From b70fcc845696f58b2a5d36039df5f2c8c1dd2e04 Mon Sep 17 00:00:00 2001 From: asq Date: Thu, 3 Apr 2014 17:15:37 +0200 Subject: add option to generate shell-safe passwords basically excludes characters that might be dangerous if used in shell. many passwords generated by trocla may end up in some sort of bash scripts (initscripts, sourced shell variables, etc) which may yeld problems with default trocla random generator. this can be now changed either in troclarc (with "shellsafe: true") or on (ie. "trocla create foo plain '{ length: 32, shellsafe: true}'"). --- lib/trocla.rb | 2 +- lib/trocla/util.rb | 14 ++++++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/lib/trocla.rb b/lib/trocla.rb index 4e7bedb..7755149 100644 --- a/lib/trocla.rb +++ b/lib/trocla.rb @@ -22,7 +22,7 @@ class Trocla plain_pwd = get_password(key,'plain') if options['random'] && plain_pwd.nil? - plain_pwd = Trocla::Util.random_str(options['length']) + plain_pwd = Trocla::Util.random_str(options['length'],options['shellsafe']) set_password(key,'plain',plain_pwd) unless format == 'plain' elsif !options['random'] && plain_pwd.nil? raise "Password must be present as plaintext if you don't want a random password" diff --git a/lib/trocla/util.rb b/lib/trocla/util.rb index 2b1c6c6..ff7e3ce 100644 --- a/lib/trocla/util.rb +++ b/lib/trocla/util.rb @@ -2,8 +2,12 @@ require 'securerandom' class Trocla class Util class << self - def random_str(length=12) - (1..length).collect{|a| chars[SecureRandom.random_number(chars.size)] }.join.to_s + def random_str(length=12,shellsafe=:undef) + if shellsafe + (1..length).collect{|a| safechars[SecureRandom.random_number(safechars.size)] }.join.to_s + else + (1..length).collect{|a| chars[SecureRandom.random_number(chars.size)] }.join.to_s + end end def salt(length=8) @@ -14,12 +18,18 @@ class Trocla def chars @chars ||= normal_chars + special_chars end + def safechars + @chars ||= normal_chars + shellsafe_chars + end def normal_chars @normal_chars ||= ('a'..'z').to_a + ('A'..'Z').to_a + ('0'..'9').to_a end def special_chars @special_chars ||= "+*%/()@&=?![]{}-_.,;:".split(//) end + def shellsafe_chars + @shellsafe_chars ||= "+%/@=?_.,:".split(//) + end end end end -- cgit v1.2.3 From 9f21b44da1ec9b24820ac08e2e4d1e171fabbf7e Mon Sep 17 00:00:00 2001 From: asq Date: Thu, 3 Apr 2014 19:02:02 +0200 Subject: puppet will convert all values to string, so we need to convert it back to integer for ranges ie. for this to work: $short_and_safe = { 'shellsafe' => 'true', 'length' => 6, # THIS WILL BE STRING! } $x = trocla('foo', 'plain', $short_and_safe) notify { "test: $x": } --- lib/trocla.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/trocla.rb b/lib/trocla.rb index 7755149..74825aa 100644 --- a/lib/trocla.rb +++ b/lib/trocla.rb @@ -22,7 +22,7 @@ class Trocla plain_pwd = get_password(key,'plain') if options['random'] && plain_pwd.nil? - plain_pwd = Trocla::Util.random_str(options['length'],options['shellsafe']) + plain_pwd = Trocla::Util.random_str(options['length'].to_i,options['shellsafe']) set_password(key,'plain',plain_pwd) unless format == 'plain' elsif !options['random'] && plain_pwd.nil? raise "Password must be present as plaintext if you don't want a random password" -- cgit v1.2.3 From eabd41b10fa6da986e7e5ee2e3d93d3f19100c49 Mon Sep 17 00:00:00 2001 From: Anna Janackova Date: Tue, 24 Jun 2014 08:09:43 +0200 Subject: adds charset option for generating plain passwords --- lib/trocla.rb | 32 ++++++++++++++++---------------- lib/trocla/util.rb | 6 ++++-- 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/lib/trocla.rb b/lib/trocla.rb index 74825aa..a239be8 100644 --- a/lib/trocla.rb +++ b/lib/trocla.rb @@ -3,11 +3,11 @@ require 'trocla/util' require 'trocla/formats' class Trocla - + def initialize(config_file=nil) if config_file @config_file = File.expand_path(config_file) - elsif File.exists?(def_config_file=File.expand_path('~/.troclarc.yaml')) || File.exists?(def_config_file=File.expand_path('/etc/troclarc.yaml')) + elsif File.exists?(def_config_file=File.expand_path('~/.troclarc.yaml')) || File.exists?(def_config_file=File.expand_path('/etc/troclarc.yaml')) @config_file = def_config_file end end @@ -20,27 +20,27 @@ class Trocla return password end - plain_pwd = get_password(key,'plain') + plain_pwd = get_password(key,'plain') if options['random'] && plain_pwd.nil? - plain_pwd = Trocla::Util.random_str(options['length'].to_i,options['shellsafe']) - set_password(key,'plain',plain_pwd) unless format == 'plain' + plain_pwd = Trocla::Util.random_str(options['length'].to_i,options['charset']) + set_password(key,'plain',plain_pwd) unless format == 'plain' elsif !options['random'] && plain_pwd.nil? raise "Password must be present as plaintext if you don't want a random password" end set_password(key,format,Trocla::Formats[format].format(plain_pwd,options)) end - + def get_password(key,format) cache.fetch(key,{})[format] end - + def reset_password(key,format,options={}) set_password(key,format,nil) password(key,format,options) end - + def delete_password(key,format=nil) - if format.nil? + if format.nil? cache.delete(key) else old_val = (h = cache.fetch(key,{})).delete(format) @@ -48,7 +48,7 @@ class Trocla old_val end end - + def set_password(key,format,password) if (format == 'plain') h = (cache[key] = { 'plain' => password }) @@ -57,22 +57,22 @@ class Trocla end h[format] end - + private def cache @cache ||= build_cache end - + def build_cache require 'moneta' lconfig = config Moneta.new(lconfig['adapter'], lconfig['adapter_options']||{}) end - + def config @config ||= read_config end - + def read_config if @config_file.nil? default_config @@ -81,10 +81,10 @@ class Trocla default_config.merge(YAML.load(File.read(@config_file))) end end - + def default_config require 'yaml' YAML.load(File.read(File.expand_path(File.join(File.dirname(__FILE__),'trocla','default_config.yaml')))) end - + end diff --git a/lib/trocla/util.rb b/lib/trocla/util.rb index ff7e3ce..2826c9e 100644 --- a/lib/trocla/util.rb +++ b/lib/trocla/util.rb @@ -2,8 +2,10 @@ require 'securerandom' class Trocla class Util class << self - def random_str(length=12,shellsafe=:undef) - if shellsafe + def random_str(length=12, charset=:undef) + if charset == 'alphanumeric' + (1..length).collect{|a| normal_chars[SecureRandom.random_number(normal_chars.size)] }.join.to_s + elsif charset == 'special_shellsafe' (1..length).collect{|a| safechars[SecureRandom.random_number(safechars.size)] }.join.to_s else (1..length).collect{|a| chars[SecureRandom.random_number(chars.size)] }.join.to_s -- cgit v1.2.3