tyler.durden
/
icinga2
mirror of https://github.com/Icinga/icinga2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve api user command 

--oneline can now be used to print out only the password hash string.
This can be used to update ApiUser passwords through the API. There is
also now a validation to make use salt does not contain a '$' which
would break verification.
This commit is contained in:
Jean Flach 2017-12-22 13:01:51 +01:00
parent 2e5aedd28a
commit aad44dfbb2
1 changed files with 25 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
lib/cli/apiusercommand.cpp
View File

@ -44,7 +44,8 @@ void ApiUserCommand::InitParameters(boost::program_options::options_description&
visibleDesc.add_options() visibleDesc.add_options()
("user", po::value<std::string>(), "API username") ("user", po::value<std::string>(), "API username")
("passwd", po::value<std::string>(), "Password in clear text") ("passwd", po::value<std::string>(), "Password in clear text")
("salt", po::value<std::string>(), "Optional salt (default: 8 random chars)"); ("salt", po::value<std::string>(), "Optional salt (default: 8 random chars)")
("oneline", "Print only the password hash");
} }
/** /**
@ -54,22 +55,32 @@ void ApiUserCommand::InitParameters(boost::program_options::options_description&
*/ */
int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const std::vector<std::string>& ap) const int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const std::vector<std::string>& ap) const
{ {
if (!vm.count("user")) { String user, passwd, salt;
if (!vm.count("user") && !vm.count("oneline")) {
Log(LogCritical, "cli", "Username (--user) must be specified."); Log(LogCritical, "cli", "Username (--user) must be specified.");
return 1; return 1;
} } else
user = vm["user"].as<std::string>();
if (!vm.count("passwd")) { if (!vm.count("passwd")) {
Log(LogCritical, "cli", "Password (--passwd) must be specified."); Log(LogCritical, "cli", "Password (--passwd) must be specified.");
return 1; return 1;
} }
String user = vm["user"].as<std::string>(); passwd = vm["passwd"].as<std::string>();
String passwd = vm["passwd"].as<std::string>(); salt = vm.count("salt") ? String(vm["salt"].as<std::string>()) : RandomString(8);
String salt = vm.count("salt") ? String(vm["salt"].as<std::string>()) : RandomString(8);
std::cout << salt << '\n';
if (salt.FindFirstOf('$') != String::NPos) {
Log(LogCritical, "cli", "Salt (--salt) may not contain '$'");
return 1;
}
String hashedPassword = HashPassword(passwd, salt, true); String hashedPassword = HashPassword(passwd, salt, true);
if (vm.count("oneline"))
std::cout << '"' << hashedPassword << "\"\n";
else {
std::cout std::cout
<< "object ApiUser \"" << user << "\" {\n" << "object ApiUser \"" << user << "\" {\n"
<< " password_hash =\"" << hashedPassword << "\"\n" << " password_hash =\"" << hashedPassword << "\"\n"
@ -77,6 +88,7 @@ int ApiUserCommand::Run(const boost::program_options::variables_map& vm, const s
<< "\n" << "\n"
<< " permissions = [ \"*\" ]\n" << " permissions = [ \"*\" ]\n"
<< "}\n"; << "}\n";
}
return 0; return 0;
} }