Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Duplicate: Add sensitive support #857

Open
wants to merge 28 commits into
base: master
Choose a base branch
from
Open

Duplicate: Add sensitive support #857

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
892e593
Add sensitive support
Jul 28, 2022
d975ad9
Fix exposing password for debug mode
Aug 5, 2022
31ac5d7
Lint fixes
Oct 19, 2022
58ec2af
Make mysql db password undef by default
Dec 12, 2022
f34d865
test: fix mysql test for password as variable
teluq-pbrideau Dec 12, 2022
fbb5a45
test: fix postgresql sensitive /root/.pgpass content
teluq-pbrideau Dec 12, 2022
a4ad064
fix: values are already masked when Sensitive type is used within epp
teluq-pbrideau Dec 12, 2022
3ff1d95
fix: use known types (and what tests are using) in zabbix_server.conf…
teluq-pbrideau Dec 12, 2022
2819839
test: cleartext password to not mask part of template
teluq-pbrideau Dec 12, 2022
e5ced74
fix: define settings similar to what was in old erb
teluq-pbrideau Dec 12, 2022
b4729ac
test: fix for the new template (erb to epp)
teluq-pbrideau Dec 12, 2022
2733015
test: cleartext password to not mask part of template
teluq-pbrideau Dec 12, 2022
02662c5
test: fix linter
teluq-pbrideau Dec 12, 2022
e206bbd
fix: linter
teluq-pbrideau Dec 12, 2022
1032eee
test: enable tests of proxy on CentOS
teluq-pbrideau Dec 12, 2022
ee0c75b
fix: define settings similar to what was in old erb
teluq-pbrideau Dec 12, 2022
de0755c
test: cleartext password to not mask part of template
teluq-pbrideau Dec 12, 2022
bdab8bf
test: is_expected_to compile when sensitive password is passed
teluq-pbrideau Dec 12, 2022
1081c1b
test: linter
teluq-pbrideau Dec 12, 2022
1ac4869
fix: add sensitive type for api_pass in web.pp
teluq-pbrideau Dec 13, 2022
90576c9
refactor: Remove vmwareperffrequency parameter
teluq-pbrideau Feb 13, 2023
8cf6557
refactor: remove sslcalocation_dir parameter
teluq-pbrideau Feb 13, 2023
5a4b258
Merge branch 'master' into feat/sensitive_support
teluq-pbrideau Feb 13, 2023
e0e2d07
fix: duplicate parameter after merge
teluq-pbrideau Feb 14, 2023
4080c66
Merge remote-tracking branch 'upstream/master' into feat/sensitive_su…
teluq-pbrideau Jul 3, 2024
fe65cd9
fix: update REFERENCE.md
teluq-pbrideau Jul 3, 2024
887219d
doc: sslcalocation_dir
teluq-pbrideau Jul 3, 2024
0a42efb
fix: add back unsensitive password removed from upstream merge
teluq-pbrideau Jul 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 28 additions & 9 deletions REFERENCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -539,7 +539,7 @@ Default value: `$zabbix::params::server_api_user`

##### <a name="-zabbix--zabbix_api_pass"></a>`zabbix_api_pass`

Data type: `Any`
Data type: `Optional[Variant[String[1], Sensitive[String[1]]]]`

Password of the user which connects to the api. Default: zabbix

Expand Down Expand Up @@ -653,7 +653,7 @@ Default value: `$zabbix::params::server_database_user`

##### <a name="-zabbix--database_password"></a>`database_password`

Data type: `Any`
Data type: `Optional[Variant[String[1], Sensitive[String[1]]]]`

Database password. ignored for sqlite.

Expand Down Expand Up @@ -2290,7 +2290,7 @@ Default value: `$zabbix::params::server_database_user`

##### <a name="-zabbix--database--database_password"></a>`database_password`

Data type: `Any`
Data type: `Optional[Variant[String[1], Sensitive[String[1]]]]`

The password of the database_user.

