3

I've found the way to reload Geoserver by REST (Geoserver Configuration Reload), but my issue is about security of that solution. My reload request is fired from a bash script periodically, so it's written in file. Is there a way to hide the password from other users with root access to the server?

4

It's hard, but not impossible, to hide a password, even from root. The trick is to save the password in a password protected keyring (like the Gnome Keyring), unlock the Keyring once and then (from the same session!) run a script like the following (written in python). Please note that even if root can su to your account he still cannot open the Keyring because he has to unlock it first. Unfortunately the password will be visibile to any user viewing the process list on the machine, but that was not the question.

import pygtk
pygtk.require('2.0')
import gtk # sets app name
import gnomekeyring
import os

keyring="login"
# find out the exact ID by running the "Password and Encryption Key" UI
id=3

def getCredentials():
        item = gnomekeyring.item_get_info_sync(keyring, id)
        #    print '%s [%s] %s = %s' % (
        #            id, keyring, item.get_display_name(), item.get_secret())
        return item

if __name__ == '__main__':
    login = getCredentials()
    os.popen("curl -u admin:%s -X POST     http://localhost:8080/geoserver/rest/reload"%(login.get_secret()))

Please remember: you will have to unlock the keyring and then leave that very same session open. Until your session is open the script will happily fetch the password and launch the curl command, but the python script has to run from the same session. If the session is closed for any reason (timeout, reboot, plague, locusts) you will have to manually start a new one.

Read more on the Gnome Keyring.

  • don't you just have to put the password for your key ring into the script now? – Ian Turton Sep 19 '11 at 14:53
  • No, you would have to actually type it in in person. Once unlocked the keyring stays open and accessibile for the whole length of the session. – unicoletti Sep 19 '11 at 15:31
1

no - that's the whole point of root access, I can read all of your files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.