freeipa

#4517 [RFE] ipa-server-install and other server-configuring programs should be able to read password from env, file, and filehandle
Opened by adelton. Modified

Open
Close Issue

This is server-side version of https://fedorahosted.org/freeipa/ticket/4040:

currently, in unattended runs, passwords need to be specified as command line parameters that will show up in ps / /proc outputs.

We need a way to pass the passwords without the words being disclosed to other users on the system. The ideas include reading them from environment variables, files, or filehandles.

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1211603

This ticket is not critical for 4.2 GA and can be done in follow-up stabilization release - postponing.

I like the idea of a config file. We could use the same keys as the long options (excluding --). Later we can extend the feature to get all options from the config file:

options

$ ipa-server-install --help
    ...
    -p DM_PASSWORD, --ds-password=DM_PASSWORD
                        Directory Manager password
    -P MASTER_PASSWORD, --master-password=MASTER_PASSWORD
                        kerberos master password (normally autogenerated)
    -a ADMIN_PASSWORD, --admin-password=ADMIN_PASSWORD
                        admin user kerberos password

config file

ds-password=
master-password=
admin-password=

We want this patch, it is just not in rush any more.

FreeIPA 4.2.1 was released, moving to 4.2.x.

master:

  • 39f6f637a7a5714a6801a1a11483f94d856c14bd install: Support overriding knobs in subclasses
  • bed64a888a5c02f389d8d744ff2b327082830fbe install: Add common base class for server and replica install
  • 86edd6abeb9749e159a529b83cfce6443fff4ba5 install: Move unattended option to the general help section

ipa-4-2:

  • 8040a0ed0ba58a32d8071bbb206ea4b963311d06 install: Support overriding knobs in subclasses
  • 61170a4295b071378804f72d8cf88e988f1ded02 install: Add common base class for server and replica install
  • 42d16b02cd153ac89ebd8ae07c98611dc3b6e471 install: Move unattended option to the general help section

master:

  • 74da4f5870edda85039b3bba52fb0a578676fb44 Replica inst. fix: do not require -r, -a, -p options in unattended mode

ipa-4-2:

  • ad285897f54190fd0113209f32fce7f37fb0ce77 Replica inst. fix: do not require -r, -a, -p options in unattended mode

ipa-4-2:

  • 75a8454caeeaf293c0b6be48f2b8476e7707447f install: fix ipa-server-install fail on missing --forwarder

master:

  • 6067824be494745926204a7ba3709c3c0f054326 install: fix ipa-server-install fail on missing --forwarder

see also #6314

Continuation of this effort should wait for installer refactoring.

Metadata Update from @adelton:
- Issue assigned to mbabinsk
- Issue set to the milestone: FreeIPA 4.5

Metadata Update from @pvoborni:
- Issue close_status updated to: None
- Issue set to the milestone: FreeIPA 4.7 (was: FreeIPA 4.5)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone
Metadata
None
None
None
Normal
enhancement
Installation
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.