Passwords in sdm output while using CI/CD

[hpaos]

Hi folks,

we're using gitlab CI/CD for mass-deployments of micro SD cards and successfully utilized sdm for this. While generating a custom image for every card we're deploying, we're also generating a custom user/password combination for every image - and the passwords are shown in sdm's output, nevertheless what redact switches we're using - is there any hint how to hide those passwords? We don't want these to appear in CI/CD logs.

Thanks and happy new year,

hendrik

[gitbls]

Could you be more specific about where the passwords are displayed? The only situation that I'm aware of is where the plugin argument lists are displayed.

Is that what you're referring to?

[hpaos]

Yep, that's the location - plugins are iterated when being parsed and passed arguments are written to STDOUT. I could write a fix to redact passwords if you're good with that.

[gitbls]

In reviewing the code I see that my brilliant past self presciently anticipated your request 🤣. Some of the code is there but it's incomplete, commented out, and obviously not tested.

Would this work for you? If --redact is specified:

• The argument lists would not be printed at all in this section:

2023-12-14 12:19:54 * Plugins selected:
2023-12-14 12:19:54    * user
2023-12-14 12:19:54        Args: userlist=/rpi/etc/sdm/bls-users

would become

2023-12-14 12:19:54 * Plugins selected:
2023-12-14 12:19:54    * user

• The argument list would not be printed at all when a plugin is run. For instance, this

2023-12-14 12:19:54 > Run Plugin 'user' (/mnt/sdm/usr/local/sdm/plugins/user) Phase 0 with arguments: 'userlist=/rpi/etc/sdm/bls-users'

would become

2023-12-14 12:19:54 > Run Plugin 'user' (/mnt/sdm/usr/local/sdm/plugins/user) Phase 0

• The argument list printing done by the plugin such as this:

2023-12-14 12:19:54 > Plugin user: Keys/values found:
2023-12-14 12:19:54    adduser: bls
2023-12-14 12:19:54    uid: 2400
2023-12-14 12:19:54    password: mauisurf

Would become smarter and display

2023-12-14 12:19:54 > Plugin user: Keys/values found:
2023-12-14 12:19:54    adduser: bls
2023-12-14 12:19:54    uid: 2400
2023-12-14 12:19:54    password: REDACTED

where the keys whose values are to be redacted is specified by the plugin

From my perspective, much of the logging is in place for two reasons:

• So you can figure out what happened if something breaks
• So I can figure out whether it's your problem or my problem when an issue is raised

I won't miss the argument list printing if --redact is specified. Will you?

Have you encountered anything of concern that isn't addressed by the above?

[hpaos]

that's pretty much the solution I got on my mind, i'm totally good with it! :)

[gitbls]

OK. Targeted for next release.

[hpaos]

Thanks, that's best news for a good start into 2025 :)

[gitbls]

Looking at the various plugins, there are only a handful that need adjustment. One question: Clearly wifi passwords are sensitive information, but what about SSIDs? Would you consider them to be sensitive from the perspective of your project, regardless of whether or not you actually use them?

EDIT: Never mind. I've concluded that they're sensitive and are thus subject to redaction.

[hpaos]

Ok :)

[hpaos]

Huge Thank you for implementing this! :) Unfortunately, the cleartext password is still visible when printing the entire command line.

[gitbls]

You're going to have to give me a little more info than that! 🤯

Guessing that you mean it's visible on the console when the command line is printed? There's nothing I can do to fix that short of making the command line printer fully context-sensitive, and that is way out of scope.

If you don't want to see passwords on the command line printed on the console, don't put passwords on the command line.

Use a pluglist file (described here: https://github.com/gitbls/sdm/blob/master/Docs/Plugins.md#plugin-overview) for ALL your plugins, or at least all the plugins that have passwords on them.