New password for fuel user saved after changing in bash history

[Egor Kotko]

{"build_id": "2015-05-24_15-51-50", "build_number": "462", "release_versions": {"2014.2.2-6.1": {"VERSION": {"build_id": "2015-05-24_15-51-50", "build_number": "462", "api": "1.0", "fuel-library_sha": "889c2534ceadf8afd5d1540c1cadbd913c0c8c14", "nailgun_sha": "76441596e4fe6420cc7819427662fa244e150177", "feature_groups": ["mirantis"], "openstack_version": "2014.2.2-6.1", "production": "docker", "python-fuelclient_sha": "e19f1b65792f84c4a18b5a9473f85ef3ba172fce", "astute_sha": "0bd72c72369e743376864e8e8dabfe873d40450a", "fuel-ostf_sha": "9a5f55602c260d6c840c8333d8f32ec8cfa65c1f", "release": "6.1", "fuelmain_sha": "5c8ebddf64ea93000af2de3ccdb4aa8bb766ce93"}}}, "auth_required": true, "api": "1.0", "fuel-library_sha": "889c2534ceadf8afd5d1540c1cadbd913c0c8c14", "nailgun_sha": "76441596e4fe6420cc7819427662fa244e150177", "feature_groups": ["mirantis"], "openstack_version": "2014.2.2-6.1", "production": "docker", "python-fuelclient_sha": "e19f1b65792f84c4a18b5a9473f85ef3ba172fce", "astute_sha": "0bd72c72369e743376864e8e8dabfe873d40450a", "fuel-ostf_sha": "9a5f55602c260d6c840c8333d8f32ec8cfa65c1f", "release": "6.1", "fuelmain_sha": "5c8ebddf64ea93000af2de3ccdb4aa8bb766ce93"}

New password for fuel user saved after changing in bash history.
http://paste.openstack.org/show/265842/

And it is require input new password each time when necessary to execute commands:
http://paste.openstack.org/show/265843/

[Dmitry Pyzhov (dpyzhov)]

There should be an option to provide a password interactively

[Vladimir Kozhukalov (kozhukalov)]

The correct way to deal with this is to implement passwd like way of changing password. Otherwise, everyone who can see the process list on a node can see this new password. As fast workaround we can simply prevent bash from writing command history.

[Vladimir Kozhukalov (kozhukalov)]

HISTCONTROL
              A colon-separated list of values controlling how commands are saved on the history list. If the
              list of values includes ignorespace, lines which begin with a space character are not saved in the
              history list. A value of ignoredups causes lines matching the previous history entry to not be
              saved. A value of ignoreboth is shorthand for ignorespace and ignoredups. A value of erasedups
              causes all previous lines matching the current line to be removed from the history list before that
              line is saved. Any value not in the above list is ignored. If HISTCONTROL is unset, or does not
              include a valid value, all lines read by the shell parser are saved on the history list, subject to
              the value of HISTIGNORE. The second and subsequent lines of a multi-line compound command are not
              tested, and are added to the history regardless of the value of HISTCONTROL.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/209909

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/209909
Committed: https://git.openstack.org/cgit/stackforge/python-fuelclient/commit/?id=62c569281c6300af6c291fc6dc4627b60e92bdff
Submitter: Jenkins
Branch: master

commit 62c569281c6300af6c291fc6dc4627b60e92bdff
Author: Sylwester Brzeczkowski <email address hidden>
Date: Thu Aug 6 14:18:45 2015 +0200

    Change user passwd in CLI using interacive prompt

    `fuel user change-password` now asks for password in interactive
    prompt in unix `passwd` style, which is secure
    comparing with passing new password as an argument to CLI.
    Also tests added.

    Change-Id: I88fd38e8bd0bb96dd9b596aa44fa3f7721ee6431
    Closes-Bug: 1462343

[Vladimir Khlyunev (vkhlyunev)]

ISO #287

[root@nailgun ~]# fuel user --help
...
  -h, --help show this help message and exit
  --newpass NEWPASS, --new-pass NEWPASS
                        new_password
  --change-password Change user password. WARNING: This method of changing the password is dangerous - it may be saved in bash history.

