Merge branch 'dev' into f-versioning

CHANGELOG.md

@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-* `Entity/names` resource for retrieving all known entity names.
+- `Entity/names` resource for retrieving all known entity names.
 - Scripting is simplified by adding a `home` directory, of which a copy is
   created for each called script and set as the `HOME` environment variable.
 - [bend_symlinks.sh](misc/bend_symlinks/bend_symlinks.sh) (version 0.1, experimental)
@@ -36,26 +36,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-* #27 - star matches slashes (e.g. for `FIND ... STORED AT /*.dat`).
-
-* #30 - file path cannot be in quotes
-
+- #27 - star matches slashes (e.g. for `FIND ... STORED AT /*.dat`).
+- #30 - file path cannot be in quotes
 - #46 - Server-side scripting failed as an unprivileged user because the was no
   writable home directory.
-
 - NaN Double Values (see #41)
-
 - #14 - Handle files on file system without File entity: Those entries are
   returned without ID but with a notice now.
-
-* #11 - pam_authentication leaks the password to unprivileged processes on the
+- #11 - pam_authentication leaks the password to unprivileged processes on the
   same machine.
 
 ### Security (in case of vulnerabilities)
 
 - TLS is by default restricted to v1.2 and v1.3 now.
-* #11 - pam_authentication leaks the password to unprivileged processes on the
-  same machine.
+- #11 - `pam_authentication` and `ldap_authentication.sh` leaked the password to unprivileged
+  processes on the same machine.
+- #68 - Shadow sensitive information when logging for debugging purposes.
 
 
 ## [0.1.0] - 2018-10-09

misc/pam_authentication/ldap.conf

@@ -2,6 +2,6 @@
 
 
 # Set the ldap server here.  This is also used to generate a fully qualified
-# user name.
+# user name: <USER>@$LDAP_SERVER
 
 # LDAP_SERVER="example.com"

misc/pam_authentication/ldap_authentication.sh

@@ -21,10 +21,10 @@
 #
 # ** end header
 
-# Try to authenticate a user ($1) with a password ($2) via LDAP
+# Try to authenticate a user ($1) via LDAP, either via stdin or a password file ($2, if given).
 
-[[ "$#" == "2" ]] || {
-    echo "call this script with two arguments: user and password"
+[[ "$#" == "1" || "$#" == "2" ]] || {
+    echo "Call this script as: $0 <user> [<password file>]"
     exit 1
 }
 
@@ -33,11 +33,17 @@
 exe_dir=$(dirname $0)
 . "$exe_dir/"ldap.conf
 
+# If the second argument is empty or "-", take password from stdin, else use the argument as a file.
 testpw() {
     username="${1}@${LDAP_SERVER}"
-    pw="$2"
+    pwfile="$2"
+    pwargs=("-w" "$pwfile")
+    if [[ $pwfile == "-" ]] ; then
+        pwargs=("-W")
+    fi
 
-    if timeout 5s ldapwhoami -x -H "ldap://$LDAP_SERVER" -D "$username" -w "$pw"; then
+    export LDAPTLS_REQCERT=ALLOW
+    if timeout 5s ldapwhoami -x -H "ldaps://$LDAP_SERVER" -D "$username" "${pwargs[@]}"; then
         return 0
     else
         ret_code="$?"
@@ -48,7 +54,7 @@ testpw() {
         return "$ret_code"
     fi
 
-    ldapwhoami -x -H "ldap://$LDAP_SERVER" -D "$username" -w "$pw"
+    ldapwhoami -x -H "ldaps://$LDAP_SERVER" -D "$username" "${pwargs[@]}"
 
 }
 

src/main/java/caosdb/server/ServerProperties.java

@@ -170,7 +170,10 @@ public class ServerProperties extends Properties {
       ArrayList<String> names = new ArrayList<>(serverProperties.stringPropertyNames());
       Collections.sort(names);
       for (String name : names) {
-        String val = name.contains("PASSW") ? "****" : serverProperties.getProperty(name);
+        String val =
+            (name.contains("PASSW") || name.contains("SECRET"))
+                ? "****"
+                : serverProperties.getProperty(name);
         logger.info(name + "=" + val);
       }
     }