Expand Down Expand Up @@ -2898,7 +2898,7 @@ Default value: `$zabbix::params::proxy_database_user`

##### <a name="-zabbix--proxy--database_password"></a>`database_password`

Data type: `Any`
Data type: `Optional[Variant[String[1], Sensitive[String[1]]]]`

Database password. ignored for sqlite.

Expand Down Expand Up @@ -3860,7 +3860,7 @@ API username.

##### <a name="-zabbix--resources--web--zabbix_pass"></a>`zabbix_pass`

Data type: `String[1]`
Data type: `Variant[String[1], Sensitive[String[1]]]`

API password.

Expand Down Expand Up @@ -3996,6 +3996,7 @@ The following parameters are available in the `zabbix::server` class:
* [`startreportwriters`](#-zabbix--server--startreportwriters)
* [`webserviceurl`](#-zabbix--server--webserviceurl)
* [`vmwarefrequency`](#-zabbix--server--vmwarefrequency)
* [`vmwareperffrequency`](#-zabbix--server--vmwareperffrequency)
* [`vaultdbpath`](#-zabbix--server--vaultdbpath)
* [`vaulttoken`](#-zabbix--server--vaulttoken)
* [`vaulturl`](#-zabbix--server--vaulturl)
Expand Down Expand Up @@ -4043,6 +4044,7 @@ The following parameters are available in the `zabbix::server` class:
* [`statsallowedip`](#-zabbix--server--statsallowedip)
* [`loadmodulepath`](#-zabbix--server--loadmodulepath)
* [`loadmodule`](#-zabbix--server--loadmodule)
* [`sslcalocation_dir`](#-zabbix--server--sslcalocation_dir)
* [`sslcertlocation_dir`](#-zabbix--server--sslcertlocation_dir)
* [`sslkeylocation_dir`](#-zabbix--server--sslkeylocation_dir)
* [`manage_selinux`](#-zabbix--server--manage_selinux)
Expand Down Expand Up @@ -4269,7 +4271,7 @@ Default value: `$zabbix::params::server_database_user`

##### <a name="-zabbix--server--database_password"></a>`database_password`

Data type: `Any`
Data type: `Optional[Variant[String[1], Sensitive[String[1]]]]`

Database password. ignored for sqlite.

Expand Down Expand Up @@ -4502,6 +4504,15 @@ How often zabbix will connect to vmware service to obtain a new datan.

Default value: `$zabbix::params::server_vmwarefrequency`

##### <a name="-zabbix--server--vmwareperffrequency"></a>`vmwareperffrequency`

Data type: `Any`

Delay in seconds between performance counter statistics retrieval from a single VMware service.
This delay should be set to the least update interval of any VMware monitoring item that uses VMware performance counters.

Default value: `$zabbix::params::server_vmwareperffrequency`

##### <a name="-zabbix--server--vaultdbpath"></a>`vaultdbpath`

Data type: `Optional[String[1]]`
Expand Down Expand Up @@ -4890,17 +4901,25 @@ Module to load at server startup.

Default value: `$zabbix::params::server_loadmodule`

##### <a name="-zabbix--server--sslcalocation_dir"></a>`sslcalocation_dir`

Data type: `Optional[Stdlib::Absolutepath]`

Location of certificate authority (CA) files for SSL server certificate verification.

Default value: `$zabbix::params::server_sslcalocation`

##### <a name="-zabbix--server--sslcertlocation_dir"></a>`sslcertlocation_dir`

Data type: `Any`
Data type: `Optional[Stdlib::Absolutepath]`

Location of SSL client certificate files for client authentication.

Default value: `$zabbix::params::server_sslcertlocation`

##### <a name="-zabbix--server--sslkeylocation_dir"></a>`sslkeylocation_dir`

Data type: `Any`
Data type: `Optional[Stdlib::Absolutepath]`

Location of SSL private key files for client authentication.

Expand Down Expand Up @@ -5312,7 +5331,7 @@ Default value: `$zabbix::params::server_database_user`

##### <a name="-zabbix--web--database_password"></a>`database_password`

Data type: `Any`
Data type: `Optional[Variant[String[1], Sensitive[String[1]]]]`

Database password. ignored for sqlite.

Expand Down
34 changes: 17 additions & 17 deletions manifests/database.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,23 +64,23 @@
# the zabbix_server and zabbix_web parameter.
# @author Werner Dijkerman ikben@werner-dijkerman.nl
class zabbix::database (
$zabbix_type = 'server',
$zabbix_web = $zabbix::params::zabbix_web,
$zabbix_web_ip = $zabbix::params::zabbix_web_ip,
$zabbix_server = $zabbix::params::zabbix_server,
$zabbix_server_ip = $zabbix::params::zabbix_server_ip,
$zabbix_proxy = $zabbix::params::zabbix_proxy,
$zabbix_proxy_ip = $zabbix::params::zabbix_proxy_ip,
$manage_database = $zabbix::params::manage_database,
Zabbix::Databases $database_type = $zabbix::params::database_type,
$database_schema_path = $zabbix::params::database_schema_path,
$database_name = $zabbix::params::server_database_name,
$database_user = $zabbix::params::server_database_user,
$database_password = $zabbix::params::server_database_password,
$database_host = $zabbix::params::server_database_host,
$database_host_ip = $zabbix::params::server_database_host_ip,
$database_charset = $zabbix::params::server_database_charset,
$database_collate = $zabbix::params::server_database_collate,
$zabbix_type = 'server',
$zabbix_web = $zabbix::params::zabbix_web,
$zabbix_web_ip = $zabbix::params::zabbix_web_ip,
$zabbix_server = $zabbix::params::zabbix_server,
$zabbix_server_ip = $zabbix::params::zabbix_server_ip,
$zabbix_proxy = $zabbix::params::zabbix_proxy,
$zabbix_proxy_ip = $zabbix::params::zabbix_proxy_ip,
$manage_database = $zabbix::params::manage_database,
Zabbix::Databases $database_type = $zabbix::params::database_type,
$database_schema_path = $zabbix::params::database_schema_path,
$database_name = $zabbix::params::server_database_name,
$database_user = $zabbix::params::server_database_user,
Optional[Variant[String[1], Sensitive[String[1]]]] $database_password = $zabbix::params::server_database_password,
$database_host = $zabbix::params::server_database_host,
$database_host_ip = $zabbix::params::server_database_host_ip,
$database_charset = $zabbix::params::server_database_charset,
$database_collate = $zabbix::params::server_database_collate,
Optional[String[1]] $database_tablespace = $zabbix::params::server_database_tablespace,
) inherits zabbix::params {
# So lets create the databases and load all files. This can only be
Expand Down
51 changes: 30 additions & 21 deletions manifests/database/mysql.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,18 +11,24 @@
# @param database_path Path to the database executable
# @author Werner Dijkerman <ikben@werner-dijkerman.nl>
class zabbix::database::mysql (
$zabbix_type = '',
$zabbix_version = $zabbix::params::zabbix_version,
$database_schema_path = '',
$database_name = '',
$database_user = '',
$database_password = '',
$database_host = '',
Optional[Stdlib::Port::Unprivileged] $database_port = undef,
$database_path = $zabbix::params::database_path,
$zabbix_type = '',
$zabbix_version = $zabbix::params::zabbix_version,
$database_schema_path = '',
$database_name = '',
$database_user = '',
Optional[Variant[String[1], Sensitive[String[1]]]] $database_password = undef,
$database_host = '',
Optional[Stdlib::Port::Unprivileged] $database_port = undef,
$database_path = $zabbix::params::database_path,
) inherits zabbix::params {
assert_private()

