Originally reported as https://bugzilla.redhat.com/show_bug.cgi?id=667326

Bugzilla Report

Description of problem

'-s' option in sss_obfuscate command is a bit redundant and functions the same
even without '-s' option.

Version-Release number of selected component (if applicable)

sssd-1.5.1-0.2010122318git375e3e4.el6.x86_64

How reproducible

Always

Steps to Reproduce

1. Configure a native ldap domain as specified in "Additional info" section.
2. Execute "sss_obfuscate -d LDAP"
3. Enter password and press "CTRL-d".

Actual results

Obfuscated password gets added to the domain.

Expected results

Either the password should be a command line option for "sss_obfuscate" or '-s'
should be used to read input from stdin. The current behaviour of reading
password from stdin without '-s' makes this option a bit redundant.

No password and without '-s' option should display the usage message.

Additional info

[domain/LDAP]
ldap_tls_reqcert = never
ldap_id_use_start_tls = False
cache_credentials = False
ldap_search_base = dc=example,dc=com
id_provider = ldap
auth_provider = ldap
ldap_default_bind_dn = uid=puser1,ou=People,dc=example,dc=com
ldap_tls_cacertdir = /etc/openldap/cacerts
debug_level = 9
min_id = 1000
ldap_uri = ldaps://ldap.server.redhat.com:636
enumerate = True
ldap_schema = rfc2307
ldap_tls_cacert = /etc/openldap/cacerts/cacert.asc

Solution

The -s option does seem redundant, yes. It should probably be removed. I don't
think we want to pass the password at the commandline, though. That's
vulnerable to process-monitoring programs to see what the password was.

This is why we have the -f/--file option to sss_obfuscate. It guarantees that
the password isn't visible in the process table.

I think our approach here should be to drop the -s option and update the
manpage to note that the password is read from stdin unless -f is specified.