Todo #10349: status.php: Sanitize ldapbindpass and ldap_pass - pfSense - pfSense bugtracker

Actions

Copy link

Todo #10349

closed

status.php: Sanitize ldapbindpass and ldap_pass

Added by Viktor Gurov almost 5 years ago. Updated over 4 years ago.

Status:

Resolved

Priority:

Normal

Assignee:

Jim Pingle

Category:

Diagnostics

Target version:

2.4.5-p1

Start date:

03/16/2020

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

Release Notes:

Description

config-sanitized.xml contains clear-text passwords:
<ldapbindpass> - squidguard LDAP DN Password (squidguard.xml)
<ldap_pass> - squid LDAP Password (squid_auth.xml)

Actions

Copy link

Updated by Viktor Gurov almost 5 years ago

This PR also removes double lighttpd_ls_password and sorts all values alphabetically:
https://gitlab.netgate.com/pfSense/pfSense/merge_requests/2

Actions

Copy link

Updated by Jim Pingle almost 5 years ago

Status changed from New to Pull Request Review

See comments on the PR

Actions

Copy link

Updated by Jim Pingle almost 5 years ago

Tracker changed from Bug to Todo
Project changed from pfSense Packages to pfSense
Category changed from Squid to Diagnostics
Assignee set to Jim Pingle
Target version set to 2.5.0

Actions

Copy link

Updated by Viktor Gurov almost 5 years ago

https://github.com/pfsense/pfsense/pull/4239

Actions

Copy link

Updated by Renato Botelho almost 5 years ago

Status changed from Pull Request Review to Feedback
% Done changed from 0 to 100

PR has been merged. Thanks!

Actions

Copy link

Updated by Viktor Gurov over 4 years ago

OK on 2.5.0.a.20200323.0902:

# grep "ldap.*pass" /cf/conf/config.xml
                <ldap_pass>123456</ldap_pass>
                <ldapbindpass>123</ldapbindpass>
# grep "ldap.*pass" config-sanitized.xml 
                <ldap_pass>xxxxx</ldap_pass>
                <ldapbindpass>xxxxx</ldapbindpass>

Renato Botelho wrote: