Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

I've found the way to reload Geoserver by REST (Geoserver Configuration Reload), but my issue is about security of that solution. My reload request is fired from a bash script periodically, so it's written in file. Is there a way to hide the password from other users with root access to the server?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

It's hard, but not impossible, to hide a password, even from root. The trick is to save the password in a password protected keyring (like the Gnome Keyring), unlock the Keyring once and then (from the same session!) run a script like the following (written in python). Please note that even if root can su to your account he still cannot open the Keyring because he has to unlock it first. Unfortunately the password will be visibile to any user viewing the process list on the machine, but that was not the question.

import pygtk
pygtk.require('2.0')
import gtk # sets app name
import gnomekeyring
import os

keyring="login"
# find out the exact ID by running the "Password and Encryption Key" UI
id=3

def getCredentials():
        item = gnomekeyring.item_get_info_sync(keyring, id)
        #    print '%s [%s] %s = %s' % (
        #            id, keyring, item.get_display_name(), item.get_secret())
        return item

if __name__ == '__main__':
    login = getCredentials()
    os.popen("curl -u admin:%s -X POST     http://localhost:8080/geoserver/rest/reload"%(login.get_secret()))

Please remember: you will have to unlock the keyring and then leave that very same session open. Until your session is open the script will happily fetch the password and launch the curl command, but the python script has to run from the same session. If the session is closed for any reason (timeout, reboot, plague, locusts) you will have to manually start a new one.

Read more on the Gnome Keyring.

share|improve this answer
    
don't you just have to put the password for your key ring into the script now? –  iant Sep 19 '11 at 14:53
    
No, you would have to actually type it in in person. Once unlocked the keyring stays open and accessibile for the whole length of the session. –  unicoletti Sep 19 '11 at 15:31

no - that's the whole point of root access, I can read all of your files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.