
>  > rhq-cli.sh -u rhqadmin -p rhqadmin
>  >
>  > rhq-cli.sh -u rhqadmin –P
>  >
>  > but I need to do
>  >
>  > rhq-cli.sh -u H*%@SDAFSDF -p H*%@SDAFSDF
>  >
>  > or similar.
>  >
>  > The problem is this needs to run as a cron job so I can’t prompt for the
>  > password but don’t want it stored as plain text.
>  >
>  > Thanks,
>  >
>  > Andy
>  >
>  >
>  >
>  > _______________________________________________
>  > rhq-users mailing list
>  > rhq-users(a)lists.fedorahosted.org
>  > https://lists.fedorahosted.org/mailman/listinfo/rhq-users
>  >
>  
>  _______________________________________________
>  rhq-users mailing list
>  rhq-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/rhq-users
>

[Andy Overton]

Hi Stefan,

Thanks for your reply. I'm going to try your second suggestion. Thanks for your help.
I'll let you know the outcome.

Regards,

Andy

-----Original Message-----
From: rhq-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of Stefan Negrea
Sent: 21 January 2014 17:27
To: rhq-users(a)lists.fedorahosted.org
Subject: Re: RHQ CLI - Obfuscating user/password data

Hello Andy,

The cron configuration is only accessible to the respective authenticated user or the root
user. So non-root users should not be able to see the configuration from other users. Can
you elaborate a little why storing the password without obfuscation can be a problem if
nobody other than the user itself has access to it? 

You could also create a cron job from the root that downgrades the execution to a non-root
user (using su). So you are guaranteed that only the root user has access to the cron
config (user/pass for the cli command). 


Does this help?


Thank you,
Stefan Negrea


----- Original Message -----
>  From: "Thomas Segismont" <tsegismo(a)redhat.com&gt;
>  To: rhq-users(a)lists.fedorahosted.org
>  Sent: Thursday, January 16, 2014 11:16:26 AM
>  Subject: Re: RHQ CLI - Obfuscating user/password data
>  
>  Hi,
>  
>  This not possible currently. Would you like to contribute the "read 
>  credentials from file" feature? We can help and it would be a nice add.
>  
>  Regards,
>  Thomas
>  
>  Le 15/01/2014 18:09, Andy Overton a écrit :
>  > Hi,
>  >
>  > Does anyone know if it’s possible to use obfuscated 
>  > username/password values to connect to RHQ via the CLI?
>  >
>  > Seems like an obvious thing to do but from the docs it looks like 
>  > you can either pass in the username/pass in plain text or get it to 
>  > prompt you for the password but no option to use obfuscated values.
>  >
>  > So, I can do:
>  >
>  > rhq-cli.sh -u rhqadmin -p rhqadmin
>  >
>  > rhq-cli.sh -u rhqadmin –P
>  >
>  > but I need to do
>  >
>  > rhq-cli.sh -u H*%@SDAFSDF -p H*%@SDAFSDF
>  >
>  > or similar.
>  >
>  > The problem is this needs to run as a cron job so I can’t prompt for 
>  > the password but don’t want it stored as plain text.
>  >
>  > Thanks,
>  >
>  > Andy
>  >
>  >
>  >
>  > _______________________________________________
>  > rhq-users mailing list
>  > rhq-users(a)lists.fedorahosted.org
>  > https://lists.fedorahosted.org/mailman/listinfo/rhq-users
>  >
>  
>  _______________________________________________
>  rhq-users mailing list
>  rhq-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/rhq-users
>   
_______________________________________________
rhq-users mailing list
rhq-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/rhq-users