$database_password_unsensitive = if $database_password =~ Sensitive[String] {
$database_password.unwrap
} else {
$database_password
}

if ($database_schema_path == false) or ($database_schema_path == '') {
if versioncmp($zabbix_version, '6.0') >= 0 {
$schema_path = '/usr/share/zabbix-sql-scripts/mysql/'
Expand All @@ -43,34 +49,37 @@
case $zabbix_type {
'proxy': {
$zabbix_proxy_create_sql = versioncmp($zabbix_version, '6.0') >= 0 ? {
true => "cd ${schema_path} && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' ${port}-D '${database_name}' < proxy.sql && touch /etc/zabbix/.schema.done",
false => "cd ${schema_path} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' ${port}-D '${database_name}' < schema.sql && touch /etc/zabbix/.schema.done"
true => "cd ${schema_path} && mysql -h '${database_host}' -u '${database_user}' -p\"\${database_password}\" ${port}-D '${database_name}' < proxy.sql && touch /etc/zabbix/.schema.done",
false => "cd ${schema_path} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p\"\${database_password}\" ${port}-D '${database_name}' < schema.sql && touch /etc/zabbix/.schema.done"
}
}
default: {
$zabbix_server_create_sql = versioncmp($zabbix_version, '6.0') >= 0 ? {
true => "cd ${schema_path} && if [ -f server.sql.gz ]; then gunzip -f server.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' ${port}-D '${database_name}' < server.sql && touch /etc/zabbix/.schema.done",
false => "cd ${schema_path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' ${port}-D '${database_name}' < create.sql && touch /etc/zabbix/.schema.done"
true => "cd ${schema_path} && if [ -f server.sql.gz ]; then gunzip -f server.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p\"\${database_password}\" ${port}-D '${database_name}' < server.sql && touch /etc/zabbix/.schema.done",
false => "cd ${schema_path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p\"\${database_password}\" ${port}-D '${database_name}' < create.sql && touch /etc/zabbix/.schema.done"
}
}
}

# Loading the sql files.
$_mysql_env = ["database_password=${database_password_unsensitive}"]
case $zabbix_type {
'proxy' : {
exec { 'zabbix_proxy_create.sql':
command => $zabbix_proxy_create_sql,
path => "/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:${database_path}",
unless => 'test -f /etc/zabbix/.schema.done',
provider => 'shell',
command => $zabbix_proxy_create_sql,
path => "/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:${database_path}",
unless => 'test -f /etc/zabbix/.schema.done',
provider => 'shell',
environment => $_mysql_env,
}
}
'server' : {
exec { 'zabbix_server_create.sql':
command => $zabbix_server_create_sql,
path => "/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:${database_path}",
unless => 'test -f /etc/zabbix/.schema.done',
provider => 'shell',
command => $zabbix_server_create_sql,
path => "/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:${database_path}",
unless => 'test -f /etc/zabbix/.schema.done',
provider => 'shell',
environment => $_mysql_env,
}
}
default : {
Expand Down
26 changes: 16 additions & 10 deletions manifests/database/postgresql.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,18 +11,24 @@
# @param database_path Path to the database executable
# @author Werner Dijkerman <ikben@werner-dijkerman.nl>
class zabbix::database::postgresql (
$zabbix_type = '',
$zabbix_version = $zabbix::params::zabbix_version,
$database_schema_path = '',
$database_name = '',
$database_user = '',
$database_password = '',
$database_host = '',
Stdlib::Port::Unprivileged $database_port = 5432,
$database_path = $zabbix::params::database_path,
$zabbix_type = '',
$zabbix_version = $zabbix::params::zabbix_version,
$database_schema_path = '',
$database_name = '',
$database_user = '',
Optional[Variant[String[1], Sensitive[String[1]]]] $database_password = undef,
$database_host = '',
Stdlib::Port::Unprivileged $database_port = 5432,
$database_path = $zabbix::params::database_path,
) inherits zabbix::params {
assert_private()

$database_password_unsensitive = if $database_password =~ Sensitive[String] {
$database_password.unwrap
} else {
$database_password
}

if $database_schema_path != false and $database_schema_path != '' {
$schema_path = $database_schema_path
} elsif versioncmp($zabbix_version, '6.0') >= 0 {
Expand Down Expand Up @@ -56,7 +62,7 @@
"PGHOST=${database_host}",
"PGPORT=${database_port}",
"PGUSER=${database_user}",
"PGPASSWORD=${database_password}",
"PGPASSWORD=${database_password_unsensitive}",
"PGDATABASE=${database_name}",
]