The help message contains misleading warning - main goal of --change-password is to prevent saving new password in bash history but the help message tells our otherwise. We should move this warning to --newpass.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/221279

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/221279
Committed: https://git.openstack.org/cgit/stackforge/python-fuelclient/commit/?id=a29d92a5cafecf5a0a202f7700ccd4368c5f740f
Submitter: Jenkins
Branch: master

commit a29d92a5cafecf5a0a202f7700ccd4368c5f740f
Author: Sylwester Brzeczkowski <email address hidden>
Date: Tue Sep 8 14:32:11 2015 +0200

    Change warning message in change password help

    Warning message was applied to wrong argument - fixed.

    Change-Id: I2375f8b8bd0fbc3a543f532211353ac195124221
    Closes-Bug: #1462343

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/7.0
Review: https://review.openstack.org/221288

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/221288
Committed: https://git.openstack.org/cgit/stackforge/python-fuelclient/commit/?id=2864459e27b0510a0f7aedac6cdf27901ef5c481
Submitter: Jenkins
Branch: stable/7.0

commit 2864459e27b0510a0f7aedac6cdf27901ef5c481
Author: Sylwester Brzeczkowski <email address hidden>
Date: Tue Sep 8 14:32:11 2015 +0200

    Change warning message in change password help

    Warning message was applied to wrong argument - fixed.

    Change-Id: I2375f8b8bd0fbc3a543f532211353ac195124221
    Closes-Bug: #1462343
    (cherry picked from commit a29d92a5cafecf5a0a202f7700ccd4368c5f740f)

[Peter Zhurba (pzhurba)]

Steps to verify

[root@nailgun ~]# fuel user --help
usage: fuel user [-h] [--newpass NEWPASS] [--change-password]

optional arguments:
  -h, --help show this help message and exit
  --newpass NEWPASS, --new-pass NEWPASS
                        WARNING: This method of changing the password is dangerous - it may be saved in bash history.
  --change-password Change user password using interactive prompt

Examples:

 To change user password:
            fuel user change-password

[root@nailgun ~]# fuel user --newpass pirat
[root@nailgun ~]# fuel user --new-pass pirat1
[root@nailgun ~]# fuel user --new pirat1
usage: fuel user [-h] [--newpass NEWPASS] [--change-password]
fuel user: error: ambiguous option: --new could match --newpass, --new-pass
[root@nailgun ~]# fuel user --change-password
Changing password for Fuel User.
New Password:
Retype new Password:
Passwords are not the same.
[root@nailgun ~]# cat /etc/fuel/release_versions/2015.1.0-7.0.yaml
VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "7.0"
  openstack_version: "2015.1.0-7.0"
  api: "1.0"
  build_number: "289"

[Sergey Novikov (snovikov)]

Verified on
VERSION:
  feature_groups:
    - mirantis
  production: "docker"
  release: "8.0"
  openstack_version: "2015.1.0-8.0"
  api: "1.0"
  build_number: "108"
  build_id: "108"
  fuel-nailgun_sha: "ec56b54491ecb0182f66e675f549825abc1a96ee"
  python-fuelclient_sha: "286939d3be220828f52e73b65928ed39662e1853"
  fuel-agent_sha: "e881f0dabd09af4be4f3e22768b02fe76278e20e"
  fuel-nailgun-agent_sha: "d66f188a1832a9c23b04884a14ef00fc5605ec6d"
  astute_sha: "0f753467a3f16e4d46e7e9f1979905fb178e4d5b"
  fuel-library_sha: "acfcfd289ca454585687b6ff9651b53e4ffaf0cd"
  fuel-ostf_sha: "37c5d6113408a29cabe0f416fe99cf20e2bca318"
  fuelmain_sha: "8e5e75302b2534fd38e4b41b795957111ac75543"