search

pulp / pulp-cli

https://docs.pulpproject.org/pulp_cli/
GNU General Public License v2.0
36 stars 41 forks source link

Pulp CLI takes only plaintext password #821

Closed swetha-swaminathan1 closed 6 months ago

swetha-swaminathan1 commented 10 months ago

Summary

Pulp-CLI currently accepts only plain-text password as input to the pulp config create command. This command creates a cli.toml file which contains the plaintext password. This is an issue as there is a requirement for us that the password must not be visible as plain text in the cli.toml file. Please let me know if a fix can be provided for this (by either accepting an encrypted password or something else). Otherwise, I can try to contribute to the pulp-cli repository with some guidance.

Examples

pulp file repository create --name file_repo1 --username USER --enc_password BASE64PASS (pulp-cli could include this new parameter enc_password which takes base64 encoded password instead of plain text password)

mdellweg commented 10 months ago

We allow certificate based authentication too. If you don not put the password in the config file, you will be asked for it (every single command...).

As a solution for this, would integrating with https://pypi.org/project/SecretStorage/ help? (For securing the password, i would prefer to go all the way.)

swetha-swaminathan1 commented 10 months ago

We allow certificate based authentication too. If you don not put the password in the config file, you will be asked for it (every single command...).

As a solution for this, would integrating with https://pypi.org/project/SecretStorage/ help? (For securing the password, i would prefer to go all the way.)

  1. Password would still be required if i use certificate right? Certificate is just for authentication whereas password is required for authorization.
  2. Regarding sercretStorage, do you mean it will be integrated into pulp?
mdellweg commented 10 months ago

I meant ssl client certs. And you'd need to provide a key. If that was password protected after all, i'm not sure this is supported by pulp-cli. Regarding secret storage: I could see that implemented (actually love to see...). It would use the d-bus secrets interface and by that matter integrate with all common Linux desktop environments.

ggainey commented 8 months ago

We had some great discussion around this at the latest cli-mtg It would be a great addition to pulp-cli, if it were taught how to take advantage of SecretStorage (as linked in those minutes!) We absolutely would love a PR that implemented such a thing!