-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
6.10.0
-
False
-
-
False
-
CLOSED
-
0
-
Platform
-
-
-
Low
-
None
Description of problem:
The password for `satellite-change-hostname` is passed on command line. This is not good practice as the password can be captured using the `ps aux` command if executed in the time window when the `sattelite-change-hostname` process is running.
Version-Release number of selected component (if applicable):
satellite-6.10.0-0.9.beta.el7sat.noarch
How reproducible:
always
Steps to Reproduce:
1. run `satellite-change-hostname dhcp-2-193.vms.sat.rdu2.redhat.com -u admin -p PASSWORD`
2. in parallel with step 1. run `ps aux | grep satellite`
3.
Actual results:
[root@localhost ~]# ps aux | grep sat
root 43075 2.3 0.0 211388 20128 pts/0 Sl+ 08:22 0:00 ruby /usr/sbin/satellite-change-hostname dhcp-2-193.vms.sat.rdu2.redhat.com -u admin -p PASSWORD
Expected results:
- There is a way to pass the password using environ variable for scripted scenarios
- The password can be read from the prompt.
- There is no way to input the password trough insecure channel like command line
Additional info: