From 530ba03ecabb472f17d5d1ab546aec9390492de1 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 30 Aug 2010 11:46:47 +0200 Subject: sss_obfuscate tool A tool to add obfuscated passwords into the SSSD config file --- src/man/sss_obfuscate.8.xml | 113 ++++++++++++++++++++++++++++++++++++++++++++ src/tools/sss_obfuscate | 81 +++++++++++++++++++++++++++++++ 2 files changed, 194 insertions(+) create mode 100644 src/man/sss_obfuscate.8.xml create mode 100644 src/tools/sss_obfuscate (limited to 'src') diff --git a/src/man/sss_obfuscate.8.xml b/src/man/sss_obfuscate.8.xml new file mode 100644 index 00000000..55bb1c33 --- /dev/null +++ b/src/man/sss_obfuscate.8.xml @@ -0,0 +1,113 @@ + + + +SSSD Manual pages + + + + + sss_obfuscate + 8 + + + + sss_obfuscate + obfuscate a clear text password + + + + + sss_obfuscate + + options + + [PASSWORD] + + + + + DESCRIPTION + + sss_obfuscate converts a given password into + human-unreadable format and places it into appropriate domain + section of the SSSD config file. + + + The cleartext password can be specified as an extra argument to the + program or read from standard input. + The obfuscated password is put into ldap_default_authtok + parameter of a given SSSD domain and the + ldap_default_authtok_type parameter is set to + obfuscated_password. Refer to + + sssd-ldap + 5 + + for more details on these parameters. + + + Please note that obfuscating the password provides no + real security benefit as it is still possible for an + attacker to reverse-engineer the password back. Using better + authentication mechanisms such as client side certificates or GSSAPI + is strongly advised. + + + + + OPTIONS + + + + + , + + + + The password to obfuscate will be read from standard + input. + + + + + + , + DOMAIN + + + + The SSSD domain to use the password in. The + default name is default. + + + + + + , + FILE + + + + Read the config file specified by the positional + parameter. + + + Default: /etc/sssd/sssd.conf + + + + + + + + SEE ALSO + + + sssd-ldap + 5 + + + + + diff --git a/src/tools/sss_obfuscate b/src/tools/sss_obfuscate new file mode 100644 index 00000000..220cd9be --- /dev/null +++ b/src/tools/sss_obfuscate @@ -0,0 +1,81 @@ +#!/usr/bin/python + +import sys +from optparse import OptionParser + +import pysss +import SSSDConfig + +def parse_options(): + parser = OptionParser() + parser.add_option("-s", "--stdin", action="store_true", + dest="stdin", default=False, + help="Read input from stdin") + parser.add_option("-d", "--domain", + dest="domain", default="default", + help="The domain to use the password in (default: default)", + metavar="DOMNAME") + parser.add_option("-f", "--file", + dest="filename", default=None, + help="Set input file to FILE (default: Use system default, usually /etc/sssd/sssd.conf)", + metavar="FILE") + (options, args) = parser.parse_args() + + # If no password given as positional paramater, read up from stdin + if len(args) == 0: + options.stdin = True + + return options, args + +def main(): + options, args = parse_options() + if not options: + print >>sys.stderr, "Cannot parse options" + return 1 + + if not options.stdin: + try: + password = args[0] + except IndexError: # should never happen + print "Missing password parameter!" + return 1 + else: + try: + password = sys.stdin.read() + except KeyboardInterrupt: + return 1 + + # Obfuscate the password + obfobj = pysss.password() + obfpwd = obfobj.encrypt(password, obfobj.AES_256) + + # Save the obfuscated password into the domain + sssdconfig = SSSDConfig.SSSDConfig() + try: + sssdconfig.import_config(options.filename) + except IOError: + print "Cannot open config file %s" % options.filename + return 1 + + try: + domain = sssdconfig.get_domain(options.domain) + except SSSDConfig.NoDomainError: + print "No such domain %s" % options.domain + return 1 + + try: + domain.set_option('ldap_default_authtok_type', 'obfuscated_password') + domain.set_option('ldap_default_authtok', obfpwd) + except SSSDConfig.NoOptionError: + print "The domain %s does not seem to support the required options" % \ + options.domain + return 1 + + + sssdconfig.save_domain(domain) + sssdconfig.write() + return 0 + +if __name__ == "__main__": + ret = main() + sys.exit(ret) -- cgit