[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Bacula-devel] Security reports


Dan Langille wrote:
This post deals with old and already fixed security issues. They are fixed in Bacula. They may not be fixed in the reported vendor code, in this case Gentoo.

I noticed these two security reports today:

  http://www.securityfocus.com/archive/1/494604
  http://www.net-security.org/advisory.php?id=9098

I have replied to the first one, directing them to the original problem report: http://bugs.bacula.org/view.php?id=990

NOTE: this issue was first documented in 2005 by the Bacula project. The documentation contains several examples as to how to avoid this situation.

I modified the make_catalog_backup to provide db password on stdin.
Then I call the script with
 (echo password; exec sleep 1) | make_catalog_backup bacula bacula -
to hide the password on the command line.

Patch attached.

P.S.: Since password may be retrieved in the environment of
   make_catalog_backup, I defined also a read-only dbuser
   who do the catalog backup.

--
Tullio Andreatta
09:f9:11:02:9d:74:e3:5b:d8:41:56:c5:63:56:88:c0
45:5f:e1:04:22:ca:29:c4:93:3f:95:05:2b:79:2a:b2

Disclaimer: "Please treat this email message in a reasonable way, or we
    might get angry" ( http://www.goldmark.org/jeff/stupid-disclaimers )

diff -urN bacula-2.4.1.orig/src/cats/make_catalog_backup.in bacula-2.4.1/src/cats/make_catalog_backup.in
--- bacula-2.4.1.orig/src/cats/make_catalog_backup.in   2007-10-22 23:47:58.000000000 +0200
+++ bacula-2.4.1/src/cats/make_catalog_backup.in        2008-07-22 09:28:49.000000000 +0200
@@ -7,12 +7,11 @@
 #     of the output file (default = bacula).
 #  $2 is the user name with which to access the database
 #     (default = bacula).
-#  $3 is the password with which to access the database or "" if no password
-#     (default ""). WARNING!!! Passing the password via the command line is 
-#     insecure and should not be used since any user can display the command 
-#     line arguments and the environment using ps.  Please consult your
-#     MySQL or PostgreSQL manual for secure methods of specifying the
-#     password.
+#  $3 is the password with which to access the database or "-" if password
+#     is provided on standard input or "" if no password (default "").
+#     WARNING!!! Passing the password via the command line is insecure and
+#     should not be used since any user can display the command line
+#     arguments and the environment using ps.
 #  $4 is the host on which the database is located
 #     (default "")
 #
@@ -26,20 +25,25 @@
 else
   if test xmysql = x@DB_TYPE@ ; then
     if test $# -gt 2; then
-      MYSQLPASSWORD=" --password=$3"
-    else
-      MYSQLPASSWORD=""
+      case "$3" in
+      -) read MYSQL_PWD || exit 1 ;;
+      *) MYSQL_PWD="$3" ;;
+      esac
+      export MYSQL_PWD
     fi
     if test $# -gt 3; then
       MYSQLHOST=" --host=$4"
     else
       MYSQLHOST=""
     fi
-    ${BINDIR}/mysqldump -u ${2}${MYSQLPASSWORD}${MYSQLHOST} -f --opt $1 >$1.sql
+    ${BINDIR}/mysqldump -u ${2} ${MYSQLHOST} -f --opt $1 >$1.sql
   else                       
     if test xpostgresql = x@DB_TYPE@ ; then
       if test $# -gt 2; then
-       PGPASSWORD=$3
+        case "$3" in
+        -) read PGPASSWORD || exit 1 ;;
+        *) PGPASSWORD="$3" ;;
+        esac
        export PGPASSWORD
       fi
       if test $# -gt 3; then
diff -urN bacula-2.4.1.orig/src/dird/bacula-dir.conf.in bacula-2.4.1/src/dird/bacula-dir.conf.in
--- bacula-2.4.1.orig/src/dird/bacula-dir.conf.in       2008-06-19 21:44:34.000000000 +0200
+++ bacula-2.4.1/src/dird/bacula-dir.conf.in    2008-07-22 09:22:09.000000000 +0200
@@ -61,11 +61,11 @@
   FileSet="Catalog"
   Schedule = "WeeklyCycleAfterBackup"
   # This creates an ASCII copy of the catalog
+  # Arguments to make_catalog_backup are:
+  #  make_catalog_backup <database-name> <user-name> <password|-> <host>
   # WARNING!!! Passing the password via the command line is insecure.
   # see comments in make_catalog_backup for details.
-  # Arguments to make_catalog_backup are:
-  #  make_catalog_backup <database-name> <user-name> <password> <host>
-  RunBeforeJob = "@scriptdir@/make_catalog_backup @db_name@ @db_user@"
+  RunBeforeJob = "(echo @db_password@; exec sleep 1) | @scriptdir@/make_catalog_backup @db_name@ @db_user@ - localhost"
   # This deletes the copy of the catalog
   RunAfterJob  = "@scriptdir@/delete_catalog_backup"
   Write Bootstrap = "@working_dir@/BackupCatalog.bsr"
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Bacula-devel mailing list
Bacula-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/bacula-devel


This mailing list archive is a service of Copilotco.