Expand Down
4 changes: 2 additions & 2 deletions manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,7 +251,7 @@
Optional[Stdlib::Absolutepath] $ldap_clientkey = $zabbix::params::ldap_clientkey,
Optional[Enum['never', 'allow', 'try', 'demand', 'hard']] $ldap_reqcert = $zabbix::params::ldap_reqcert,
$zabbix_api_user = $zabbix::params::server_api_user,
$zabbix_api_pass = $zabbix::params::server_api_pass,
Optional[Variant[String[1], Sensitive[String[1]]]] $zabbix_api_pass = $zabbix::params::server_api_pass,
Optional[Array[Stdlib::Host,1]] $zabbix_api_access = $zabbix::params::server_api_access,
$listenport = $zabbix::params::server_listenport,
$sourceip = $zabbix::params::server_sourceip,
Expand All @@ -265,7 +265,7 @@
$database_schema = $zabbix::params::server_database_schema,
Boolean $database_double_ieee754 = $zabbix::params::server_database_double_ieee754,
$database_user = $zabbix::params::server_database_user,
$database_password = $zabbix::params::server_database_password,
Optional[Variant[String[1], Sensitive[String[1]]]] $database_password = $zabbix::params::server_database_password,
$database_socket = $zabbix::params::server_database_socket,
$database_port = $zabbix::params::server_database_port,
$database_charset = $zabbix::params::server_database_charset,
Expand Down
8 changes: 5 additions & 3 deletions manifests/params.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@
$ldap_clientcert = undef
$ldap_clientkey = undef
$ldap_reqcert = undef
$server_api_pass = 'zabbix'
$server_api_pass = Sensitive('zabbix')
Copy link
Contributor Author

@teluq-pbrideau teluq-pbrideau Dec 13, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’m not sure if we should set default values as sensitive.

I’ve changed some tests because of this: if the default value is Sensitive, the output may be masked during tests, and the validation cannot be made. These lines are marked with this comment below:

# cleartext password must be explicitly declared in this test, otherwise the parser will secure content of the file

For example, see spec/classes/proxy_spec.rb:115

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO that's okay

$server_api_user = 'Admin'
$server_api_access = undef
$server_database_double_ieee754 = false
Expand All @@ -204,7 +204,7 @@
$server_database_host = 'localhost'
$server_database_host_ip = '127.0.0.1'
$server_database_name = 'zabbix_server'
$server_database_password = 'zabbix_server'
$server_database_password = Sensitive('zabbix_server')
$server_database_port = undef
$server_database_schema = undef
$server_database_socket = undef
Expand Down Expand Up @@ -241,6 +241,7 @@
$server_snmptrapperfile = '/tmp/zabbix_traps.tmp'
$server_sourceip = undef
$server_sshkeylocation = undef
$server_sslcalocation = undef
$server_sslcertlocation = '/usr/lib/zabbix/ssl/certs'
$server_sslkeylocation = '/usr/lib/zabbix/ssl/keys'
$server_startdbsyncers = '4'
Expand Down Expand Up @@ -291,6 +292,7 @@
$server_vaulturl = 'https://127.0.0.1:8200'
$server_vmwarecachesize = '8M'
$server_vmwarefrequency = '60'
$server_vmwareperffrequency = undef
$server_vmwaretimeout = undef
$server_socketdir = undef
$server_hanodename = undef
Expand Down Expand Up @@ -374,7 +376,7 @@
$proxy_proxyconfigfrequency = undef
$proxy_database_host = 'localhost'
$proxy_database_name = 'zabbix_proxy'
$proxy_database_password = 'zabbix-proxy'
$proxy_database_password = Sensitive('zabbix-proxy')
$proxy_database_port = undef
$proxy_database_schema = undef
$proxy_database_socket = undef
Expand Down
Loading
Loading